Locke sits between you and the AI tools you use, and quietly takes the private bits out of whatever you send them. It runs on your computer, it doesn't slow you down, and once it's set up there's nothing you have to remember to do.
You paste a spreadsheet into ChatGPT to get help cleaning it up. It has customer emails in it. You ask Claude to summarize a patient note. It has a name and a date of birth in it. You hand Claude Code a config file with a live API key in it. None of this is careless — it's just work. But once that text leaves your machine, it's on someone else's servers, and you can't take it back.
Locke is the step in between. When you send a message to an AI tool, Locke reads it first, spots anything sensitive, and replaces each sensitive value with a short token that names its type — EML_x9k2 for an email, for example — before the message leaves your computer. The AI still understands what you're asking. It just never sees the real value, and nothing turns a token back into it.
Dashboard
Whether Locke is protecting this device right now, and what it caught. · Monday, October 19
Protection status
Running
Desktop ProtectionUp
Browser ProtectionConnected
Detection engineReady
Configured to monitor 13 AI products.
The engine is responding. This health check does not confirm that your traffic is being screened.
location in Google Gemini / Vertex / AI Studiomasked
Detections and first sightings of a surface come from this session's capture feed; policy rows are the proxy's and the extension's own acks of the surface policy; deletions are this device's record. Rule edits are not in this feed — nothing on this device records when a Never flag or a data-type choice changed.
Summarised from the comprehensive requirement checklist over the 19 outbound detection events this session — the same template Reports exports. A tool-generated record, not legal advice. The same summary is shown for every role: Locke has no organization-wide compliance posture.
23
Items masked before sendingThis device
PII Locke replaced in what you sent since this app opened — across every AI app you used, not one chat. Like the recorded tally, it counts each request's new turn only: the AI tool's own system prompt, the context it injects (saved notes, project files), the tool output it feeds back and re-sent conversation history are masked but not counted. It counts per request rather than per recorded value, so the two figures can differ.
312
Sensitive detections recorded (all-time, You typed only)This device
312 of 947 recorded, per your tally settings — the rest sit in origins you are not counting, or are replayed conversation history.
Recorded detection occurrences in the selected all-time tally — masking outcomes not included.
A deliberate subset: everything recorded here was masked, but not everything masked is recorded here.
13
AI products enabledThis device
Distinct AI products Locke screens, with at least one hostname enabled in its local surface catalog (27 hostnames in all). Every catalog entry ships enabled, so this is Locke's default list until you change it in Controls — runtime interception is reported separately when available.
Not counted: Microsoft Copilot in the browser and Web search (7 hostnames), which Locke lists but does not screen — see Controls.
7 verified · 0 degraded · 20 unverified this session, from captured traffic only.
4
Terminal AI tools protectedThis device
4 of the 4 terminal tools Locke knows about send prompts to an API host Locke's proxy is still told to screen (Claude Code, OpenAI Codex CLI, Gemini CLI, GitHub Copilot CLI). Locke's surface catalog groups hostnames, not command-line tools, so this mapping is Locke's own — it counts endpoint coverage, not tools installed or running on this machine, and runtime interception is reported separately when available.
These four figures are not slices of one another: the first is your live capture feed since this app opened, the second is the all-time metrics store narrowed by your tally settings, the third is your local surface list, and the fourth is how many known terminal tools that list still covers. Only the second is stored history. All four are individual figures — this device, under your account. Locke does not show organization-wide totals anywhere yet.
Detailed status and diagnostics
Welcome to Locke
Local diagnostics are ready. A couple of quick steps and you're set.
1 of 3 done
Check the detection engineThe detection engine answered a health check. That doesn't confirm your traffic is routed through it.Answering
2Review configurationSee which AI apps and sites Locke covers.
3See it protect something realLocke's capture log is being watched and nothing has come through yet. Send something sensitive through a configured AI surface and this ticks off.
You can reopen this anytime from Support.
Your surface and data-type choices on Controls do reach Locke — switching a data type off means Locke still finds that value and sends it through in the clear on purpose. The numbers on this page show what Locke has handled. See the card below for current protection status.
Detection engine is answering
The engine is responding. This health check does not confirm that your traffic is being screened.
