The app, screen by screen
Activity
A live console over the detections Locke has stored on this device: what kind of value, where it was headed and what Locke did about it. Metadata only — never the value itself.
Available toAll plans
Activity on a Free plan.
- The status strip. Whether the feed is live, how much is stored, and a Pause for the list.
- Pulse. Totals and a per-minute chart for the window you pick.
- Filters. Narrow the feed by text, direction, surface, data type or outcome.
- The feed. One row per detection, newest first. Click a row for its metadata.
What Activity shows
Activity reads the newest 500 detections stored in Locke's metrics database on this device and refreshes every couple of seconds, so new rows arrive while you watch. The page's subtitle reads Every PII detection Spliicer recorded — Spliicer is the name of Locke's detection engine.
Every row is metadata: the data type, the destination, the outcome, which part of Locke saw it, and when. The text you sent and the values Locke found are never shown here, and aren't stored for this page to show.
Use it when you want to watch Locke work in real time, or look closely at one recent request. For a period's history, an exported record or a compliance report, use Reports — its detection history links here with Open Activity. The Dashboard shows the last few rows of the same activity.
The status strip
Across the top: a dot and a word — Live, Paused, Loading or Error — then how many detections are stored and how many arrive per minute, averaged over the last five minutes. A card under it repeats the stored count, or says Reading the metrics database… while it loads and Can't read the metrics database if that fails. The last rows read stay on screen when it does.
Pause freezes the list so rows stop moving while you read; Resume catches it up. Scrolling down the feed holds it the same way. While the list is held, new rows wait behind a N new — jump to latest button instead of pushing the page around.
Pulse
A summary of the detections in a time window. Pick the window with Session, Last hour or Last 15 min; the window also applies to the feed below.
| Tile | What it counts |
|---|---|
| Values masked | Values Locke replaced with tokens, added up across the masked requests in the window. A dash means no masked request reported a count. |
| Requests | Detection events in the window. One request can carry several values. |
| Held back | Requests that never left your device: blocked plus withheld. |
| Unprotected | Requests that went out without masking: mask failed plus bypassed. The tile is highlighted when it isn't zero. |
| Destinations | How many different AI services the requests were headed to. |
Beside the tiles, a small chart plots detections per minute over the last 60 minutes (the last 15 in the 15-minute window) and names the peak. Under them, a bar splits the window's requests by outcome. The outcomes are the same ones the Dashboard uses — the Dashboard chapter explains each.
Filtering the feed
| Filter | What it does |
|---|---|
| Search box | Matches the data type, destination, surface, outcome, direction or an id. |
| Both / → Out / ← In | Direction: what you sent to an AI service, what came back, or both. |
| Any surface / Proxy / Extension / Unstated | Which part of Locke saw it: the desktop proxy, the browser extension, or a row that didn't say. |
| Data-type chips | The most common types in the window, each with a count. More hide behind a “more” chip. |
| Outcome chips | One per outcome present, each with a count. The chips and the bar above use the stored names, so an unmasked request appears as “detected” there. |
Chip counts are requests, not values. Choose more than one chip to see any of them. Showing N of M tells you how many rows match out of the window, and Reset filters clears everything except the window. Locke remembers your filters while the app stays open.
Reading a row
Each row shows how long ago it happened (hover for the exact time), the outcome, the data type, an arrow for the direction, the destination, a small icon for the surface, and — when Locke reported it — how many values it masked. A divider marks each new minute.
Click a row, or press Enter on it, to expand its metadata. Click again or press Esc to close it.
An expanded row: ids, time, direction, outcome, type, destination — and no values.
| Field | Means |
|---|---|
| id, event id, session id | Identifiers for the event and the app session it belongs to — useful when Support asks about a specific event. |
| timestamp | When it happened, in full. |
| direction, outcome | The same direction and outcome as the row. |
| cause, what this means | Only when Locke reported a reason, for example a signed request that contained personal data. |
| data type | The kind of value found. |
| provider id, destination | The AI service, as an id and by name. |
| surface | Which part of Locke saw it: proxy or extension. |
| source | Where in the request the value sat — what you typed, attached context, tool output and so on. |
| values masked | How many values Locke replaced in that request. |
| schema version | The record format, for Support. |
A field the producer didn't report reads not reported rather than being left out or guessed.
Keyboard shortcuts
| Key | Does |
|---|---|
| / | Jumps to the search box. |
| ↓ or j, ↑ or k | Moves between rows in the feed. |
| Home / End | Jumps to the first or last row. |
| Enter | Expands the row you're on. |
| Esc | Collapses it. |
Exporting
Available toTeams MemberTeams Admin
On a Teams plan, Export CSV and Export JSON sit at the end of the filter bar. They save the rows the filters currently show — still metadata only — with the detection strictness each was screened at and a few totals, as a file named locke-activity- plus the date and time. The buttons are greyed out when nothing matches.
On Free, the same spot reads CSV and JSON export are part of Teams, with Upgrade to Teams. Everything else on the page works the same on every plan. See Free vs Teams.
