Compliance evidence that never leaves your device.
Locke turns local detections into reports for regulators, auditors and your own records. Nothing is sent anywhere to produce them.
Locke, by Sonomos · Early Access
Compliance reports
Reports mapped to CCPA, GDPR and HIPAA
The dashboard already maps detections to regulatory frameworks (see the Reports guide). A compliance report exports that mapping, organized by regime, for counsel, a DPO or an auditor.
CCPA / CPRA
California, US
Personal and sensitive information sent to third-party AI tools, sorted by CCPA's disclosure categories.
UK GDPR
United Kingdom
Personal data transmissions assessed against the UK's post-Brexit data-protection principles.
EU GDPR
European Union
Personal data processing events relevant to lawful-basis, cross-border transfer, and data-subject-rights questions.
HIPAA
United States · Healthcare
Transmissions matching Protected Health Information patterns sent to an AI tool without a Business Associate Agreement on file.
General Privacy
Multi-regime overview
One transmission summary across several privacy frameworks, for teams that answer to more than one.
Technical reports
Evidence for the people who have to sign off
Locke also exports technical reports for infosec teams, IT regulators and auditors who need the evidence under the regulatory summary.
What was detected
Type, category and confidence for every pattern Locke flagged, including ones that led to no action.
What was masked or blocked
Each event's outcome (masked, blocked, remediated or sent unprotected) and why.
When it happened
A full, timestamped event history, in the order it occurred.
Configuration state
Which detectors were on, and how sensitivity was set, at the time of each event.
Every plan includes reports. Teams adds more detailed, team-wide compliance and technical reports, saved as PDF, HTML or JSON. Each report carries a SHA-256 integrity digest of its evidence, which anyone can recompute from the HTML or JSON file without asking Sonomos to vouch for it. Reports are generated on your device, like everything else here.
Rules sandbox
Test a detector before you rely on it
Write a detection rule in a simple format, or pick any of Locke's built-in categories, and run it against your own sample text. Nothing you type into the sandbox goes anywhere.
PROJ-4471 matched "Internal Project Code". Custom rule, tested before it protects anything.
The sandbox also runs Locke's 36 checksum-validated regex detectors and 70+ semantic categories, so you can see how each behaves before you enable it.
Reports and the sandbox ship with Locke. Install the Early Access app, then join the waitlist inside it.
Download Locke