What data goes where

This page follows the data Prism DLP handles from the device to our servers, through its own judgement model, and out to your SIEM or chat. It’s written for DPOs and security reviewers. The privacy policy is the legal statement for the browser extension; this page adds the detail behind it, including the Mac agent.

In short

Read on the device: what a person pastes, uploads or sends as a message on the AI tools you choose, including the text inside uploaded files and images. The Mac agent also reads text and images pasted into AI desktop apps and terminals, and text files copied to USB drives and cloud-sync folders.
Sent to Prism: that text, as it is, over HTTPS, with the person’s work email, the site or app, and which kind of account is signed in. The file or image itself is never sent, only the text read from it.
Stored: the text with every detected value replaced by a placeholder such as [EMAIL_1]. For uploaded files and images, none of the contents.
Never kept: the detected values themselves, any of an uploaded file’s or image’s contents, and the full email address or ID of the account signed in to the AI tool.

On the device

The browser extension (Chrome and Edge) reads text at the moment someone pastes, uploads or presses Send, and only on the sites your organisation has chosen. It doesn’t read keystrokes as people type.

For uploads, the extension reads the file on the device before the site gets it:

PDF, with Mozilla’s PDF.js, inside the extension
Word, Excel and PowerPoint (.docx, .xlsx, .pptx), by unzipping the file and reading its text
text files such as .txt, .csv, .json and source code
images (PNG, JPEG, WebP, GIF, BMP), with an OCR engine bundled in the extension that runs in its own extension page and fetches nothing

Files over 20 MB, older Office formats (.doc, .xls, .ppt) and other file types aren’t read. Prism gets their name, type and size and records that they couldn’t be read.

The Mac agent reads the clipboard when someone pastes into an AI desktop app or a terminal running an AI command-line tool. For a pasted image, it reads the text with Apple’s Vision framework on the Mac, with no network call. When a file is copied to a USB drive or a cloud-sync folder, the agent reads it only if it’s a text file (by extension, such as .txt, .csv, .json, .pem) of 2 MB or less.

Where redaction happens

Today, detection and redaction run on Prism’s servers. The device sends the text it read without changing it, over HTTPS (TLS) to the Prism API in the EU. The API finds detected values and swaps each for a placeholder in memory, as its first step with the request. From then on only the redacted text moves: to the queue, the database, the judgement model and any integration. The API doesn’t log request bodies.

So the text does leave the device, once, encrypted in transit, to Prism. It doesn’t reach anyone else in its original form.

What’s sent, by sensor

Sensor and moment	What’s sent
Extension: a paste, a message sent, an upload	An event ID and time; the action; the person’s work email, their name if your settings provide it, and where the email came from (your settings, the signed-in Chrome profile, or typed); the site and page address without query strings; which AI tool it is; the account check below; the text, or for a file the text read from it with its name, type, size and how much could be read
Extension: someone continues after a warning	The reason they typed, with the event ID
Extension: AI tool use, every 15 minutes	A random ID for the browser install, the operating system, the extension version, the person’s work email and name, and active seconds per AI website per day. Never page addresses, titles or what’s on the page. Off if you turn it off
Mac agent: a paste into an AI app or terminal	The same event shape, with the app instead of a page address and no account check; for an image, only the text Vision read from it
Mac agent: an AI app comes to the front	If Also cover right-click, menu and drag pastes is on, the text on the clipboard, so Prism can hold back what it would block. This check isn’t recorded. Anything then pasted is checked and recorded like any paste
Mac agent: a file copied to USB or a cloud-sync folder	The file’s name, size and type; where it went (USB, or the cloud service, with personal or work worked out from the folder name); the text of text files up to 2 MB; a SHA-256 hash of the file, which Prism doesn’t store
Mac agent: AI tool use	A random ID the agent keeps (not a serial number), the macOS version, the agent version, whether paste checking is allowed, the person’s work email and name, and active seconds per AI app and command-line tool per day

The account check

On ChatGPT, Claude, Gemini, Grok, Perplexity and Copilot, the extension looks at which account is signed in so Prism can tell work accounts from personal ones. It sends one of these:

the email domain of the signed-in account, such as acme.com, never the full address
the ChatGPT workspace ID, or that it’s a personal ChatGPT account
the Claude organisation ID
that a Grok or Perplexity account isn’t in a business organisation
for Copilot, whether it’s the consumer site or Microsoft 365

Prism compares it with the work accounts you list under Destinations, keeps only the result (work, personal or unknown) and discards the reference itself.

