Security built into how Locke works, not bolted on after.
Detection runs on your device. Masking is one-way. Network inspection is scoped to finding and screening AI traffic. Deeper technical documentation is linked below.
Company-level trust (independent scans, our disclosure policy) is on Security & Trust.
Detection runs on your device
Every scan runs locally. Nothing is sent out to be analyzed.
Masking is one-way
Sensitive values become a non-reversible placeholder. No key exists that could rebuild the original.
Not a general-purpose VPN
Locke is designed to scope inspection to the AI tools it protects.
Build inputs you can trace
Release inputs are pinned to specific component versions, so changes are reviewable.
DETECTION & MASKING
Every step runs on your device, before anything is sent
Three ways to find sensitive data
Structural validation for formats you can check, like a checksum. Contextual matching for data known by what surrounds it. Free-form recognition for names, organizations and places with no fixed pattern.
A placeholder, not a fake value
Each detected value becomes a short token, not a realistic-looking fake. The same value gets the same token within a document, so it still reads coherently.
Memory-safe code in selected modules
Selected Rust modules use explicit safe-code boundaries, which cuts the risk of memory-safety mistakes there. The wider application still relies on defense in depth.
Nothing sensitive in the logs
Locke records a detection's metadata, such as its type, length and confidence, not the detected value itself.
Network
Inspected locally, then sent over verified TLS
AI screening and service discovery
The browser extension screens supported AI sites. When desktop capture is active, discovery can decrypt and inspect initial requests to eligible unknown HTTPS destinations that reach the local proxy, including services later classified as non-AI. Platform, routing rules and unsupported connections affect scope. AI-service controls apply after classification.
Locally generated trust material
Locke creates certificate material on your device for its active gateway session. None of it is shared across users or devices.
The private key stays local
The local gateway's private key is not transmitted. Trusting its local root is an explicit choice for this device. It enables supported desktop proxy inspection, including AI-service discovery.
A fully verified connection onward
After inspection, your request goes on to the real AI provider over standard, fully verified TLS, with the same checks your browser makes.
Can block what it can't verify
For supported prompt bodies, if Locke cannot confirm screening completed, the gateway can fail closed instead of passing the content through.
The application
The app around the engine is hardened too
A locked-down interface layer
The app's interface runs with context isolation on and no direct access to system APIs. It reaches the rest of the app only through a small, explicit, allow-listed bridge.
No usage analytics or telemetry
No usage analytics or telemetry, first-party or third-party, and no analytics or crash-reporting SDK. Crash reports and support messages go only when you send them.
Detection history stays local
Your detection history stays on your device. Locke requires an account, and your settings (which AI services to monitor, which categories to flag) sync to it across devices. The content Locke inspects, and what it found there, never syncs.
BUILDS & RELEASES
Pinned inputs and a signed Windows installer
Pinned build inputs
Release artifacts are built from specific component versions, so the inputs can be inspected and reproduced.
Deliberate version changes
Updating a component is a deliberate release decision. The detailed review process is in the Trust Center.
Nothing ships without checks passing
Formatting, linting, tests and documentation integrity are release checks. Detailed release evidence is in the Trust Center.
The Windows installer is signed
It is Authenticode-signed by Sonomos, Inc., so Windows shows a verified publisher. Linux .deb and .rpm packages are not code-signed. Verify them against the SHA-256 checksum published with each release.
Dependency risk is reviewed
Locke's dependencies are reviewed as part of release work. Vulnerability-management details are in the Trust Center.
How this compares
What on-device processing rules out
Most of Locke's security follows from one decision: processing never leaves your device. See the full comparisons category by category.
Nothing server-side to breach
Cloud privacy and DLP tools inspect your original content on someone else's server. Locke sends your sensitive values nowhere to be analyzed, so Sonomos holds no copy to breach, subpoena or leak.
No key that rebuilds your data
Reversible encryption keeps a key somewhere that can rebuild your original values. Locke 1.0 masks one-way, so there is no key to steal.
A narrow blast radius by design
General-purpose proxies and VPNs typically see everything you do online. Locke is designed to scope inspection to the AI tools it protects.
Go deeper
Locke Privacy Policy
The binding commitments behind this page: what Locke does and does not send us. Separate from our website privacy policy.
Read the Locke Privacy PolicySonomos Support Center
User guides, how detection works in plain terms, and some security background. Open to everyone.
Visit the Support CenterSonomos Trust Center
Architecture, security practices and compliance documentation for customers and prospective customers. During the beta it is access-controlled: the link asks you to sign in, and we grant access if you write to us. The install guide explains the local certificate authority without an account.
Open the Trust Center (access-restricted during beta)Locke is in Early Access. Download the app, then join the waitlist inside it.
Download Locke