AI Security
Protecting sensitive data in the age of AI and GenAI tools
27 articles
AI Coding Assistants Leak Production PII
Unit test fixtures with real customer records. Log files with production data for debugging. GitHub found 39 million secrets leaked in 2024.
Internal Wiki PII: Confluence Customer Data
Support teams document processes with screenshots of customer accounts. Over 3 years, that's thousands of GDPR data minimization violations in your.
Screenshot PII: Leaks in Internal Tools
Slack, Teams, Jira, and email regularly receive screenshots containing customer PII. This access-control violation bypasses every DLP tool.
PII Highlighting vs Compliance Training
62% of employees who use AI tools for customer data work 'sometimes' forget to remove PII first. Here's why automatic highlighting removes the compliance.
Real-Time PII Prevention Saves $2.2M
IBM found a $2.2M cost difference between prevention and detection. Here's the math that makes real-time PII interception non-optional for security teams.
GDPR Art. 32: AI Tools PII Monitoring
Enterprise compliance teams need quantitative evidence of AI tool PII controls. Network DLP misses browser AI interactions.
Real-Time PII Prevention for AI Data Leaks
When an employee types a customer name into ChatGPT, the data leaves organizational control in real-time. Post-hoc DLP cannot un-ring this bell.
GDPR Support AI: Custom Identifiers
Customer support AI receives customer messages with names, emails, AND order IDs. Standard PII tools strip email addresses but leave order IDs intact.
Is Your AI Privacy Tool Stealing Your Data?
67% of AI Chrome extensions collect user data. The December 2025 incidents saw 900K users compromised by extensions posing as privacy tools.
3.8 Daily PII Exposures in Support Teams
Every support agent using ChatGPT makes an average of 3.8 sensitive data pastes per day. For a 100-person team, that's 380 GDPR exposure incidents daily.
After the 900K-User Extension Incident
In January 2026, two malicious Chrome extensions installed by 900K+ users exfiltrated complete ChatGPT and DeepSeek conversations every 30 minutes.
Why Policy Fails to Stop ChatGPT PII Leaks
77% of enterprise AI users copy-paste data into chatbot queries. Nearly 40% of uploaded files contain PII or PCI data. HIPAA Security Rule update proposed.
Enterprise AI: Dev Access Without Risk
Banks banned ChatGPT. Their developers used it from home anyway. 27.4% of all content fed into enterprise AI chatbots contains sensitive data (Zscaler.
Using Cursor & Claude Without Leaking Code
Cursor loads .env files into AI context by default. A financial services firm lost $12M after proprietary trading algorithms were sent to an AI assistant.
AI Policy Without Technical Controls Fails
77% of employees share sensitive work data with AI tools despite policies prohibiting it. A government contractor pasted FEMA flood-relief applicant data.
IDE vs Browser: Developer AI Security
Developers use AI in two environments: IDE (Cursor, VS Code) and browser (Claude.ai, ChatGPT). Each requires different controls.
83% of AI Extensions Are Never Audited
83% of Chrome extensions with broad permissions have never been security-audited (USENIX 2025). 45% of enterprise employees use unapproved extensions.
39M GitHub Leaks: AI Coding Risk
67% of developers have accidentally exposed secrets in code (GitGuardian 2025). 39 million secrets leaked on GitHub in 2024, up 25% year-over-year.
Vibe Coding and PII Leakage: The Security Risk No One Is Talking About
AI-generated code rarely includes PII handling. 73% of vibe-coded apps process sensitive data without anonymization. Here's what developers need to know.
MCP Server Security 2026: 8,000 Exposed, 492 With No Authentication
8,000+ Model Context Protocol servers are publicly exposed. 492 have zero authentication. 36.7% are vulnerable to SSRF. Protect PII in your MCP tools.
Browser DLP: Blocking vs. Anonymization Approaches 2026
Two approaches to browser DLP: blocking prevents PII submission to AI tools; anonymization transforms data before sending. An objective comparison.
