Start here
How it protects you
Three steps: Locke reads what you're about to send, replaces anything sensitive with a convincing stand-in, and sends the cleaned version. All three happen on your computer, in the moment, without you doing anything.
Masking, not blocking
The obvious way to stop private data reaching an AI would be to block the message. That's also useless — you sent the message because you wanted an answer. So Locke does something less obvious: it substitutes.
Say you type Email John Smith (SSN 123-45-6789) at [email protected] re: matter MTR-00421. Locke recognizes four sensitive things in there and replaces each with a fake of the same kind and shape — a name for a name, a valid-looking SSN for an SSN, an email for an email. The AI receives a sentence that reads perfectly naturally and can be reasoned about normally. It simply contains none of your actual data.
Sandbox
Safe test area — nothing here is sent anywhereInput
Masked output
What was detected
| Action | Type | Replacement | Confidence |
|---|---|---|---|
| masked | Person Name | Marcus Webb | 96% |
| masked | Social Security Number (US) | 482-19-3057 | 99% |
| masked | Email Address | [email protected] | 98% |
| masked | Matter codescustom rule | MTR-77310 | 100% |
This is the Sandbox — a page in Locke where you can try this on any text you like, safely. The left box is what you typed; the right is what the AI would receive.
- Amber highlights are the sensitive values Locke found.
- Green highlights are the stand-ins that go out instead. Same kind of value, same format, different data.
- The table shows what each item was, what replaced it, and how sure Locke was.
The technical name for this is deterministic tokenization: the stand-in has the same shape as the original and is derived from it by a one-way hash, so the same input always produces the same stand-in. It is not encryption — there is no key, and nothing turns the stand-in back into the original. That last part matters more than it sounds — if you mention the same customer twice in a conversation, the AI sees the same fake name twice and can follow the thread.
Nothing leaves your computer
Detection runs in a small program installed alongside the app, on your own machine. It doesn't call a server to ask whether something is sensitive, because that would mean sending it the sensitive thing.
| Thing | Where it lives |
|---|---|
| The text you send to an AI tool | Inspected on your computer. The cleaned version goes to the AI; the original goes nowhere. |
| The sensitive values Locke found | On your computer only. Never uploaded, never sent to Sonomos. |
| The record of detections | A local log on your machine, kept until your retention setting removes it, storing hashes rather than the plaintext. |
| Your settings and custom rules | On your computer. On a Teams plan, your admin's policy is delivered to your device — your own settings don't travel back. |
| Reports you generate | Built on your machine from your local history, saved wherever you choose to save them. |
What Locke watches
Locke uses an intelligent router on your device to distinguish AI-service traffic from non-AI traffic, including eligible services beyond its built-in catalog. On the desktop proxy path, discovery can inspect initial requests to eligible unknown HTTPS destinations before deciding whether they are AI, including services later classified as non-AI. See the Locke Privacy Policy for details.
Recognizing an AI service and screening its requests are separate steps. Screening depends on the supported capture route and your settings. Native desktop wrappers such as ChatGPT desktop, Claude desktop and Microsoft Copilot desktop are recognized and screened by Locke. Unsupported request types and connections can still bypass screening. You manage AI-service controls on the Controls page.
Within a protected surface, Locke screens the text you send. Images and voice are not screened in this release: they are sent as they are unless you (or your Teams admin) set them to Block, and NSFW filtering is not in this release. We plan to add this in a future release.
Sensitive data isn't only what you typed
This surprises most people. When you send a message to a modern AI tool, your typed words are a fraction of what actually goes out. The tool also attaches saved memory, project files, its own hidden instructions, and the output of any tools it ran. All of it can contain personal data, and all of it is going to the same place.
Locke protects all of it identically. It also records where each item came from, which is why your Dashboard can distinguish You typed from Injected context. By default your counters only tally what you typed — the full number, including everything the app attached on your behalf, is usually much larger and reads as alarming when it's mostly plumbing. You can change what's counted in Settings › What counts as a detection, described in Settings.
Confidence and the one dial that matters
Every detection carries a confidence score. A 16-digit number that passes a card checksum is near-certain; a capitalized pair of words that might be a person's name is a judgment call. Rather than making you weigh that number yourself, Locke reduces it to a single question: how much doubt should it tolerate before masking something anyway?
That question is the Controls › Scanning floor dial. Stricter catches more and also masks more things that didn't need it — there's no setting that's strictly better, just a trade-off to pick a side of. The three levels, what each is for, and how to choose between them are covered in Controls.
