How it protects you

Masking, not blocking

The obvious way to stop private data reaching an AI would be to block the message. That's also useless — you sent the message because you wanted an answer. So Locke does something less obvious: it substitutes.

Say you type Email John Smith (SSN 123-45-6789) at john@acme.com about the Q3 invoice. Locke recognizes three sensitive things in there — a name, a Social Security number and an email address — and replaces each with a token that names its type: the email becomes something like EML_x9k2. The AI receives the same sentence with the three values swapped out. It can still tell that a person, an SSN and an email address are involved, and draft the email you asked for. It simply never receives your actual data.

The technical name for this is deterministic tokenization. Each token is a three-letter type prefix — EML for an email, PHN for a phone number, SSN — and four characters derived from the value by a one-way hash, so the same value always produces the same token. It is not encryption: there is no key, and nothing turns a token back into the original. The consistency matters more than it sounds — if you mention the same customer twice in a conversation, the AI sees the same token twice and can follow the thread.

Masking is what Locke does whenever it can. A few things it blocks instead, because sending them unchecked would be worse than not sending them at all: a file it cannot read (a zip archive or an Apple iWork file, for example), a request too large to screen, a request from a tool that sends prompts in a binary format to a service Locke screens, and — by default — any request Locke can't check at the moment it is sent. When that happens the request does not leave your computer. The details are on Known limitations.

Nothing leaves your computer

Detection runs in a small program installed alongside the app, on your own machine. It doesn't call a server to ask whether something is sensitive, because that would mean sending it the sensitive thing.

What Locke watches

Locke uses an intelligent router on your device to distinguish AI-service traffic from non-AI traffic, including eligible services beyond its built-in catalog. On the desktop proxy path, discovery can inspect initial requests to eligible unknown HTTPS destinations before deciding whether they are AI, including services later classified as non-AI. See the Locke Privacy Policy for details.

Recognizing an AI service and screening its requests are separate steps. Screening depends on the supported capture route and your settings. Native desktop wrappers such as ChatGPT desktop and Claude desktop are recognized and screened by Locke. AI websites such as chatgpt.com and claude.ai are screened by the Locke browser extension, so each browser you use needs it. Unsupported request types and connections can still bypass screening. You manage AI-service controls on the Controls page.

Within a protected surface, Locke screens the text you send. Attached files it can read are screened the same way: text, code, CSV, JSON, Markdown, logs and RTF, and PDF, Word, Excel and PowerPoint files. Files it can't read are blocked, as above. Images and voice are not screened in this release: they are sent as they are unless you (or your Teams admin) set them to Block, and NSFW filtering is not in this release. We plan to add this in a future release. Everything Locke doesn't cover yet is listed on Known limitations.

Sensitive data isn't only what you typed

This surprises most people. When you send a message to a modern AI tool, your typed words are a fraction of what actually goes out. The tool also attaches saved memory, project files, its own hidden instructions, and the output of any tools it ran. All of it can contain personal data, and all of it is going to the same place.

Locke protects all of it identically. It also records where each item came from, which is why the Dashboard's Detailed status and diagnostics › Sensitive data origins can distinguish You typed from Injected context. By default your Dashboard tally only counts what you typed — the full number, including everything the app attached on your behalf, is usually much larger and reads as alarming when it's mostly plumbing. You can change what's counted in Settings › Protection › What counts as a detection, described in Settings.

Confidence and the one dial that matters

Every detection carries a confidence score. A 16-digit number that passes a card checksum is near-certain; a capitalized pair of words that might be a person's name is a judgment call. Rather than making you weigh that number yourself, Locke reduces it to a single question: how sure must it be that a word is a name, a place or an organization before it masks it?

That question is the Controls › Strictness and Modalities › Detection strictness setting: Relaxed, Standard (the default) or Strict. Stricter catches more borderline names and places and also masks more ordinary words that didn't need it — there's no setting that's strictly better, just a trade-off to pick a side of. Card numbers, keys, IDs and other structured data are masked the same way at every setting. Strictness applies to the text you send; files are screened at Standard for now, and images are sent unscreened. The three levels and how to choose between them are covered in Controls.