Prevent sensitive data leaks from engineering and product teams
Locke finds keys, tokens and customer PII in your prompt and masks or blocks them on your device before the request goes out.
What Locke detects
API keys and secrets
Patterns consistent with keys, tokens and secret strings from AWS, GCP, Azure, Stripe, GitHub and other major providers. Found by prefix, entropy and format.
Structural + contextual matchingDatabase connection strings
JDBC, ODBC and URI strings that carry hostnames, ports, credentials and database names.
Contextual pattern matchingInternal IPs and hostnames
RFC 1918 private ranges and internal domains like *.internal, *.corp and *.local.
Structural + contextual matchingEmails and employee IDs
Corporate email addresses and employee ID patterns, matched by format and domain.
Structural + contextual matchingCustomer PII in bug reports and logs
SSNs, card numbers, phone numbers and emails in pasted logs, error messages or support tickets.
Structural + contextual matchingSource code identifiers
Proprietary function names, internal package references and repo paths, when they appear in code.
Contextual pattern matchingFrameworks that may apply to flagged data
Locke reports pattern matches, not compliance status. These frameworks may be relevant when detected data is sent unprotected.
CCPA
Locke flags a CCPA relevance signal when employee or customer PII is sent to a third-party AI tool.
PCI-DSS
Locke flags a PCI-DSS relevance signal when payment card data, say from a pasted log or support ticket, is sent to a third-party AI tool.
Trade Secret Protection
No specific compliance signal applies here. Sending proprietary source code, internal architecture details or API credentials to third-party AI tools may implicate trade secret protections. These include the Defend Trade Secrets Act (DTSA) and state equivalents. Locke can block the patterns it detects.
Signal requirements: A relevance signal requires (1) flagged data in a specific category, (2) sent unprotected, (3) to a destination matching a relevant classification. Blocked or remediated transmissions don't trigger one.
Locke does not determine whether data is a trade secret, whether an NDA covers it, or whether the destination has appropriate security controls. It identifies patterns. Those calls belong to your security and legal teams.
Four steps, all on your device
Detect
Locke scans for API keys, connection strings, internal IPs, PII in logs and proprietary code patterns. It runs on your device, not a remote server.
Alert
Each match is color-coded by confidence: red for structurally validated secrets (AWS keys, Stripe tokens) and PII (Luhn-valid card numbers, SSNs); yellow for contextual matches like internal hostnames and employee IDs.
Block or mask
An engineer pastes a stack trace into ChatGPT. Locke can mask the token in it or block the request before it reaches the AI.
Report
Events are logged on your device. Export PDF reports for incident reviews, SOC 2 audit evidence or policy enforcement records.
Your secrets never reach our servers
Engineering teams hold production credentials, customer databases and proprietary code. A privacy tool that scans them in its own cloud is one more SaaS vendor with your secrets. Locke inspects content on your device. It sends Sonomos only sign-in, licence checks and your settings, so your security team has no new store of secrets to assess.
Someone on your team will paste a live key into a prompt. Locke can catch it first.
Get Locke for your teamOr try the interactive demo first.
