Skip to content
redactsure
Book a demo

Explore.

Guide · By Chris Sowa · Published
Last updated

How to Protect Sensitive Data Before It Reaches ChatGPT, Claude or Gemini: Change the Data Before the Model, Not the Contract After It

Tokenize identifiers, card numbers and credentials where each of the five doors to a model opens, because no-training terms act only after the model has read the record.

Sensitive record fields become small tokens at a filter before reaching model windows.

62% experimenting · 23% scaling · 1 named person

McKinsey's State of AI 2026 counts 62% of organizations experimenting with AI agents and 23% scaling them anywhere (CX Today, 2026). You signed an enterprise contract, read the no-training clause, and found that it governs what the vendor does after the record is handed over. The record still reached the model in clear. The control that works changes the data before the door, not the contract after it.

A record reaches a model through five doors. A typed prompt. A pasted record. An uploaded document. A screen an agent reads. A connector payload. You probably control two with a gateway and the other three with a paragraph in a vendor agreement. That paragraph is a promise about reuse, not a control on exposure.

Rome inspected traffic at the limes, before anyone crossed, not at a tribunal afterward. Your control sits at the same place: the render, the one point every application shares, before any model reads it. Identifiers, card numbers, keys and passwords reach the model as SSN_001, ACCT_001 and KEY_001. The amounts, dates and codes the task runs on stay in clear. The named person who owns the workflow confirms that policy and approves each consequential action.

Five doors carry a record to a model, and enterprise terms guard none of them

The typed prompt and the pasted record are the two doors your gateway sees. The uploaded document is handed over whole. The screen an agent reads arrives as a screenshot in one design (Claude Help Center, 2026) and as webpage text and document content in another (OpenAI, 2026). The connector payload returns the whole object (Do API Connectors Give an AI Agent More Data Than the Task Needs?, 2026).

Two of the five doors never pass a gateway, and a third, the upload, gets a file scan at best. The enterprise terms describe what happens after any door opens. The principle is Least Exposure: the principle that for each piece of work, the AI receives exactly the data the task requires and nothing more, enforced before any model reads the screen. Map every AI use to one door and one record type.

OpenAI's no-training default and Google's Sensitive Data Protection act once the model holds the record

OpenAI states that Business, Enterprise and Education workspaces "don't use your content to train our models by default" (OpenAI, 2026). The clause governs reuse of content the model has already received, in full and in clear. Key holder and data location are not disclosed in the same document. Google describes Model Armor on the Gemini Enterprise Agent Platform as protecting "against activities like prompt injection, tool poisoning, and sensitive data leakage" and Sensitive Data Protection as giving "continuous visibility into model inputs and outputs" (Google Cloud, 2026). Visibility into an input is a view of what the model already received.

A cloud service provider that receives ePHI is a business associate even if it only stores encrypted ePHI and lacks the key (HHS, 2026), and the minimum necessary standard at 45 CFR 164.502(b) asks whether the name was needed (eCFR, 2026). To reconcile a remittance, the diagnosis code and the amount were needed. The name was not. Keep the terms as your second layer; put the first at the render, so the content they govern is PATIENT_001.

Three controls reach three different sets of doors, and only one reaches all five

A vault tokenizes fields in the pipelines you built, not the applications you bought (Data Privacy Vault vs Screen-Level Tokenization, 2026). A gateway redacts patterns in prompts routed through it and never sees an agent reading a page in a cloud computer (AI Gateway, DLP or Tokenization?, 2026). The render layer acts at the one point every application shares, the screen (Tools That Tokenize Data Before the LLM, 2026).

Render-layer tokenization is replacing sensitive values with consistent stand-in tokens at the point where a screen is rendered, before any AI model reads it, so the model works with SSN_001 and ACCT_001 and real values resolve only at approved destinations.

Property Data privacy vault AI gateway or DLP Render-layer tokenization
Doors covered Pipelines you built Prompts routed through it All five
Bought applications Per-application integration Prompt side only Covered without integration
Agent in a vendor cloud computer Not reached Not reached Covered
Uploaded document Only if the pipeline wrote it File scan at best Rendered as tokens first
Where real values resolve In the pipeline Not applicable At approved destinations

Mark any door covered by "enterprise terms only" in your inventory. For a claim file or a chart, that is not a control.

An agent in the employee's browser receives the active tab, whatever is on it; a cloud computer receives the full page

Claude in Chrome takes screenshots of the active tab, and all visible information becomes part of the context (Claude Help Center, 2026). Dots run on a cloud computer; secure sign-in keeps credentials out of the model's context, and the model sees webpage text and document content (OpenAI, 2026).

