Sentry
Watches the prompt box on managed endpoints and decides before the data leaves.
What changes for the organisation
Staff stop pasting your customer data into ChatGPT — without you having to block ChatGPT.
How it works
The enterprise content-analysis connector covers paste, drag-drop, file-attach and print; a force-installed extension covers typed text. Both call the verdict service, which resolves policy within a p95 of 150 ms and returns log, warn, or block with a named category.
What it watches
- AD-joined Windows endpoints running managed Chrome or Edge
- Input paths: typed text, paste, drag-and-drop, file attach, print
- Destinations resolved against a signed, versioned catalog — ChatGPT, Claude, Gemini, Copilot, DeepSeek, regional services, and your own internal endpoints
- Everything else — other browsers, desktop AI apps, API and script traffic — is seen but not blocked, and feeds the shadow-AI inventory
How it actually works
The mechanism, not the marketing. If a step below would not survive an engineer's scrutiny, it should not be on this page.
1
Two capture paths, because one has a structural gap
The Chrome and Edge enterprise content-analysis connector is registered by policy and called by the browser over a local socket before content reaches the page. The browser blocks awaiting our verdict — which is what makes it fail-closed capable. It fires on paste, drag-drop, file attach and print. It does not fire on typed text. Any vendor claiming connector-only coverage is claiming something the connector cannot do.
2
The extension covers the keyboard, at DOM level
Force-installed by GPO or MDM and injected only into origins matching the destination catalog. It resolves the prompt composer — rarely a plain textarea, since ChatGPT, Claude and Gemini all use contenteditable rich-text editors — then observes it with a MutationObserver over the composer subtree plus debounced beforeinput events.
3
Interception sits on the submit path, not on a timer
Capture-phase keydown for Enter, the send-button click, and form submit are all intercepted before the page's own handler runs, with fetch and XMLHttpRequest hooked in the main world as a backstop for programmatic submission. Nothing is scraped speculatively; we act at the moment of egress.
4
Verdict over mTLS, then a closed shadow root
Content goes to the on-LAN verdict service authenticated by the machine's own AD identity — p95 under 150 ms at rated QPS. The warn dialog mounts in a closed shadow root, so the destination page can neither restyle it nor read what it says.
5
Detection runs deterministic-first, model-last
Checksum country-ID packs, Luhn, IBAN, entropy-scored secrets and language identification resolve in sub-millisecond time. Exact Data Match against salted hashes of your crown-jewel records and document fingerprinting run next. Multilingual model classification runs only on what remains — and never hard-blocks by default.
6
Absence is itself an alarm
If the extension is missing, downgraded, or stops reporting, the endpoint raises gone-dark and the coverage dashboard stops counting that machine as protected. Coverage is proven per machine, not inferred from a deployment count.
Operating path
From signal to auditable evidence
01Observed inputs
- AD-joined Windows endpoints running managed Chrome or Edge
- Input paths: typed text, paste, drag-and-drop, file attach, print
- Destinations resolved against a signed, versioned catalog — ChatGPT, Claude, Gemini, Copilot, DeepSeek, regional services, and your own internal endpoints
02Deterministic workflow
- 1 Two capture paths, because one has a structural gap The Chrome and Edge enterprise content-analysis connector is registered by policy and called by the browser over a local socket before content reaches the page. The browser blocks awaiting our verdict — which is what makes it fail-closed capable. It fires on paste, drag-drop, file attach and print. It does not fire on typed text. Any vendor claiming connector-only coverage is claiming something the connector cannot do.
- 2 The extension covers the keyboard, at DOM level Force-installed by GPO or MDM and injected only into origins matching the destination catalog. It resolves the prompt composer — rarely a plain textarea, since ChatGPT, Claude and Gemini all use contenteditable rich-text editors — then observes it with a MutationObserver over the composer subtree plus debounced beforeinput events.
- 3 Interception sits on the submit path, not on a timer Capture-phase keydown for Enter, the send-button click, and form submit are all intercepted before the page's own handler runs, with fetch and XMLHttpRequest hooked in the main world as a backstop for programmatic submission. Nothing is scraped speculatively; we act at the moment of egress.
- 4 Verdict over mTLS, then a closed shadow root Content goes to the on-LAN verdict service authenticated by the machine's own AD identity — p95 under 150 ms at rated QPS. The warn dialog mounts in a closed shadow root, so the destination page can neither restyle it nor read what it says.
