Skip to main content

    Your personal data doesn't belong in someone else's AI model

    That tax question might include your Social Security number. That appeal letter, your diagnosis. Locke spots these on your device and can mask them before the AI sees them.

    Download LockeSee how it works

    What Locke detects

    Social Security numbers

    Nine-digit patterns checked against SSN structure: area, group and serial number. Invalid ranges such as 000, 666 and 900-series area numbers are excluded to cut false positives.

    Structural validation

    Credit card numbers

    Visa, Mastercard, Amex and Discover numbers, validated with the Luhn checksum.

    Structural validation (Luhn)

    Phone numbers

    Domestic and international formats, with country and area codes validated.

    Structural + contextual matching

    Email addresses

    Personal and work addresses, matched by standard format.

    Structural validation

    Home addresses and location

    Street addresses, zip codes and city-state pairs, found by named entity recognition and nearby residential keywords.

    NER + contextual matching

    Dates of birth

    Dates near words like DOB, birthday, born or age.

    Contextual pattern matching

    Government ID numbers

    Patterns consistent with driver's license, passport and state ID numbers. Confidence varies by state and country, because formats do.

    Contextual pattern matching

    Medical information

    Patterns consistent with prescription names, diagnoses and insurance member IDs, near health-related keywords.

    Contextual pattern matching

    Confidence varies by data type. Structurally validated types like SSNs and card numbers have lower false positive rates than contextual ones like addresses and medical terms. Each detection is color-coded so you can see its confidence at a glance.

    Five everyday ways personal data reaches an AI

    Every prompt you send to an AI service leaves your device.

    • —Pasting your SSN, W-2 or bank account numbers into a chatbot for tax help.
    • —Drafting a medical appeal letter that names your diagnosis, insurance ID and date of birth.
    • —Filling out an AI-powered form that processes your answers on its server before you know where they go.
    • —Asking for financial advice with your card number, balances or transaction history included.
    • —Drafting a landlord dispute, insurance claim or divorce filing with your address, SSN and finances in it.

    Locke detects these patterns on your device, before you hit send.

    Frameworks that may apply to flagged data

    Locke reports pattern matches, not compliance status. These frameworks may be relevant when detected data is sent unprotected.

    CCPA (California Consumer Privacy Act)

    Locke flags a CCPA relevance signal when personal or government-issued identifiers (SSNs, names, addresses, dates of birth) are sent to a third-party AI tool. If you live in California, CCPA gives you rights over how your personal information is collected and shared.

    PCI-DSS

    Locke flags a PCI-DSS relevance signal when payment card data is sent to a third-party AI tool. PCI-DSS is a merchant-side standard, but the card number is still yours.

    Signal requirements: A relevance signal requires (1) flagged data in a specific category, (2) sent unprotected, (3) to a destination matching a relevant classification. Blocked or remediated transmissions don't trigger one.

    Locke does not determine whether a regulation has been violated or whether data has a specific legal protection. It identifies patterns consistent with sensitive personal data. Legal questions need a lawyer.

    Four steps, all on your device

    Detect

    When you send a message, Locke looks for SSNs, card numbers, phone numbers, addresses and other personal identifiers. Nothing leaves your device during detection.

    Alert

    Red means a high-confidence structural match, like an SSN that passed checksum validation. Yellow means a contextual match worth a second look.

    Block or mask

    Send a message or a form with flagged data in it, and Locke can mask the data or block the request before it reaches the AI.

    Review

    Your dashboard shows what was detected, blocked or let through. It is stored on your device, and Sonomos never sees it.

    What you type never reaches Sonomos

    Many privacy tools scan your data on their own servers, so your SSN, card number and medical details pass through one more company. Locke detects, alerts and blocks on your device. Sonomos holds only your account record and Locke settings, never your prompts, files or what Locke detected. There is no server of ours holding your personal information to breach.

    You'd never post your SSN in public. See what's in your prompt before you hit send.

    Get Locke free

    Or try the interactive demo first.

    Reading for individuals