--- title: "Prevent sensitive data leaks from engineering and product teams" description: "Developers and IT teams paste credentials and internal data into AI tools constantly. Locke detects secrets, PII, and proprietary identifiers locally." url: "https://sonomos.ai/who-its-for/technology/" source: "https://sonomos.ai/who-its-for/technology/" --- # Prevent sensitive data leaks from engineering and product teams Locke finds keys, tokens and customer PII in your prompt and masks or blocks them on your device before the request goes out. [Download Locke](https://sonomos.ai/downloads/)[See how it works](https://sonomos.ai/locke/#demo) ## What Locke detects ### API keys and secrets Patterns consistent with keys, tokens and secret strings from AWS, GCP, Azure, Stripe, GitHub and other major providers. Found by prefix, entropy and format. Structural + contextual matching ### Database connection strings JDBC, ODBC and URI strings that carry hostnames, ports, credentials and database names. Contextual pattern matching ### Internal IPs and hostnames RFC 1918 private ranges and internal domains like *.internal, *.corp and *.local. Structural + contextual matching ### Emails and employee IDs Corporate email addresses and employee ID patterns, matched by format and domain. Structural + contextual matching ### Customer PII in bug reports and logs SSNs, card numbers, phone numbers and emails in pasted logs, error messages or support tickets. Structural + contextual matching ### Source code identifiers Proprietary function names, internal package references and repo paths, when they appear in code. Contextual pattern matching ## Frameworks that may apply to flagged data Locke reports pattern matches, not compliance status. These frameworks may be relevant when detected data is sent unprotected. ### CCPA Locke flags a CCPA relevance signal when employee or customer PII is sent to a third-party AI tool. - [California Privacy Protection Agency: CCPA regulations](https://cppa.ca.gov/regulations/) ### PCI-DSS Locke flags a PCI-DSS relevance signal when payment card data, say from a pasted log or support ticket, is sent to a third-party AI tool. - [PCI Security Standards Council: PCI DSS document library](https://www.pcisecuritystandards.org/document_library/) ### Trade Secret Protection No specific compliance signal applies here. Sending proprietary source code, internal architecture details or API credentials to third-party AI tools may implicate trade secret protections. These include the Defend Trade Secrets Act (DTSA) and state equivalents. Locke can block the patterns it detects. - [18 U.S.C. ยง 1836: Defend Trade Secrets Act civil action](https://www.law.cornell.edu/uscode/text/18/1836) Signal requirements: A relevance signal requires (1) flagged data in a specific category, (2) sent unprotected, (3) to a destination matching a relevant classification. Blocked or remediated transmissions don't trigger one. Locke does not determine whether data is a trade secret, whether an NDA covers it, or whether the destination has appropriate security controls. It identifies patterns. Those calls belong to your security and legal teams. ## Four steps, all on your device ### Detect Locke scans for API keys, connection strings, internal IPs, PII in logs and proprietary code patterns. It runs on your device, not a remote server. ### Alert Each match is color-coded by confidence: red for structurally validated secrets (AWS keys, Stripe tokens) and PII (Luhn-valid card numbers, SSNs); yellow for contextual matches like internal hostnames and employee IDs. ### Block or mask An engineer pastes a stack trace into ChatGPT. Locke can mask the token in it or block the request before it reaches the AI. ### Report Events are logged on your device. Export PDF reports for incident reviews, SOC 2 audit evidence or policy enforcement records. ## Your secrets never reach our servers Engineering teams hold production credentials, customer databases and proprietary code. A privacy tool that scans them in its own cloud is one more SaaS vendor with your secrets. Locke inspects content on your device. It sends Sonomos only sign-in, licence checks and your settings, so your security team has no new store of secrets to assess. Someone on your team will paste a live key into a prompt. Locke can catch it first. [Get Locke for your team](https://sonomos.ai/downloads/) Or [try the interactive demo](https://sonomos.ai/locke/#demo) first. ## Reading for technology - [Is Windsurf AI Safe for Sensitive Code? A 2026 Security Guide](https://sonomos.ai/blog/is-windsurf-ai-safe-sensitive-code-2026/) - [Is Cursor AI Safe for Sensitive Code? A 2026 Security Guide](https://sonomos.ai/blog/is-cursor-ai-safe-sensitive-code-2026/) - [Source Code in AI Coding Assistants: Keeping Secrets Out of Copilot, ChatGPT, and Claude](https://sonomos.ai/blog/source-code-ai-coding-assistants-engineering-security/) - [Is Claude Code Safe for Sensitive Code? A 2026 Security Review](https://sonomos.ai/blog/is-claude-code-safe-sensitive-code-2026/) See also [Legal](https://sonomos.ai/who-its-for/legal/)[Healthcare](https://sonomos.ai/who-its-for/healthcare/)[Financial Services](https://sonomos.ai/who-its-for/financial-services/)[Individuals](https://sonomos.ai/who-its-for/individuals/) Related concepts [Prompt leakage](https://sonomos.ai/glossary/prompt-leakage/)[Tokenization](https://sonomos.ai/glossary/tokenization/)[Redaction](https://sonomos.ai/glossary/redaction/)[On-device AI](https://sonomos.ai/glossary/on-device-ai/)[Privacy layer for AI](https://sonomos.ai/glossary/privacy-layer-for-ai/) [Compare Locke with cloud DLP and enterprise privacy platforms](https://sonomos.ai/compare/).