Compliance Tools
← Back to DLP Shield

DLP Shield security statement

How DLP Shield protects your information

This statement applies specifically to DLP Shield. It explains how the product handles sensitive content and the service data needed to operate your DLP Shield account.

DLP Shield’s core security principle

Prompts, attachments and detected sensitive values are inspected locally on the user’s device. They are not transmitted to or stored by Compliance Tools for inspection.

Local protection

Sensitive content stays close to the user

DLP Shield brings your organisation’s screening controls to Chrome on Windows PCs and Macs. Prompt text, supported attachment contents and detected values are processed on the device before information is submitted to ChatGPT or Claude.

DLP Shield does not send us
  • Chat prompt contents
  • Attachment contents inspected locally
  • Detected sensitive values
  • Browsing history
The DLP Shield service manages
  • Account and organisation details
  • Screening policies and custom rules
  • Licensing and device enrolment
  • Security and account audit events

Verified DLP Shield controls

Encryption and secure communications

DLP Shield communications required for account management, licensing, device enrolment and policy synchronisation are protected using HTTPS and TLS. Persisted DLP Shield service data is encrypted at rest under our hosting and database providers’ controls.

Transport protection

The DLP Shield website, administration area and API require HTTPS, use HSTS and reject obsolete TLS 1.1 connections.

Hosted data

Our hosting platform protects DLP Shield service data in transit using modern TLS and encrypts hosted data at rest using AES-256.

Database data

Our managed database platform protects network communications using TLS and encrypts stored DLP Shield data at rest using AES-256.

Credentials and policy integrity

Mac credentials

Mac enrolment credentials are stored using Apple Keychain and are not saved as plain text in the Compliance Tools database.

Hashed enrolment tokens

The service stores a cryptographic hash of each Mac enrolment token for validation.

Signed policies

Mac clients verify the signature, intended audience, issuer and expiry of downloaded organisation policies before applying them.

Accounts and administration

Customer information is separated by organisation using database access policies. Administrative actions are restricted by role. Audit records cover account, licence, installation and policy events without including prompt text, attachment contents, detected values or browsing history.

Payments

DLP Shield subscription payments are processed using Stripe-hosted checkout. Compliance Tools does not receive or store full payment card numbers. Stripe documents encryption in transit and at rest and is certified as a PCI Level 1 service provider.

Shared responsibility

What happens after content is approved?

When a user chooses to submit approved content, it is sent to the selected AI platform through that application’s normal connection. The AI provider’s security, privacy and retention controls apply from that point. DLP Shield helps your organisation control what is allowed to reach the AI service, but it does not replace the provider’s own security responsibilities or your organisation’s device security.

Scope and further assurance

This statement covers DLP Shield only. It is based on controls verified in the current DLP Shield implementation, live production connection tests and assurance provided by our service providers.

Detailed supplier and supporting security information is available to customers during due diligence. Contact us to request it.

Last reviewed: 9 September 2026