How to stop pasting sensitive data into ChatGPT (without banning it)
You stop sensitive data reaching ChatGPT not by banning the tool but by making the safe path the easy path: a browser extension that watches the prompt box, flags names, emails, cards, and API keys before send, and scrubs them to placeholders in one click. Bans just move the pasting to personal devices.
- People paste support tickets, customer lists, and config files with live keys into AI chats because it works. That incentive does not go away.
- Blanket bans create shadow AI: same pasting, now on personal phones and home laptops where you have zero visibility.
- A browser-side guard is a seatbelt: it catches PII in the input box before send and scrubs it to placeholders, with undo.
- Sether Shield does this 100% locally: storage-only permission, no network calls (CI-enforced), no account, free.
- It protects humans at the chat box, not your API traffic. Your product's LLM calls need a library-side layer too.
What do people actually paste into ChatGPT?
The pattern is boring and universal. A support agent pastes a full ticket thread, customer name and email included, and asks for a polite reply. An analyst pastes a customer list and asks for a summary. A developer pastes a config file to debug it, and the config contains a live AWS key.
Nobody does this maliciously. They do it because it works: the model writes the reply, finds the bug, summarizes the list. The sensitive data was just along for the ride, and once it is sent, you cannot unsend it.
This is a different problem from your product's own API calls to OpenAI or Anthropic. Those run through code you control and are covered in our complete guide to PII redaction for LLM apps. This post is about the humans and their browsers.
Why do blanket bans fail?
Because the productivity gain is real, and people route around obstacles that stand between them and getting their work done. Block chatgpt.com on the corporate network and the same prompt gets typed into a personal phone at the same desk.
This is shadow AI, and it is strictly worse than the problem you started with. The pasting still happens, but now on devices and accounts you cannot see, with no logging, no policy, and no chance to help. A ban converts a visible risk into an invisible one.
The teams that handle this well treat it like seatbelts, not prohibition. Keep the tool, keep the speed, and put a guard at the exact moment the risk happens: the second before the prompt is sent.
What does browser-side guarding look like?
The idea is simple. Something watches the prompt input box on the AI chat sites, the same way Grammarly watches a text field. When it sees an email, a phone number, a card number, or an API key in the draft, it tells you before you hit send.
One click scrubs the values to placeholders like [email-1], so the model still gets a coherent prompt and the answer still makes sense. The real values never leave the tab. If you scrubbed something the model genuinely needed, undo puts it back.
This is the human-side complement to API-side redaction, not a replacement for it. Your app's server-side calls need a library in the request path, in TypeScript or Python. The extension covers the copy-paste habits no server-side code can see.
How does Sether Shield work?
I built Sether Shield because I kept writing server-side redaction and then watching people paste the same data into a browser tab. It is a Chrome extension (Manifest V3) that runs on chatgpt.com, chat.openai.com, claude.ai, and gemini.google.com.
- Input watcher, not a proxy. It watches the prompt box the way Grammarly does. MV3 extensions cannot read request bodies, so a network proxy is not even possible here; the input box is the honest interception point.
- Floating shield with a live count. As you type or paste, the shield shows how many pieces of PII are currently in the draft.
- One-click scrub. Detected values become placeholders like
[email-1]or[phone-1]. The prompt still reads naturally to the model. - Undo and restore. Originals are held in in-tab memory only and cleared on reload. Nothing is written to disk.
- Real detectors, not toy regex. It runs the same detector packs as the open-source
@raeven-co/sether/browserbuild: validated email, phone, card with Luhn, IBAN with mod-97, the secrets pack for API keys and tokens, plus conversational detection for phrases like "my name is..." and "I live at...". - Nothing leaves the machine. The only permission is "storage". Zero network calls, no telemetry, no account. CI fails the build if any network call enters the bundle.
It is free, and the detection code is MIT open source at github.com/raeven-co/sether. You can install it from the Chrome Web Store at [CHROME_STORE_LINK].
What can a browser extension not do?
Being honest about limits matters more here than anywhere. Sether Shield watches the input box. It is not a network proxy and cannot be one under Manifest V3, so it does not see or filter the actual HTTP traffic.
- It does not cover your product's API calls to LLM providers. That needs a server-side layer: see the TypeScript walkthrough or the Python one.
- It only runs on the chat sites it declares (ChatGPT, Claude, Gemini). A new AI site is uncovered until support is added.
- It cannot catch what detectors do not detect. Validated patterns and conversational cues cover a lot, but a name dropped mid-sentence with no cue can slip through. It is a seatbelt, not a force field.
- It is Chrome-only today, and it does not stop file uploads, only text in the prompt box.
How do you roll this out to a team?
| Step | What to do | Why it works |
|---|---|---|
| 1. Frame it as a seatbelt | Announce it as protection for employees, not surveillance of them | It genuinely is: no telemetry means there is nothing to report back to anyone |
| 2. Start with volunteers | Ask the support and engineering teams to try it for two weeks | The people who paste the most become the advocates |
| 3. Show the count, not the shame | Share aggregate "the shield flagged N items this month" stories, self-reported | Makes the invisible risk visible without naming anyone |
| 4. Pair it with a clear policy | One page: what is fine to paste, what is not, and what the shield does | People follow rules they understand and can actually comply with |
| 5. Cover the API side too | Add server-side redaction to your product's LLM calls | The extension covers humans; your code paths need their own layer |
The goal is not zero AI use. The goal is that the fast path and the safe path are the same path, so nobody has a reason to route around you.
Frequently asked questions
- Does Sether Shield send my prompts anywhere for analysis?
- No. All detection runs locally in the tab using the open-source detector packs. The extension makes zero network calls, has no telemetry and no account, and its only permission is "storage". The CI pipeline fails the build if any network call enters the bundle.
- Will scrubbing break the AI's answer?
- Usually not. Placeholders like [email-1] keep the prompt coherent, and the model reasons about the structure the same way. If the answer genuinely needs a real value, undo restores it in one click and you decide what to send.
- Can this replace a DLP product or server-side redaction?
- No. It covers one specific, high-frequency gap: humans pasting into AI chat sites. Your product's own API calls to LLM providers need a library or gateway in the request path, and enterprise DLP covers channels an extension never sees.
- What happens to the original values after a scrub?
- They are held in in-tab memory only, so undo works during the session, and they are cleared when the page reloads. Nothing is persisted to disk and nothing leaves the machine.
Sether is free and MIT-licensed: npm i @raeven-co/sether · pip install sether. Or paste some text into the live sandbox and watch the redaction happen.
Keep reading
- PII redaction for LLM applications: the complete guide (2026)How to keep names, emails, cards, and secrets out of OpenAI, Anthropic, and other LLM providers: detection methods, reversible tokenization, streaming pitfalls, and tool comparison.
- How to redact PII before sending prompts to OpenAI (TypeScript)A hands-on TypeScript tutorial: detect and redact emails, phones, cards, and API keys before they reach OpenAI, then restore them in the reply. Streaming included.
- Is it GDPR-compliant to send customer data to OpenAI?It can be, if you sign the DPA, list OpenAI as a sub-processor, handle the US transfer, and apply technical measures like redaction. Here is the honest checklist.