For data-protection teams
If you are the person who has to sign off on staff using ChatGPT, Gemini or Claude, this page is for you. It sets out — in your terms — what the gateway does as a control, what it verifiably does not do, and where it sits in a DPIA. The limits are stated as plainly as the capabilities, because for this reader the limits are the due diligence.
What the control is
The gateway is a deterministic pseudonymisation and data-minimisation measure at the egress boundary. Before a prompt leaves your network, it replaces each structured identifier with a placeholder; the model answers on the placeholders; the real values are restored on the way back. The token↔value map — the one place the real data lives — stays on your side of the boundary, in memory, for the life of the request or the browser tab, and is never persisted or transmitted.
In GDPR terms that is pseudonymisation (Art. 4(5)) applied to reduce the personal data disclosed to a third-party processor (Art. 5(1)(c)); under the revised Swiss FADP the same reasoning applies to a cross-border disclosure. This is a technical characterisation of what the code does, not a legal determination about your processing — see the note at the foot.
What it does, and how you can check it yourself
Every claim here is something a reviewer can verify without taking our word for it:
- Detection is deterministic, not a model. Regex plus checksums — an AHV must pass its EAN-13 digit, an IBAN its mod-97, a card its Luhn. It cannot be talked out of a match, and it does not guess. Change any digit and watch the check fail on How it works.
- It fails closed. If something has the shape and the checksum of an identifier, it is withheld, not waved through. Nothing about a prompt's content is sent to us to decide — there is no “us” in the path.
- It runs where you can audit it. As an OpenAI-compatible proxy on-premise or in a Swiss region for a team, or as a browser extension for an individual. No account, no API key of ours, no analytics. The Leak Radar runs the same detectors on a document entirely in your browser, so you can test it on your own material.
- It leaves a record. Each redaction emits a category-and-time audit line — never the value — which contributes to your record of the processing step. In the extension that log is on-device and value-free by construction.
- It is model-agnostic. Gemini, Claude, a model hosted abroad — the boundary is the same, because nothing sensitive reaches any of them.
On the utility question a reviewer always asks — does redaction make the answer worse? — there is a measured answer rather than a reassurance: see the benchmark.
What it does not do
This is the part to read closely. A structural, deterministic layer has structural blind spots, and pretending otherwise would be the real risk.
- Names and street addresses are not detected. They have no checksum, so they need a named-entity model — which would forfeit the determinism that makes the rest trustworthy. Run a local NER redactor alongside it for free-text PII, and fail closed on high-risk flows.
- It is not encoding-robust. A model — or a user — that base64s or ciphers an identifier defeats a regex. Separator and whitespace reformatting is handled; encoding and semantics are not.
- It does not read intent. It redacts identifiers, not the sensitivity of a sentence. “My manager is being investigated” carries no identifier and passes untouched.
- It guards the typed prompt, not attached files. In the browser extension, the contents of a document or codebase you upload to the chat go to the provider as-is — the guard inspects the message you compose, not file uploads. Treat attachments as an unguarded channel and redact them before you attach.
- It is not a DPIA, a lawful-basis analysis, or a transfer-mechanism. It removes the transfer question for the data it redacts. It does not remove your other obligations, and it is not legal advice.
Where it fits in a DPIA
Treat it as one technical measure in a defence-in-depth stack, sitting alongside your organisational ones — an acceptable-use policy, staff training, a lawful basis, and human review. Concretely, it helps with:
| DPIA question | What the gateway contributes |
|---|---|
| Data minimisation — is the disclosure limited to what is necessary? | Structured identifiers are removed before egress, so the processor receives placeholders in their place. |
| International transfer — does personal data leave the jurisdiction? | For the categories it detects, the real values do not cross the boundary. Free-text PII still can — see the limits above. |
| Record of processing — can you show what happened? | A per-request, value-free audit line of what was redacted, and when. |
| Residual risk — what remains, and is it managed? | Stated below, rather than left for you to discover. |
Residual risk, stated plainly
| Risk | Mitigation |
|---|---|
| Free-text names and addresses reach the model. | Chain a local NER redactor; restrict high-risk flows by policy. |
| An identifier is encoded or paraphrased past the regex. | Deterministic layers cannot catch this; training and review must. |
| A provider changes its internal API and a message goes out uninspected. | The extension warns the user in-page rather than failing silently, and offers a one-click report so a moved transport is fixed quickly. |
| A hostile first-party script on the chat page itself. | A content script shares a realm with the page and cannot win against one actively hunting for it; the guard is a control against accidental disclosure, not a compromised host. |
Working this out for your organisation?
I help Swiss and EU teams map how personal data actually flows into AI tools and put the right controls around it — a hands-on technical assessment of your data flows, redaction boundaries and residual exposure. It supports the DPIA your DPO and legal counsel own; it is not a substitute for their determination.
Not legal advice. Sovereign Shield is an engineering utility that aids programmatic privacy mitigation. It is not an automated guarantee of regulatory compliance under the FADP or the GDPR. Context-dependent leak vectors — free-text names, encoded data, semantics — can still pass a deterministic layer. Use it alongside a DPIA where required, audit logs, and human review, as the outer, deliberately-dumb layer of a defence-in-depth stack.