Ladon
How to Prevent Sensitive Data Leaks to ChatGPT, Claude and Gemini
Every team that adopts generative AI eventually asks the same question: how do we stop sensitive data from ending up in a prompt? Blocking ChatGPT, Claude and Gemini outright rarely survives contact with reality — people route around the block, and you lose both the productivity gain and your visibility. A better approach is to inspect and control what is sent, not whether AI is used.
What actually leaks
In practice, leaks fall into a few repeatable categories:
- Identifiers: national ID numbers, phone numbers, customer records.
- Payment data: credit card numbers pasted from support tickets or spreadsheets.
- Secrets: API keys and tokens inside code, config files and logs.
- Internal material: contracts, financials, unreleased product information.
Principles of AI data loss prevention
1. Inspect at the source
The prompt is only visible, in clear text, on the device that sends it. Inspecting there avoids shipping raw prompts to yet another third-party service just to scan them.
2. Detect with validation, not just pattern matching
A naive regex for "nine digits" flags every order number and timestamp. Good detectors validate. For example, an Israeli ID number (Teudat Zehut) carries a check digit, and a payment card number must pass the Luhn checksum. Validating the checksum removes most false positives, which is what keeps users from learning to ignore your alerts. Secrets are easier to recognise by their well-known prefixes, such as the key formats used by major AI and cloud providers.
3. Prefer redaction to blocking when you can
If a prompt contains an ID number, the employee usually still wants the answer to their question. Replacing the sensitive value with a placeholder and forwarding the rest keeps the workflow intact while keeping the value out of the request. Reserve hard blocking for the cases where no safe version of the request exists.
4. Handle known secrets deterministically
For credentials you already know about, you do not need to guess. Registering them in a local vault lets the agent replace those exact values with an alias before the request leaves the machine, so the model sees a placeholder and the secret itself stays on the device.
5. Keep the proxy narrow
Decrypting all HTTPS traffic is invasive and fragile. Route only AI services through the inspection proxy and let everything else pass straight through, so a problem with the agent never breaks ordinary browsing.
6. Log decisions, not just detections
For every flagged request, record which app, which device, which data type and what action was taken. That record is what lets security triage incidents and lets you tune policies with evidence.
Putting it together with Ladon
Ladon implements this model. Its endpoint agent inspects requests to recognised AI services locally, validates Israeli ID numbers and credit cards by checksum, recognises common API key formats, and applies your policy — allow, alert, redact or block. Detections open incidents in a live console, and a Slack webhook can notify your team the moment a new incident appears.
Because the policy engine evaluates rules in priority order and the first match wins, you can express intent plainly: redact IDs everywhere, alert on secrets, and allow a specific team to use a specific tool freely.
A sensible rollout
- Deploy in alert-only mode and review a week of real traffic.
- Turn on redaction for high-confidence identifiers and card numbers.
- Add targeted blocks only where redaction cannot make the request safe.
- Review incidents regularly and adjust policies as new tools appear.