Skip to main content
    SonomosSupport Center
    Main Site

    The app, screen by screen

    Controls

    Everything that decides what Locke screens on this device lives here, on four tabs: which AI apps and sites it checks, which kinds of data it masks, how strict it is about names, and what happens to attached files. Under every tab you can export your choices, import them, or test them on sample text.

    Available toFreeTeams Admin

    On a Teams plan this page works differently. A member has no Controls page — a read-only Team policy page takes its place — and an admin's own device follows the team's policy. See On a Teams plan below.

    The four Controls tabs
    TabAnswersChange it when
    Protected SurfacesWhich AI apps and websites does Locke screen, and what happens with AI services it doesn't know?You use an AI service Locke doesn't list, or want different handling for one it does.
    Sensitive dataWhich kinds of value are masked, and which go through in the clear?A type gets in the way of your work, or one particular term keeps being masked when it shouldn't be.
    Strictness and ModalitiesHow sure must Locke be that a word is a name, a place or an organization before it masks it?Ordinary words are being masked as names, or names are slipping through.
    AttachmentsWhat happens to a file you attach to an AI request?You want images or audio blocked instead of sent unscreened, or text files blocked outright.

    Changes take effect as you make them; there is no Save button. Beside the tabs, Saved. confirms it. Your choices are kept on this device and synced to your Sonomos account. A How these controls work disclosure under the tabs sums up the whole page in one place.

    Protected Surfaces

    A surface is one AI service Locke knows — a website you use in a browser, or the endpoint a desktop app or command-line tool sends prompts to. This list manages AI-service screening. When desktop capture is active, discovery can also decrypt and inspect initial requests to eligible unknown HTTPS destinations that reach the local proxy, including services later classified as non-AI. AI-service controls apply after classification; changing them does not by itself disable initial discovery inspection. See the Locke Privacy Policy for discovery limits and bypasses.

    The top of the tab. Further down: On this device, Unrecognized AI services and Explicit exceptions.

    1. Status cards. What is actually in force, as reported by the parts of Locke that do the screening: AI apps & APIs (Locke's proxy) and AI websites (the browser extension). On Windows, a Windows capture card first checks that the machine sends its traffic to Locke at all. A service you switch off is listed on its card.
    2. Not covered yet. One line naming what this release doesn't screen. The details are on Known limitations.
    3. Known AI services, in two lists. Each host has a switch and a remove button (×).

    Known AI services

    The two lists of known AI services
    ListWhat screens itExamples
    AI websitesThe Locke browser extension, page-side in the browser. Until the extension connects, this list is replaced by Browser Protection required and a link to install it.gemini.google.com, perplexity.ai, chat.mistral.ai
    AI appsLocke's proxy — for browsers, command-line tools and the native desktop apps.api.openai.com, api.anthropic.com, chatgpt.com, claude.ai

    Under AI websites, two collapsible lists name sites Locke recognizes but can't screen, so they have no switch. Not screened — unsupported transport holds sites that send chat over a live connection Locke can't read, such as Microsoft Copilot browser chat at copilot.microsoft.com; voice and realtime modes on otherwise-screened services are in the same position. Recognised, not screened yet holds search engines, where a search travels in the page address rather than a request Locke sees.

    What you can do with a known AI service
    ActionEffect
    Switch it offLocke stops screening that service on this device. It stays on the list, so you can switch it back on, and the status card at the top lists it as turned off. Initial discovery inspection is separate, as described above.
    Remove it (×)Takes the service off the list. Locke stops screening it, exactly as when it is switched off.

    On this device

    AI applications and terminal tools Locke found on this computer. The check is made locally and read-only, and nothing about it is sent anywhere. Two lists: Desktop AI applications (ChatGPT, Claude, Perplexity) and Terminal AI tools (Claude Code, OpenAI Codex CLI, Gemini CLI, GitHub Copilot CLI). Each row says whether the program was found on this device and whether it is Protected, Partly protected or Not protected, with a switch.

    If Locke finds a program whose endpoints are switched off, a Found, but not protected yet box appears at the top of the card with a Begin protecting button beside each one. That button — or the row's switch — turns on screening of the endpoints the program sends prompts to. Programs that share an endpoint change together: Claude and Claude Code both use api.anthropic.com, and ChatGPT and OpenAI Codex CLI both use api.openai.com. A program installed somewhere Locke doesn't look isn't listed, but the same endpoints stay screened for it.

