DataGate
Data loss prevention, built for AI.
A browser extension inspects what your people type, paste, and upload into the AI sites you choose to monitor — and enforces policy per data type and per tool, before anything leaves the machine.
The problem
AI is a new exfiltration channel your DLP can't see.
To get value from AI, employees paste real content in — and that content routinely includes API keys, customer PII, card numbers, database credentials, and source code. Email and file DLP never see a secret typed into a chat box.
Pasting a card number into ChatGPT is stopped and the input cleared — before the model ever receives it.
Capabilities
Precise control over what leaves
Monitored Sites & the Enforcement Matrix
Monitored Sites (Target Registry)
The extension acts only on the sites you choose — it does nothing anywhere else.
Enforcement Matrix
A grid of data element × site; each cell is IGNORE, WARN, or BLOCK. Be precise instead of banning tools.
Detection you control
Two-tier detection patterns
A SpectGrid-curated global catalog plus your own patterns. Patterns are server-delivered, never hardcoded in the extension.
A safety funnel for client-authored regex
Every pattern passes structural checks and a ReDoS analysis (static heuristic + an isolated, killable timeout probe) before it can go live.
Data elements, including custom
SpectGrid-provided categories (secrets, PII/compliance, IP/governance) plus custom per-org elements — each with its own rules and analytics.
Caught at the moment of risk
Paste Protection
Clipboard content is scanned the instant it’s pasted into a monitored site — before it enters the field.
Typed-submission protection
On WARN or BLOCK, the submission is held at Enter / send — a WARN waits for the employee to confirm; a BLOCK stops it outright.
Clear WARN / BLOCK prompts
Employees see a redacted snippet and a reason. BLOCK clears the input; WARN removes just the flagged text on cancel. No raw secret is ever stored.
Document Classification
Scan document uploads — locally
DataGate reads the text of uploaded documents (PDF, DOCX, XLSX, PPTX, TXT, CSV) on the device and flags confidential files before they’re uploaded. The file never leaves the machine to be scanned.
Custom classification phrases
Define your own phrases that mark a document sensitive — e.g. a classification banner or a project codename — each with a label (Confidential, Restricted), a WARN or BLOCK action, and optional case-sensitivity.
Any site, or just the ones you configure
Apply document scanning everywhere, or scope it to specific sites — the sites you already monitor, or a separate upload-scan list. Broad or precise, your call.
A benefits plan containing a confidential banner is blocked at upload (label: Confidential).
File-Type & Egress Guardrails
Block risky file types by type, not just content
Keys, database dumps, archives, and executables are caught on upload by their type — so a sensitive artifact is stopped even when its contents aren’t a known pattern.
Scope to trusted destinations
Allow a file type only where it belongs. Restrict a rule to specific destinations, so the same upload is permitted on a sanctioned tool and blocked elsewhere.
A renamed file is still caught
Type guardrails work alongside content inspection — renaming a file to dodge the extension doesn’t get it past document scanning.
A private-key file is blocked on upload to an unapproved destination.
See everything
Prevention you can take to the board
Every warning and block is captured as redacted telemetry and rolled up in your console — by data-element category, over time, and into ready-to-share reports.
Analytics by category
Activity broken out by secrets & credentials, PII & compliance, and IP & governance — so leadership sees prevention in terms they care about.
Report library
Board posture, risk rollups, shadow-AI usage, false-positive rate, and coverage health — each exportable to CSV or a branded PDF.
Audit trail
Policy changes and enforcement outcomes are logged for review — the record a security or compliance team needs.
Privacy by design
Detection is local. Only redacted telemetry leaves.
The sensitive value itself is never transmitted. SpectGrid stores a redacted snippet and the policy outcome — enough to see and audit, never the raw secret.
See DataGate on your own tools
A short walkthrough on the AI sites your team actually uses.