Chrome extension · privately distributed to organisations · v1.7.0

FOR ENTERPRISE

Put your organisation’s rules in front of the send button.

Safe Privacy Mask Enterprise applies administrator-defined masking rules in employees' browser input fields just before they send.

Detection and replacement run on each device. Input is not sent to our servers. Enterprise has a separate codebase and distribution from the free extension and is not available on the Chrome Web Store.

Managed policy
Org-forced rules
Audit log
GPO, MDM and Admin Console delivery
No server of ours

Talk to us about a deployment Request an evaluation build

Pricing depends on the number of users and the rollout support you need. Contact us for a quote. We aim to send an initial support reply within two business days.

The clip is a recording of the free Safe Privacy Mask. Where the replacement happens and when it happens are the same in Enterprise; the only difference is where the rule came from. The subtitle in the clip says “a custom rule the user wrote themselves” — in Enterprise, that is a rule out of the policy an administrator distributed.

THE PROBLEM

Reduce the paste accidents without stopping the AI work

Ban the tools and the work stops; leave it alone and customer names and credentials go to an outside model as typed. The third option is to make your own rules take effect in the moment before sending.

The policy went out. Whether it is followed, nobody knows

A written rule such as “do not paste customer names into AI” does not change what happens in the input field. This extension applies the organisation's replacement rules before sending.

Leave it to personal settings and every team differs

When people set up rules individually, settings can vary across the team. Administrators can distribute the same replacement rules to everyone.

Surveillance-style controls meet resistance

Recording everything people type and shipping it to a central store reads as monitoring. This product records the decision only; the text itself is kept nowhere.

HOW IT IS DEPLOYED

Distribute it, let it act, keep the decision

Use your existing Chrome Enterprise setup to distribute policies. No new management server is required.

An administrator prepares the policy JSON

Replacement rules, presets, target sites, audit and gateway settings go into one JSON object. The keys are defined in the managed schema.
Push it to the devices

GPO and the registry on Windows, a configuration profile on macOS, or the Google Admin Console. The CRX is distributed privately, and you can self-host it.
Text is replaced in the field, before it is sent

In the fields you targeted, matching strings are replaced. Only the pre-send pass runs synchronously, so it reliably applies.
The decision, and only the decision, is recorded

The log records what happened and on which host, without recording the message text. You can also forward events to a collector run by your organisation.

# Windows / GPO — where the policy is written
HKLM\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\<extId>\policy

{
  "masterEnabled": true,
  "enabledLock":   true,
  "rules":         [ { "find": "Contoso Ltd.", "replace": "[customer]" } ],
  "targetSites":   [ "chatgpt.com", "claude.ai", "gemini.google.com" ],
  "audit":         { "enabled": true, "sink": "siem",
                     "endpoint": "https://collector.example.co.jp/spm" }
}

This example shows a policy ready for distribution. The technical documentation provided at rollout includes all settings and examples for each platform.

ADMIN CONTROL

What an administrator decides

Managed policies take precedence over users' settings. Users cannot change settings that an administrator has locked.

Org-forced rules

Distribute replacements for customer names, project names and internal system names. Users can neither edit nor delete them. Whether users may add rules of their own is also yours to set.

Per-site enforcement and exclusion

Name the domains where masking is always on, and the domains where the extension never runs. The mode for an individual domain can be overridden too.

Locking the enabled state and the settings

Force the extension on across the organisation so users cannot disable it, and make the settings page read-only if you want to.

Pinning presets and region

Fix which detection categories are active — email, card numbers, API keys, region-specific ID formats — and set the region detection should assume.

Enforcing the audit log

Turn the audit log on or off organisation-wide, regardless of the user toggle. The forwarding destination is set by policy too. On the device the log keeps up to 1,000 events, dropping the oldest; the retention period in the policy is a guide for your collector and is not applied on the device.

A second check before sending (optional)

Optionally send locally masked text to a DLP or LLM endpoint run by your organisation for a second check. Choose whether an error allows or stops the submission.

AUDIT

The decision is what gets recorded

The audit log is off by default. When it is on, what it records is the pre-send decision — not what was written.

Recorded

Timestamp and hostname (never the full URL)
The decision — passed, replaced, blocked, cancelled, warned
The type IDs of the presets that matched
Whether the optional second check was involved

Never recorded

The text the user typed
The text after replacement
Full URLs, paths, query strings, cookies
API keys, endpoints, or any other credential

Only the listed fields can be saved in the audit log. Any extra data passed to the logging code is discarded before storage.

The most recent 1,000 events are stored on the device. This local record remains even if you forward events to your own collector or SIEM. Your organisation provides that destination; we do not receive the events.

DATA FLOW

No server of ours is on the path

Detection and replacement both finish on the device. Outbound requests happen only in two cases you configure: the second check (text after local masking) and audit-event forwarding (decision records without the message text). Both go to destinations your organisation specifies.

Processed on the device

Detection and masking happen inside the browser. There is no mechanism that sends what was typed, what was found, or where someone browsed to us.

The second check goes to your endpoint

When enabled, the second check sends text after local masking to an endpoint your organisation configures and operates. Our servers are not involved.

No ads, analytics or telemetry

No usage measurement, no advertising trackers, and no error reports sent anywhere.

Check the free edition’s permissions, storage and traffic →

PROCUREMENT

We do not become a processor of your data

There is no route by which we receive what your staff type, so a review does not gain another party to assess.

There are no subprocessors

Detection and masking use no external API and no external server. When the second check is used, the destination is your own asset.

No cross-border transfer to assess

The product has no path by which typed text crosses a border. If you place the second check’s endpoint inside your own jurisdiction, that is where it ends.

Documentation you can put into a review

A technical pack covering the permissions requested, the data flow, the fields the audit log records and the known limits is provided during evaluation.

What we do not have

We hold no third-party certification (SOC 2, ISO 27001 or similar), and there is no vendor-side console. Management runs through Chrome policy distribution.

COMPARE

How it differs from the free extension

Each person installs and configures the free edition themselves. Enterprise is a separate product that lets administrators distribute shared rules across an organisation.

Aspect	Safe Privacy Mask (free)	Safe Privacy Mask Enterprise
Who sets the rules	The person using it	The administrator (users can be locked out of editing)
How it is delivered	Each user adds it from the Chrome Web Store	A privately distributed CRX, force-installed via GPO, MDM or the Admin Console
Where it runs	Major AI chats, plus the fields you register yourself	Always on, across the domains named in the policy
Audit log	None	Yes — no message text recorded, forwarding to your own collector available
Second check before sending	None	Optional, to a DLP or LLM endpoint you operate
Terms and support	Free, as-is, one shared support form	Quoted, with rollout support and a two-business-day first-reply target

See the free Safe Privacy Mask →

LIMITS

What it does not do

Before you take this any further, here is what the product does not take on.

It does not guarantee that every piece of sensitive information is detected and replaced. Both misses and false positives happen.
It does not replace your DLP, your access controls or your approval processes. It works alongside them.
There is no vendor-hosted admin console or reporting service. Settings are distributed through Chrome policies, and your organisation is responsible for collecting audit events.
There is no SSO and no user directory integration. The design has no concept of an account at all.
Chrome is the supported browser. Behaviour in other browsers has not been verified.
Whether anything is actually sent is always the user’s action. The product never decides that for them.

Start with an evaluation

We can provide an evaluation build and technical documentation covering permissions, data flow and audit fields. Tell us how many people would use it and which rules you want to distribute.