Samsung Lost Source Code to ChatGPT 3 Times
Three separate Samsung engineering teams pasted proprietary code and confidential data into ChatGPT in April 2023. Each incident revealed a different.
Enterprise AI Bans: Productivity vs Risk
27.4% of enterprise AI chatbot content contains sensitive data—a 156% year-over-year increase. Yet 71.
Safe AI Privacy Extensions in 2026
In January 2026, two malicious Chrome extensions with 900,000+ users were caught exfiltrating ChatGPT and DeepSeek conversations every 30 minutes.
Browser DLP for ChatGPT, Claude, and Gemini
Traditional enterprise DLP was built for file transfers and email, not AI chatbots. This guide covers browser-native data loss prevention for ChatGPT.
900K Users Had Their AI Chats Stolen
Two malicious Chrome extensions stole ChatGPT conversations from 900,000+ users. One had Google's 'Featured' badge.
AI: The #1 Data Exfiltration Vector
77% of employees paste sensitive data into AI tools. GenAI now accounts for 32% of all corporate data exfiltration. Learn how to protect your organization.
Start Protecting Your Data Today
285+ entity types, 48 languages, enterprise-grade security at startup pricing.
About this page
We update this page when our platform or the law changes.
Read our founder note for how we work.
Each change shows up in the timestamp at the top.
Related reading
- Common questions
- Glossary
- How tokens work
- Security posture
- Where we comply
- What we detect
- Case studies
- Release notes
We follow these rules
- GDPR (EU 2016/679).
- ISO/IEC 27001:2022.
- NIS2 (EU 2022/2555).
- HIPAA safe harbor under 45 CFR § 164.514(b)(2).
Our promise
We do not sell your data.
We do not train models on your text.
We store your files in Germany.
You can delete your account at any time.
You own your work.
Where we run
Our servers live in Falkenstein, Germany.
We use Hetzner. They hold ISO 27001 certification.
All data stays in the EU.
Backups run every day.
Need help?
Email support@anonym.legal.
We reply within one business day.
How we test
We run a full check suite on every release.
Each surface gets its own sweep script and report.
Human reviewers spot-check the output each week.
We track recall and precision on a labelled set.
Bad runs block the deploy.
What we never do
- We never sell your information to third parties.
- We never train models on what you upload.
- We never keep your work after you delete it.
- We never share keys with any outside firm.
- We never run ads inside the product.
Plans in plain words
We sell credits, not seats.
One credit covers one short job.
Long jobs use a few credits each.
You can top up at any time.
Unused credits roll over each month.
Read the plans page for current rates.
Who built this
A small team of engineers and lawyers built this.
We ship from Europe and work in the open.
Our founder note spells out why we started.
Where to start
- Open the web app and try a sample file.
- Learn how credits get counted.
- See current plans and limits.
- Meet the team behind the product.
How the parts fit
A browser add-on cleans text inside Chrome.
A Word plug-in handles drafts in Office.
A small desktop tool works on whole folders.
An agent protocol link feeds large models safely.
All four share one core engine and one rule set.
Words from our team
We started this work after a lunch about cookies.
One friend kept getting odd ads on her phone.
We asked why a court file leaked through a draft.
We sketched the first build on a napkin that week.
By month three we had a tiny demo for a friend.
She used it on her first case the next day.
Common questions we hear
Can the tool read scanned PDFs? Yes, with OCR.
Does it work on long files? Yes, in small chunks.
Can I roll my own rule set? Yes, save it as a preset.
Does it run offline? The desktop build runs offline.
Do you keep my files? No, the cloud build wipes after each run.
Will it learn from my work? No, we never train on inputs.
A short tour of the workflow
Upload a file or paste a snippet of prose.
Pick the entities you want gone from the draft.
Choose a method: replace, mask, hash, encrypt, or redact.
Press run and watch the side panel show each hit.
Skim the result and tweak any rule that misfired.
Save the cleaned file or send it to a teammate.