    Unrecognized AI services

    What Locke does with an AI service its list doesn't include, recognized by how it behaves and what it sends. Two settings, one for Likely AI services (requests Locke is confident are AI; default Screen) and one for Possible AI services (requests Locke suspects are AI but isn't sure of; default Ask me). These settings apply to detected AI requests; they don't turn off initial discovery or its local inspection.

    Actions for unrecognized AI services and explicit exceptions
    ActionWhat Locke does
    ScreenScreens the request before it is sent, as it does for known AI services.
    Ask meHolds the request and asks you: screen and send, send once without screening, or cancel.
    BlockStops the request from being sent.
    AllowSends the request without screening.

    Notify me when Locke suspects an unrecognized AI service (off by default) gives you a notification each time, whatever the setting does with the request. A line at the top of the card says whether Locke's proxy is enforcing these settings — a saved setting is never shown as in force until the proxy confirms it.

    Explicit exceptions

    Hosts you name, each with what Locke should do with it: Screen, Ask me, Block or Allow (trusted). An exception covers the host and its subdomains and takes precedence over Locke's own recognition. Allow and Block apply to every connection to the host; Screen and Ask me apply once Locke detects AI traffic to it. Locke never opens a connection to inspection just because a rule names the host. Each exception shows In force once the proxy applies it.

    To make sure Locke screens an internal AI tool or a service it doesn't list:

    1. Open Controls › Protected Surfaces and scroll to Explicit exceptions.
    2. Type the host into the box, for example llm.example.com.
    3. Change the action beside it from Allow (trusted) — the preselected choice — to Screen.
    4. Choose Add. The host appears in the list with its action, and you can change the action or remove it (×) later.

    Sensitive data

    The catalog of what Locke masks: 78 types in eight categories — personal and identity details, government and tax IDs, financial data, health and medical data, secrets and credentials, crypto and web3, legal and business identifiers, and device and network identifiers. Each type has a risk level and a switch. The full list is in What Locke detects.

    One card per category. The Never flag list is at the bottom of the tab.

    1. Filter data types… narrows the catalog as you type.
    2. Masking policy. Reads back the policy file the detection engine uses and says in one line what goes out in the clear. On a fresh install that is one type, UUID.
    3. Each category card has a switch in its header (All … masking) that sets every type in it at once; it shows a mixed state when some types are on and some off.
    4. Each type shows High risk, Medium risk or Low risk — how damaging that kind of value is if it leaks.

    A switch decides what happens to a value Locke finds, not whether it looks for it. Locke checks for every type on every scan. Switched on, a value is masked: replaced before the request leaves your device with a short token that names its type, like EML_x9k2 for an email address. The same value always gets the same token, and nothing turns a token back into the value. Switched off, Locke still finds and counts the value, and sends it through in the clear on purpose.

    Every type starts switched on except UUID, which the engine deliberately lets through — the identifiers AI tools use to keep track of their own requests, which identify nobody. Eleven labels carry a not enforced tag: Locke has no detector behind them yet, so their switch is disabled. A few further types the engine knows have no switch on this page at all; they are always masked.

    The Never flag list

    The card at the bottom of the Sensitive data tab. Its own description says it: terms here are still detected and counted, but sent through in the clear. An entry does for one value what switching a type off does for a whole type — useful when your company's own name is masked as an organization, or a project codename is masked as a person's name.

    1. Type the term into the box, for example Project Falcon.
    2. Leave the data type at Any data type, or pick Only as … a single type (say, Only as Organization Name) so the term goes through only when Locke finds it as that type.
    3. Choose Add. The entry is listed with its scope and a Remove button. The list holds up to 512 entries.

    An entry must match the whole value Locke finds, ignoring case. Entries are plain words and phrases, not patterns.

    Strictness and Modalities

    Detection strictness sets how sure Locke must be that a word is a name, a place or an organization before it masks it. Card numbers, keys, IDs and other structured data are masked the same way at every setting. Choosing a level applies it straight away.

    One three-way choice for text, a table of what kinds of content are screened, and — as under every tab — the card for the configuration file and the rules test.

    The three detection strictness levels
    LevelWhat the app saysGood for
    RelaxedFewer false alarms. Only names and places the model is confident about are masked.Work where ordinary words keep being masked as names, and an occasional missed name costs little.
    StandardThe default. Balanced between catching names and leaving ordinary words alone.Almost everyone.
    StrictCatches more. Borderline names and places are masked too, so expect more false alarms.Regulated work where a missed name costs more than a false alarm.