0.08% reported attack success · 2 classifiers · 1 active tab

Two classifiers run, and Anthropic reports attack success under 0.08% in internal testing (Claude Help Center, 2026). Above zero on a full page is a schedule.

Property Agent in the employee's browser Agent in a vendor cloud computer Agent in a governed environment
Password In the browser the model reads Kept out of the model's context Kept out of the model's context
Page content Screenshot of the active tab Full page text The task's fields with identifiers as tokens
Who approves a payment A setting the employee chooses A rule plus the vendor's reviewer A named person

The last column is a tethered agent: an agent that works only inside the governed environment a named person connected it to, on the applications that person chose (Should an AI Agent Run in the Employee's Own Browser?, 2026). It rests on separation of model and control: the principle that the environment deciding what an AI agent sees and who approves what it does is owned by the customer and independent of whichever model performs the work. A model swap then changes nothing but the endpoint (Can an Enterprise Change AI Models Without Changing AI Controls?, 2026).

CLAIMANT_001 carries across four pages; a mask breaks the link on page two

A mask removes a value; a token replaces it with a consistent stand-in. A masked claim file loses the link between the claimant on page one and page four, and the work stalls (Masking vs Tokenizing Data for AI, 2026). A tokenized file carries CLAIMANT_001 through every page.

The PCI Security Standards Council describes the same property for cardholder data: systems that handle a token for a PAN stay outside the scope the PAN would carry (PCI SSC, 2026). CARD_001 resolves only at the payment destination when a named person approves the payment.

Programs hit the PII Wall: the point in an AI program where the valuable workflow turns out to run on data the security team will not let a model see, and the project shrinks or stops. Tokenized, the workflow runs on the amounts and codes, not the fields the security team objected to.

Carlini showed a model can emit what it held; Greshake showed what it reads can steer it

Carlini and colleagues showed a deployed model can emit training data verbatim (Carlini et al., 2021). Greshake and colleagues showed content an LLM-integrated application reads can steer it against the user (Greshake et al., 2023). OWASP ranks prompt injection and sensitive information disclosure first and second in its 2025 Top 10 (OWASP, 2025; OWASP, 2025).

Each attack yields only what was in context. A model that held PATIENT_001 leaks PATIENT_001; a steered agent that tries to send the record elsewhere sends tokens (Prompt Injection When the Agent Sees Only Tokens, 2026). And the send still waits.

That wait is Supervised Delegation: a named person grants the access, chooses the applications, confirms what is tokenized, can watch and pause the run, and approves every consequential action, on the record. The record is the AI Control Record: the record of every screen the agent saw as tokens, every action, every approval with a name, exported to the customer's own monitoring.

6 Rules for protecting data before it reaches a model

Inventory every door before you write a policy

The screen door and the connector door are the two most programs miss; neither passes the proxy.

Test: Pick three AI uses from SSO logs. Each maps to one door and one record type within five minutes.

Treat the vendor terms as the second layer

The no-training default and retention period govern reuse after hand-over. File them, and put the exposure control before the model so the content they govern is tokens.

Layer What it controls
First: render-layer tokenization What the model sees at the moment of the task
Second: enterprise terms What the vendor does with content afterward

Tokenize identifiers; leave the task's fields in clear

A policy that tokenizes everything stops the work; one that tokenizes nothing is the vendor's terms again. Name every field in clear and why the task needs it.

Before: The model's input shows Jane Doe, member 4471, $1,240.00, CPT 99214. After: The model's input shows PATIENT_001, MEMBER_001, $1,240.00, CPT 99214.

Tokenize, do not mask

A mask drops the value and the link between pages. A token carries the same stand-in through every screen.

Test: Open a four-page claim file as the model sees it. The claimant is the same token on every page.

Keep the agent off the employee's browser

Run the agent inside an environment with its own session, connected by a named person to the applications that person chose. Permissions stay as they are; what the AI can see changes.

Before: The agent's context holds a screenshot of the active tab and everything visible on it, the open record included. After: The agent's context holds the task's fields with identifiers as tokens.

Make every consequential action wait for a name

Payments, submissions and record changes each wait for the named person who owns the workflow. A standing approval removes the person from the one step where a steered agent does damage.

Setting What it means for a payment
Standing "always allow" The payment runs with no named approval
Supervised Delegation A named person approves this payment, and the record shows the name

How to choose where the control lives

  • If staff only type questions and never paste records, a gateway on the prompt door is enough today.
  • If records are pasted or uploaded, the gateway misses the upload, and the control has to act where the document is rendered.
  • If an agent reads screens in a vendor's cloud computer, no proxy sees that traffic; the control has to sit in an environment you own.
  • If the applications are bought rather than built, a vault needs integrations you will not finish; use the render layer.
  • If the work runs on health, card or student records, tokenize identifiers before the model and keep amounts and codes in clear, aligned with the minimum necessary standard.
  • If you expect to change models on price this year, keep the policy, approvals and record in the environment, not the vendor's product.