What this check confirms
Locke's detection engine answered a health check. This check reaches the detection engine directly. It does not pass through the screening path your traffic takes — the system redirect, the proxy, or Locke's guard — so it cannot tell you that any of those are working. If requests are failing or arriving unredacted while this reads green, that gap is where to look. To report this, open Support › Diagnostics and press Copy diagnostics, then send us what it copies.
Counting You typed · occurrences — change what countsWhat the recorded count leaves out
Locke masks more than it records. Four kinds of masked value are deliberately left out of the total above:
Replayed conversation history. A chat client re-sends the whole transcript every turn. A value is recorded once, on the turn it arrives — every later replay is masked again and not counted again.
Text the machine wrote. Values written by the AI itself are never recorded. Names, places, organisations and keyword-dictionary hits found in tool output are masked but not recorded.
Repeats of a value already counted. The same value in the same position counts once per session. After a large number of distinct occurrences that memory is cleared, so a value seen earlier can be counted once more.
Types the metrics store has no column for. A detected type outside its vocabulary is masked but not recorded.
None of this changes what Locke masks — only what it counts. Your own tally settings then filter that recorded subset further.
312 sensitive occurrences in the selected all-time tally. Masking success is shown only when the capture pipeline supplies explicit outcomes.
Live monitoring feed This device
20 validated detections in the current app-session buffer.
14:32:08email in OpenAI / ChatGPTmasked
14:29:51person in Anthropic / Claudemasked
14:28:34phone in OpenAI / ChatGPTmasked
14:26:58credit_card in Anthropic / Claudemasked
last event just now · live tail · processed locally, never leaves your device
Sensitive data origins (all-time)
Injected context
Things your AI tool quietly attaches to every message — saved notes, memory, project files
not counted39% · 368
You typed
Info you actually wrote into your message
in your tally33% · 312
System prompt
The AI tool's own built-in hidden instructions
not counted13% · 121
Tool output
Results from files or commands the AI read, fed back in
not counted10% · 97
The AI's replies
Text the AI generated
not counted5% · 49
Much of this content isn't typed by you — the app, its tools, or the AI itself can add it. These are detection/count-only aggregates; they do not establish a masking outcome. Choose what's included under Settings → What counts as a detection. Percentages are the share of all recorded origins, including rows excluded from your tally.
The Locke desktop app. This is the Dashboard — the first thing you see when you open it.
1Protection status.Running means the detection engine is answering. The rows underneath say whether desktop apps and your browser are covered.
2Recent activity. The latest items Locke caught — the kind of value, the AI service it was headed for, and what Locke did with it.
3Next step and Shortcuts. The one thing worth doing next, and quick links to the pages you'll use most.
Who this guide is for
Both kinds of reader, on purpose. If you just want your stuff protected and would rather not think about it, the first three chapters are all you need. If you're the person rolling Locke out to a team, setting a team policy, or producing a report an auditor will read, the rest of the guide is written for you and doesn't skip the details.
Nothing here assumes you know what PII stands for. Where a technical term is unavoidable, it's explained the first time it appears.
The two plans, in one line each
The two Locke plans
Plan
Who it's for
What you get
Free
One person, for free
The whole protection engine for one person: every detection category and the Never flag list, plus one Privacy summary report a month.
Teams
Teams, companies and organizations that need insight into, and control over, how their members use AI
The same protection engine, set by a team policy instead of each person, plus unlimited full reports for every member, and an admin who sets that policy for everyone and requests reports from the team.
Teams has two roles inside it — admin and member — and the difference matters, so it has its own chapter: Free vs Teams.
How to read this guide
It's built to be read in order, and it's also fine to jump. Every chapter stands alone, screens are shown as they actually look, and the flows that are easier to watch than to read are walkthroughs you can step through.
Two conventions worth knowing: text like Controls › Strictness and Modalities is a path through the app's own navigation, and a box labelled Available to at the top of a section tells you which plans and roles see it.
Locke doesn't screen everything yet — some apps, connections and file types are outside what it can check today. The full list, in plain words, is on Known limitations; the chapters link to the relevant item where it matters.