- 5 Detection runs deterministic-first, model-last Checksum country-ID packs, Luhn, IBAN, entropy-scored secrets and language identification resolve in sub-millisecond time. Exact Data Match against salted hashes of your crown-jewel records and document fingerprinting run next. Multilingual model classification runs only on what remains — and never hard-blocks by default.
- 6 Absence is itself an alarm If the extension is missing, downgraded, or stops reporting, the endpoint raises gone-dark and the coverage dashboard stops counting that machine as protected. Coverage is proven per machine, not inferred from a deployment count.
03Evidence outputs
- One immutable event per capture, verdict, warn, override, block and dispute
- Evidence capture is per rule: none, masked snippet, or full content — with none required where storing matched content would itself breach classification handling
- Override justifications stored under evidence-class protection, because free text typed at the moment of handling sensitive data is content, not metadata
A case
A finance analyst pastes 200 customer rows into ChatGPT
The single most common way sensitive data reaches a public model — and the one a network control cannot see, because the session is TLS to a legitimate business domain.
14:32:07
Paste into the ChatGPT composer. The browser calls the local connector and blocks before the content reaches the page.
14:32:07.04
Verdict service: 47 NRIC checksum matches, plus 12 Exact Data Match hits against the enrolled customer-account table. Crown-jewel EDM is a high-precision class, so the rule action is hard-block.
14:32:07.06
Policy resolves. The user is in SG-FIN-Analysts, which is at enforce stage, so no downgrade applies. No exception is active. Final action: block.
14:32:07.09
Verdict returned in 91 ms. The paste is never delivered to the page — the content did not reach ChatGPT's DOM, let alone its servers.
What she sees
A dialog naming the category — “customer account records detected” — showing none of the matched content, offering the sanctioned internal assistant instead.
14:32:41
She clicks through to the internal assistant and pastes again. Re-evaluated against the internal destination profile: NRIC downgrades to log-only, but EDM still blocks. Sanctioned is not unmonitored.
14:33:15
She removes the account-number column and proceeds. The work gets done.
What the SOC sees
One block, one redirect-taken, one successful re-submission. Her third override this week aggregates into an incident under the repeated-override rule.
What it came to
Nothing was leaked, nothing was silently swallowed, and the analyst finished her task 68 seconds later on an approved path. Blocking the destination outright would have cost the same task an afternoon and a shadow-AI workaround.
How a decision gets made
The authority ladder. Green rungs are authoritative — a rule, a scanner, a sandbox, or a person. Blue is where the model contributes. Amber is where a human decides.
03
Model classification
Multilingual encoder classification runs last, on EN/ZH, MS/ID, VI and TH — including code-switched input, which in this region is the norm rather than an edge case.
04
Policy and the user
Action defaults bind to detector precision class. Hard-block is reserved for high-precision detectors; model-based classification defaults to warn-then-confirm.
What the model adds
Semantic classification of content that no deterministic pattern describes — the company-confidential material that is sensitive because of what it means, not because of how it is shaped.
What it cannot claim
It cannot escalate its own verdict. A model-based classification does not hard-block by default, because at real-world classification precision a block-by-default posture produces false blocks at fleet scale. That posture was considered and rejected.
What it will never do
- Never echoes the matched content back in the warn dialog. It names the category — “Singapore NRIC detected” — and shows nothing.
- Never hard-blocks on a model-only classification by default. You may raise any rule to hard-block; the product will not do it for you.
- Never claims to cover what it does not. The coverage matrix is published per input path × egress path, and voice, images, personal devices and non-Windows endpoints are named as out of scope.
- Never accepts an unauthenticated verdict request. Endpoints authenticate with machine identity; the verdict API carries your most sensitive content and is not callable by arbitrary LAN hosts.
What evidence it leaves
- One immutable event per capture, verdict, warn, override, block and dispute
- Evidence capture is per rule: none, masked snippet, or full content — with none required where storing matched content would itself breach classification handling
- Override justifications stored under evidence-class protection, because free text typed at the moment of handling sensitive data is content, not metadata
- Every evidence reveal is itself an event: who viewed what, when
See it work
Status and what promotion requires
Committed v1 scope. Shipping.
Roles that touch it
End UserPolicy AdminSOC AnalystAuditor / Compliance