The checklist

Check Pass Fail
Door inventory Every AI use maps to a door and a record type Uses with no door
Chart screen as the model sees it Codes and dates in clear; patient as PATIENT_001 The name is in the input
Uploaded PDF Identifiers reach the model as tokens The file handed over whole
Link across pages CLAIMANT_001 is the same token on every page Masked values with no link
Agent location Own session in a governed environment Extension in the employee's browser
Key holder The customer's account The vendor, or not disclosed
Consequential actions Each shows a named approval in the record A standing "always allow"
Injection test Tokens collected; the action stopped for a person The action ran, or real values leaked

Questions

Does an enterprise contract stop the model from seeing our data?

No. It governs only what the vendor does afterward: training, retention and access rights. OpenAI's document says business workspaces do not use content for training by default (OpenAI, 2026), and the content still reached the model in clear. The contract is the second layer; tokenization at the render layer is the first.

Can we tokenize what staff paste into a chat window?

Yes, where the paste happens on a screen rendered inside a governed environment, because what they copy is already PATIENT_001 rather than the person. A gateway redacts patterns in prompts routed through it. Neither reaches a personal device, and a ban moves the use there; a ban produces invisibility, not safety (Does Banning AI Tools Work?, 2026).

Is masking enough?

No, not for any task that spans more than one page of a record. Masking removes a value; tokenizing replaces it with a consistent stand-in. A masked claim file loses the link between the claimant on page one and page four, and the work stalls. A tokenized file carries CLAIMANT_001 through every page (Masking vs Tokenizing Data for AI, 2026).

What about documents staff upload rather than paste?

An uploaded PDF or spreadsheet is handed over whole, and a gateway sees a file at best. Inside a governed environment the document is rendered before anything reads it, so the model receives the task's fields with identifiers as tokens. Outside that environment the vendor's terms are the only control, and they act after the upload.

Which fields stay in clear?

The ones the task runs on: amounts, dates, codes. The per-task policy names them before the run and a named person confirms it (What Should the AI See?, 2026). Identifiers, account numbers, keys and passwords reach the model as tokens. If you cannot write one sentence for why a field is in clear, tokenize it.

Is the vendor's injection classifier enough?

No. Anthropic reports attack success under 0.08% in internal testing (Claude Help Center, 2026), and Greshake and colleagues showed content a model reads can steer it (Greshake et al., 2023). On a tokenized page the successful attempt collects tokens, and the action it tries to cause waits for a person. The classifier is a second layer, not the first.

Who is the business associate when a model reads a chart?

A cloud service provider that receives ePHI is a business associate (HHS, 2026). A model that receives a patient's name next to a diagnosis has received ePHI. One that receives PATIENT_001 next to a diagnosis code has received a token. Counsel makes the determination; the tokenized input makes it shorter.

Methodology

What this page rests on. Vendor documentation from OpenAI, Anthropic and Google Cloud, read as of October 9, 2026; HHS cloud guidance and 45 CFR 164.502(b); the PCI SSC tokenization supplement; OWASP's 2025 Top 10; McKinsey's State of AI 2026 as reported by CX Today; and two research works: training-data extraction (Carlini et al., peer-reviewed) and indirect prompt injection (Greshake et al., preprint).

What was not tested. No hands-on testing of ChatGPT, Claude, Gemini, Dots, Claude in Chrome or Gemini Enterprise was performed. Vendor defaults change with releases, and this page carries its date. The worked examples are illustrations.

Whose determination it is. Whether a deployment meets the minimum necessary standard or PCI scope is for your counsel, your assessor and your security and compliance officers to determine.

How RedactSure does this

RedactSure runs AI co-workers inside a governed environment: a secure virtual machine in the cloud the customer's posture requires, on hardware-encrypted enclaves, with keys the customer holds; RedactSure holds ciphertext it cannot decrypt. Every sensitive value chosen by policy, names, SSNs and card numbers first, is replaced by a consistent token at the render layer before any model reads the screen. That covers all five doors, with no integration and no change to user permissions.

5 doors covered · 0 keys held by the vendor · 1 named approver per workflow

The Planner sets which values are tokenized and what the agent may do on each screen; a named person confirms that policy and approves every payment, submission and record change while it runs. Real values resolve only at approved destinations at the moment of an approved action. Every screen as tokens, every action and every approval lands in the AI Control Record and exports to the customer's SIEM. Models swap without moving the controls, Gemini included. A successful injection collects tokens, and the action still stops for a named person. Deployments are in pilot.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.