DataGate
Data loss prevention, built for AI.
A browser extension inspects what your people type, paste, and upload into the AI sites you choose to monitor — and enforces policy per data type and per tool, before anything leaves the machine.
The problem
AI is a new exfiltration channel your DLP can't see.
To get value from AI, employees paste real content in — and that content routinely includes API keys, customer PII, card numbers, database credentials, and source code. Email and file DLP never see a secret typed into a chat box.
Pasting a card number into ChatGPT is stopped and the input cleared — before the model ever receives it.
Capabilities
Precise control over what leaves
Monitored Sites & the Enforcement Matrix
Monitored Sites (Target Registry)
The extension acts only on the sites you choose — it does nothing anywhere else.
Enforcement Matrix
A grid of data element × site; each cell is IGNORE, WARN, or BLOCK. Be precise instead of banning tools.
Detection you control
Two-tier detection patterns
A SpectGrid-curated global catalog plus your own patterns. Patterns are server-delivered, never hardcoded in the extension.
A safety funnel for client-authored regex
Every pattern passes structural checks and a ReDoS analysis (static heuristic + an isolated, killable timeout probe) before it can go live.
Data elements, including custom
SpectGrid-provided categories (secrets, PII/compliance, IP/governance) plus custom per-org elements — each with its own rules and analytics.
Caught at the moment of risk
Paste Protection
Clipboard content is scanned the instant it’s pasted into a monitored site — before it enters the field.
Typed-submission protection
On WARN or BLOCK, the submission is held at Enter / send — a WARN waits for the employee to confirm; a BLOCK stops it outright.
Clear WARN / BLOCK prompts
Employees see a redacted snippet and a reason. BLOCK clears the input; WARN removes just the flagged text on cancel. No raw secret is ever stored.
Document Classification
Scan document uploads — locally
DataGate reads the text of uploaded documents (PDF, DOCX, XLSX, PPTX, TXT, CSV) on the device and flags confidential files before they’re uploaded. The file never leaves the machine to be scanned.
Custom classification phrases
Define your own phrases that mark a document sensitive — e.g. a classification banner or a project codename — each with a label (Confidential, Restricted), a WARN or BLOCK action, and optional case-sensitivity.
Any site, or just the ones you configure
Apply document scanning everywhere, or scope it to specific sites — the sites you already monitor, or a separate upload-scan list. Broad or precise, your call.
A benefits plan containing a confidential banner is blocked at upload (label: Confidential).
Privacy by design
Detection is local. Only redacted telemetry leaves.
The sensitive value itself is never transmitted. SpectGrid stores a redacted snippet and the policy outcome — enough to see and audit, never the raw secret.
See DataGate on your own tools
A short walkthrough on the AI sites your team actually uses.