---
title: "How it protects you"
description: "Read the Sonomos Support Center guide for How it protects you. Detect, mask, send. Why nothing sensitive leaves your computer, in plain English."
url: "https://sonomos.ai/support/locke/how-it-works/"
source: "https://sonomos.ai/support/locke/how-it-works/"
---

Start here

# How it protects you

Three steps: Locke reads what you're about to send, replaces anything sensitive with a convincing stand-in, and sends the cleaned version. All three happen on your computer, in the moment, without you doing anything.

## Masking, not blocking

The obvious way to stop private data reaching an AI would be to block the message. That's also useless — you sent the message because you wanted an answer. So Locke does something less obvious: it substitutes.

Say you type _Email John Smith (SSN 123-45-6789) at john@acme.com re: matter MTR-00421._ Locke recognizes four sensitive things in there and replaces each with a fake of the same kind and shape — a name for a name, a valid-looking SSN for an SSN, an email for an email. The AI receives a sentence that reads perfectly naturally and can be reasoned about normally. It simply contains none of your actual data.

_The Sandbox page. The input box shows a sentence with four highlighted sensitive values; the output box shows the same sentence with each value replaced by a realistic stand-in; a table below lists each detection with its type, replacement, and confidence._

This is the Sandbox — a page in Locke where you can try this on any text you like, safely. The left box is what you typed; the right is what the AI would receive.

1. Amber highlights are the sensitive values Locke found.
2. Green highlights are the stand-ins that go out instead. Same kind of value, same format, different data.
3. The table shows what each item was, what replaced it, and how sure Locke was.

The technical name for this is **deterministic tokenization**: the stand-in has the same shape as the original and is derived from it by a one-way hash, so the same input always produces the same stand-in. It is not encryption — there is no key, and nothing turns the stand-in back into the original. That last part matters more than it sounds — if you mention the same customer twice in a conversation, the AI sees the same fake name twice and can follow the thread.

Why the fakes look real

A stand-in like `[REDACTED]` tells the AI that something was removed, which often derails the answer. A stand-in that looks like a real SSN keeps the request intact. The AI answers the question you actually asked, and you're the only one who knows the values were swapped.

## Nothing leaves your computer

Detection runs in a small program installed alongside the app, on your own machine. It doesn't call a server to ask whether something is sensitive, because that would mean sending it the sensitive thing.

| Thing | Where it lives |
| --- | --- |
| The text you send to an AI tool | Inspected on your computer. The cleaned version goes to the AI; the original goes nowhere. |
| The sensitive values Locke found | On your computer only. Never uploaded, never sent to Sonomos. |
| The record of detections | A local log on your machine, kept until your retention setting removes it, storing hashes rather than the plaintext. |
| Your settings and custom rules | On your computer. On a Teams plan, your admin's policy is delivered to your device — your own settings don't travel back. |
| Reports you generate | Built on your machine from your local history, saved wherever you choose to save them. |

What your team admin can see

On a Teams plan, admins get **numbers**: how many items were detected and masked per member, and whether each member's device meets the org policy. They do not get the text you typed, the values that were masked, or which specific messages triggered a detection. That boundary is enforced in the product, not by convention — see [For team members](https://sonomos.ai/support/locke/members/).

Security & technical documentation

How that on-device processing is built and documented — and every other security, compliance or technical question — is documented on the Sonomos Trust Centre: [trust.sonomos.ai](https://trust.sonomos.ai) (access-restricted during beta).

## What Locke watches

Locke uses an intelligent router on your device to distinguish AI-service traffic from non-AI traffic, including eligible services beyond its built-in catalog. On the desktop proxy path, discovery can inspect initial requests to eligible unknown HTTPS destinations before deciding whether they are AI, including services later classified as non-AI. See the [Locke Privacy Policy](https://sonomos.ai/locke/privacy/) for details.

Recognizing an AI service and screening its requests are separate steps. Screening depends on the supported capture route and your settings. Native desktop wrappers such as ChatGPT desktop, Claude desktop and Microsoft Copilot desktop are recognized and screened by Locke. Unsupported request types and connections can still bypass screening. You manage AI-service controls on the [Controls](https://sonomos.ai/support/locke/controls/) page.

Within a protected surface, Locke screens the text you send. Images and voice are not screened in this release: they are sent as they are unless you (or your Teams admin) set them to Block, and NSFW filtering is not in this release. We plan to add this in a future release.

## Sensitive data isn't only what you typed

This surprises most people. When you send a message to a modern AI tool, your typed words are a fraction of what actually goes out. The tool also attaches saved memory, project files, its own hidden instructions, and the output of any tools it ran. All of it can contain personal data, and all of it is going to the same place.

Locke protects all of it identically. It also _records_ where each item came from, which is why your Dashboard can distinguish You typed from Injected context. By default your counters only tally what you typed — the full number, including everything the app attached on your behalf, is usually much larger and reads as alarming when it's mostly plumbing. You can change what's counted in Settings › What counts as a detection, described in [Settings](https://sonomos.ai/support/locke/settings/).

Tip

Changing what's counted never changes what's protected. Locke masks everything it finds regardless; the setting only decides which finds get added up in your numbers and reports.

## Confidence and the one dial that matters

Every detection carries a confidence score. A 16-digit number that passes a card checksum is near-certain; a capitalized pair of words that might be a person's name is a judgment call. Rather than making you weigh that number yourself, Locke reduces it to a single question: how much doubt should it tolerate before masking something anyway?

That question is the Controls › Scanning floor dial. Stricter catches more and also masks more things that didn't need it — there's no setting that's strictly better, just a trade-off to pick a side of. The three levels, what each is for, and how to choose between them are covered in [Controls](https://sonomos.ai/support/locke/controls/).