--- title: "Keep financial data out of unprotected AI channels" description: "Analysts, advisors, and compliance teams use AI tools to work faster. Locke detects financial account data and blockchain wallet patterns locally." url: "https://sonomos.ai/who-its-for/financial-services/" source: "https://sonomos.ai/who-its-for/financial-services/" --- # Keep financial data out of unprotected AI channels Client account numbers, wire references, wallet addresses: Locke finds them on your device and can mask or block them before the prompt goes out. [Download Locke](https://sonomos.ai/downloads/)[See how it works](https://sonomos.ai/locke/#demo) ## What Locke detects ### Credit card numbers (PAN) Luhn-validated, with the issuer read from the prefix: Visa, Mastercard, Amex, Discover. Structural validation (Luhn) ### Bank account and routing numbers ABA routing numbers, check digit verified. Account numbers when they sit near banking keywords. Structural + contextual matching ### Blockchain wallet addresses Bitcoin (Base58Check, version byte checked), Ethereum (0x prefix, EIP-55 checksum) and other major chain address formats. Structural validation ### Transaction hashes and identifiers Patterns consistent with blockchain transaction IDs, wire transfer references and SWIFT/BIC codes. Contextual pattern matching ### SSNs and EINs Social Security and Employer Identification Numbers, structurally validated. Structural validation ### Customer account identifiers Brokerage account numbers, loan identifiers and policy numbers near financial-services keywords. Contextual pattern matching ## Frameworks that may apply to flagged data Locke reports pattern matches, not compliance status. These frameworks may be relevant when detected data is sent unprotected. ### GLBA (Gramm-Leach-Bliley Act) Locke flags a GLBA relevance signal when financial-category data is sent unprotected to a third-party AI tool. - [16 CFR Part 314: the FTC Safeguards Rule](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314) ### PCI-DSS Locke flags a PCI-DSS relevance signal when payment card data is sent unprotected to a third-party AI tool. - [PCI Security Standards Council: PCI DSS document library](https://www.pcisecuritystandards.org/document_library/) ### FinCEN / Travel Rule Locke flags a FinCEN/Travel Rule relevance signal when blockchain wallet or transaction data is sent unprotected to a third-party AI tool. - [31 CFR 1010.410: records for funds transfers (the Travel Rule)](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1010/subpart-D/section-1010.410) ### CCPA Locke flags a CCPA relevance signal when personal or government-issued identifiers are sent to a third-party AI tool. - [California Privacy Protection Agency: CCPA regulations](https://cppa.ca.gov/regulations/) Signal requirements: A relevance signal requires (1) flagged data in a specific category, (2) sent unprotected, (3) to a destination matching a relevant classification. Blocked or remediated transmissions don't trigger one. Locke does not determine whether a regulation has been violated, whether a data processing agreement is in place, or whether the data subject is a customer of a covered institution. You can add DPA-covered destinations to your compliance profile. ## Four steps, all on your device ### Detect Locke scans for card numbers, routing numbers, wallet addresses, transaction IDs and customer identifiers on your device. No data leaves it. ### Alert Each match is color-coded by confidence: red for Luhn-validated card numbers and checksum-verified wallet addresses; yellow for contextual matches to review. ### Block or mask Locke can intercept requests to AI tools, external services or unrecognized endpoints. Card numbers and wallet addresses can be masked or redacted before the AI sees them. ### Report Events are logged on your device. Export PDF reports for compliance officers, auditors or regulatory filings. ## No customer data reaches Sonomos Financial regulators expect firms to control customer data at every point in the processing chain. A privacy tool that routes it through external servers adds a data processor, an attack surface and possibly a regulatory obligation. Locke processes content on your device. Sonomos holds only your account, licence status and Locke settings, so your risk team has no new processor of customer data to review. Run the numbers through AI. Keep the account numbers out. [Get Locke for your firm](https://sonomos.ai/downloads/) Or [try the interactive demo](https://sonomos.ai/locke/#demo) first. ## Reading for financial services - [Financial Services + AI: GLBA, FFIEC, and Securities Compliance for ChatGPT and Claude in 2026](https://sonomos.ai/blog/financial-services-ai-glba-ffiec-compliance-2026/) - [PCI DSS and AI: Can You Use ChatGPT With Cardholder Data? (2026 Guide)](https://sonomos.ai/blog/pci-dss-ai-chatgpt-cardholder-data-2026/) - [AI in Insurance 2026: NAIC Model Bulletin, Colorado Reg 10-1-1, and ChatGPT for Underwriting](https://sonomos.ai/blog/ai-insurance-naic-colorado-bulletin-underwriting-2026/) - [SOC 2 and AI: What Auditors Look For When Your Team Uses ChatGPT and Claude](https://sonomos.ai/blog/soc-2-ai-chatgpt-claude-2026/) See also [Legal](https://sonomos.ai/who-its-for/legal/)[Healthcare](https://sonomos.ai/who-its-for/healthcare/)[Technology](https://sonomos.ai/who-its-for/technology/)[Individuals](https://sonomos.ai/who-its-for/individuals/) Related concepts [What is PII?](https://sonomos.ai/glossary/personally-identifiable-information/)[Tokenization](https://sonomos.ai/glossary/tokenization/)[Data masking](https://sonomos.ai/glossary/data-masking/)[Prompt leakage](https://sonomos.ai/glossary/prompt-leakage/)[Zero-knowledge processing](https://sonomos.ai/glossary/zero-knowledge-processing/) [Compare Locke with cloud DLP and enterprise privacy platforms](https://sonomos.ai/compare/).