What Prism stores

For each event:

the time, the sensor, the action and the person’s work email (their name isn’t stored with events)
the site or app, the page address without query strings, the AI tool and the account result
for pastes and messages, the redacted text
what was found: each detector’s type and count, and a one-way fingerprint of each detected value (a keyed hash using a secret unique to your organisation), so a repeat can be recognised without keeping the value
two one-way fingerprints of the redacted text, so the same content can be linked when it turns up again
the verdict, the mode it was applied in, and the reasons
the decision record: the judgement model’s answers and what it was given (the redacted text for pastes and messages)

For uploaded files and images, images pasted on a Mac, and files copied to USB drives or cloud folders on a Mac, none of the contents are stored. Prism keeps the file’s name with detected values removed (or no name at all if you turn off Keep file names under Detectors), its type and size, how much could be read, what was found and how many times, the fingerprints above, and what happened. The decision record for a file holds the model’s answers with the text left out.

Reasons people type when they continue after a warning are redacted the same way and kept in the organisation’s audit log until the retention period ends.

For the devices list and AI tool use, Prism keeps the device’s random ID, operating system and sensor version, the person’s work email and name, and daily active time per tool. If Show who uses each tool is off under Settings, the console and its API show totals per tool only.

Prism’s own judgement model

Alongside the detectors and your settings, Prism uses a judgement model we trained. It judges whether the text looks confidential, whether it looks like someone moving data out on purpose, and whether it tries to give the AI tool instructions. It can turn an allowed action into a warning; it never blocks on its own.

Where it runs: on our servers in the EU, as a service on Railway in EU West (Netherlands). It has no public address and is reached only over Railway’s private network from the Prism API and worker.
What it receives: the redacted text, the detected value types and counts, the action, the destination and account result, your organisation’s approved tools and workflows, and a file’s name (with detected values removed), type and size. It doesn’t receive the person’s email or name.
What it keeps: nothing. The service writes no request logs and keeps no text after answering.

No other company’s AI model sees your data. Jev, from TypeSafe, which Prism used during development, isn’t used for customer data.

Where it’s hosted

Database: Supabase in London, UK (eu-west-2).
Application services (the API, the worker, the console and the judgement model): Railway in EU West, the Netherlands.
Isolation: every query runs as your organisation and the database’s row-level security enforces it, so one organisation’s data can’t be read in another’s console. The page Stabilise staff use to run Prism shows counts and dates per organisation, never event content.
Encryption: HTTPS (TLS) in transit from devices and browsers. Data is encrypted at rest by Supabase. Credentials for your Slack, Teams, Splunk and webhook destinations are encrypted again with our own key.

The subprocessors (Supabase, Railway, Resend, Stripe and Vercel), what each does and where, are listed at https://prism-dlp.com/security.

Integrations

Integrations receive only redacted information. A SIEM or webhook gets the event’s details: who, where, the verdict, the reasons, what was found, and the file’s name and size. The redacted text goes too only if you tick Include redacted text for that destination, and the Events API returns it only when asked with include_text=true. Slack and Teams alerts never carry content, even redacted. See integrations.md.

Retention and deletion

Events are deleted once they’re older than your organisation’s retention period, 90 days by default. Their findings, decision records, verdicts and links go with them, and AI tool use is deleted on the same schedule. The job runs daily. Admins choose the period under Settings → Keep events for.

The same job deletes the reasons people typed and analysts’ reviews, and Macs that haven’t checked in within the period (with the email, name and system recorded for them). Changes to settings, keys and people stay in the audit log while your organisation uses Prism, and go when it’s deleted.

Your organisation can ask us at any time to delete all of its data (privacy@stabilise.io). We delete the organisation and everything in it, including anything still waiting in the queue, and keep a record that the deletion happened, with counts and no content.

Training

We don’t use customer data to train AI models. Prism’s judgement model was trained on text written for the purpose, never on customer data.

Updated 19 October 2026