    Strictness applies to text you send. Files are screened at Standard for now, and images are sent unscreened. Every change is recorded with who made it and appears in your reports.

    Modalities

    Modalities
    ModalityScreeningStrictness
    TextEnabledThe level chosen above
    ImageComing in V1.X—
    FileComing in V1.X—
    AudioComing later—

    Only text is screened as a modality in this release, and the other rows can't be switched on. That doesn't leave attachments unhandled: a file Locke can read is screened like typed text, and everything else is decided on the Attachments tab. Strictness for images, files and audio is on the Known limitations list.

    Attachments

    The File types card decides what happens to each kind of file you attach. Locke recognizes a file by what is inside it, not by its name, so renaming a file doesn't change what happens to it.

    The File types card. Below it, What happens to an attached file records what the engine does with each kind.

    File types and what Locke does with them
    FormatChoicesDefault
    Text, code, CSV, JSON and logs; Rich Text (RTF); PDF, Word, Excel and PowerPointScreen (the text is read and masked before the file is sent) or BlockScreen
    PNG, JPEG, GIF and WebP imagesSent unscreened (Locke can't check images yet) or BlockSent unscreened
    Audio and voiceSent unscreened (Locke can't check audio yet) or BlockSent unscreened
    Pages, Numbers and Keynote, SQLite databases, Outlook mail, archives (zip, tar, 7z, rar), other images (HEIC, TIFF, BMP), video, unknown binaryAlways Block — “Can't screen yet — coming in a future release”Block

    Nothing else can be sent without screening. When a file is blocked you see: “This file was blocked by your file-type setting, so it was not sent. The rest of your message was screened and sent.” Every change is recorded with who made it and appears in your reports.

    Below it, What happens to an attached file is a record, not a setting: for each kind of file, the extensions it covers and what the detection engine does with it, with the reasons and the engine's limits behind two disclosures. RTF, for instance, is read as text, but its formatting codes can split a value, so detection there is partial.

    Export, import and test

    Under every tab, one card holds two tools.

    The card under every Controls tab
    ToolWhat it does
    Configuration file › Export configurationSaves your choices on this page as a JSON file — never captured traffic or detected values. Use it to copy your setup to another device.
    Configuration file › Import configuration…Applies a previously exported file in full, replacing the configuration on this device; the change saves and syncs like an edit made by hand. A file that doesn't validate is refused whole — nothing is partly applied.
    Test your rules › Test with sample textOpens the same test as the Sandbox page, without leaving Controls.

    The test area has an Input box, Run test, a Masked output box you can copy, and What was detected: a row per value with its action (masked, or disclosed for a type you've switched off), type, token and confidence. It's the quickest way to see what a change on the Sensitive data tab does. More in Sandbox.

    On a Teams plan

    Available toTeams MemberTeams Admin

    Members: the Team policy page

    A member's device is locked to the team's policy, so there is no Controls page in a member's sidebar. Team policy takes its place: a read-only summary of what your organization enforces on this device. There is nothing to switch, and nothing on it can be loosened from your side; if something needs to change, ask your admin.

    What a member sees in place of Controls.

    What the Team policy page lists
    RowMeans
    PoliciesThe team policies that apply to you, by name — for example HIPAA-focused.
    Text strictnessRelaxed, Standard or Strict, set by your admin.
    Image and file strictnessComing later.
    File types blockedThe formats your team blocks, such as audio or images. Formats Locke can't screen yet are always blocked.
    AI apps and sites screenedWhich AI services are screened. On a device the team locks, Locke keeps screening every one it screens by default.
    Always maskedThe data types your team always masks, by category.
    Applied on this deviceWhen your device applied the policy, and its team revision number.

    More on what a member controls and what an admin can see in For team members.

    Admins: your own device follows the team

    As an admin you keep the Controls page, but your own device is covered by your team's policy too, so most of it is read-only: the switches on Protected Surfaces and Sensitive data, the Never flag list, strictness, file types, and importing a configuration file. Strictness and file types say Set by your team's policy. Your administrator changes it from My Team › Policies. To change them, edit the policy in My Team › Policies. Export configuration and the rules test still work.

    An admin's own device: the team's strictness, shown but not editable here.

    Unrecognized AI services and Explicit exceptions stay yours unless the team's AI services Locke doesn't recognize setting decides otherwise. If it sets one action for everyone, your two defaults show that action and can't be changed. If it doesn't let members add their own exceptions, yours are kept on the device but marked Not applied: your organization does not allow personal exceptions.