Masking on the endpoint · Fleet monitoring
Let AI use data it never sees.
Your teams already use AI. Your data does not have to go with it.
Neverseen sits between AI tools and LLM providers. Before a request leaves the workstation, sensitive values are replaced by plausible stand-ins. The model reasons normally. When the response comes back, the local encrypted vault restores the originals.
On the workstation · The request
What the provider receives · The request
On the workstation · The response
What the provider receives · The response
Stand-ins keep the exact shape of the original and carry a deliberately invalid checksum: no generated national ID, IBAN or card number can point at a real person. A secret never gets a stand-in: it always travels as a token, even in stand-in mode. That is what makes restoration safe — no value put back can be mistaken for a live key.
The blind spot
Nobody waits for your approval to use AI.
A developer runs Claude Code across a whole repository. A lawyer pastes a contract into an assistant. A support script summarises last night’s ticket queue. Every one of those actions sends plain text to a third-party provider, from a machine your enterprise gateway never sees.
Central gateways protect the applications you built. They do not protect what an employee launches from a terminal — which is exactly where the freshest and least filtered company data lives.
What actually leaves today
- Code excerpts, along with the environment variables and keys inside them.
- Named customer records pasted into a prompt to save a few minutes.
- Incident logs carrying addresses, identifiers and account numbers.
Banning AI solves nothing: it moves the usage onto personal accounts, where you see nothing at all.
The mechanism
Four steps, on the endpoint, before anything leaves.
- 01
Detect
An ordered pattern catalogue recognises contact details, national identifiers — French, UK and US — and secrets. Wherever a checksum exists, it decides alone: the French NIR, SIREN and SIRET, IBANs, payment cards, NHS numbers and ABA routing numbers are verified, not guessed at.
- 02
Substitute
Every value gets a stable stand-in: same shape, same length, unattributable by construction. Reserved domains and address ranges, deliberately invalid checksums, indices that are never drawn at random.
- 03
Let the model work
The prompt stays readable prose. The model reasons over a coherent story rather than a wall of redaction bars — that is what separates masking from deletion, and what keeps the answer usable.
- 04
Restore
The response passes back through the local encrypted vault and regains the original values, line by line, streaming included. Sensitive content never left the machine.
The invariant
Here is everything that reaches our servers.
Not an excerpt chosen for the brochure: the entire message an agent sends. One five-minute window, the state it is actually applying, and nothing else.
- No prompt, no response, no detected value — not even truncated. No file name, no URL.
- Two exceptions, written here rather than discovered in a database. The first: the machine’s own local IP addresses. Not content — nothing about the traffic travels in them — but an address identifies a machine, and through it a person. It is there because a fleet view without it does not work: “ag_7f3c1a9e is silent” sends nobody anywhere, “the laptop at 10.4.2.87 is silent” sends somebody to a desk.
- The second, more direct and knowingly so: the name the workstation calls itself. A machine is often named after the person using it, so “marie-macbook” names somebody where an address only names a machine. That is exactly why it is reported: it is the identifier an operator already recognises, and the only one that survives a laptop moving between networks. It is sent as the operating system gives it, never resolved and never hashed — hashing would keep the personal data and lose the use.
- State reports what the agent applies, not what a file intends: switched-off categories, secret level, loaded locales. An agent carrying three locales that has stopped masking email addresses shows up here, where a console reading configuration alone would paint it green. It also reports how the agent itself is exposed: values printed in clear to a console, exchanges written to disk, listening beyond loopback, a provider rerouted, values exempted from masking.
- The counters describe the control as much as the traffic: requests refused because the body could not be read, windows lost beyond the buffer, answers restored piecemeal. They also carry the inventory nothing else gives you — which AI tools are running on the workstations, which providers answered and how, and what the models asked the workstation to run: how many tool calls, how many put back a value the model never saw, and what class the commands fell into. Words from closed vocabularies, never the arguments.
- The telemetry contract is public and versioned, and a test walks the type itself, refusing any text field that has not been argued for, line by line. The invariant is verified on every build, not promised in a sales call.
POST /v1/heartbeat
{
"schema": 2,
"agent_id": "ag_7f3c1a9e",
"sent_at": "2026-08-25T10:35:00Z",
"state": {
"version": "1.4.2",
"platform": "darwin/arm64",
"started_at": "2026-08-25T08:02:11Z",
"locales": ["fr", "gb"],
"substitution": "fake",
"providers": ["anthropic", "openai"],
"addresses": ["10.4.2.87"],
"hostname": "poste-47.exemple",
"masking": "partial",
"switched_off": ["DOB"],
"secret_level": "medium",
"console": false,
"tracing": false,
"exposed": false,
"rerouted": [],
"allowlisted": 12
},
"buckets": [
{
"window": {
"start": "2026-08-25T10:30:00Z",
"end": "2026-08-25T10:35:00Z"
},
"counters": {
"requests": 412,
"masked": {
"EMAIL": 138, "PHONE": 61, "NIR": 4,
"IBAN": 12, "SIREN": 27, "SECRET_ANTHROPIC_KEY": 9
},
"models": {
"claude-opus-5": {
"input": 84900, "output": 96430,
"cache_write": 21400, "cache_read": 1200000
},
"gpt-5.2": { "input": 210400, "output": 18220 }
},
"restarts": 1,
"dropped": 0,
"refused": 1,
"providers": { "anthropic": 380, "openai": 32 },
"upstream": {
"ok": 404, "rate_limited": 5, "rejected": 2,
"failed": 1, "unreachable": 0
},
"clients": { "claude-code": 371, "openai-sdk": 32, "cursor": 8, "other": 1 },
"policy": { "applied": 1, "refused": 0 },
"degraded": 1,
"sessions": {
"active": 6, "opened": 2, "closed": 3,
"duration": [0,0,0,0,0,0,1,0,0,1,0,0,1,0,0,0,0,0,0,0,0,0,0,0],
"requests": [0,0,1,0,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],
"input": [0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,1,0,0,0],
"output": [0,0,0,0,0,0,0,0,0,1,0,1,0,1,0,0,0,0,0,0,0,0,0,0],
"tool_calls": [1,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],
"masked": [0,0,0,1,0,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
},
"tools": {
"calls": 96, "restored": 7,
"names": { "Bash": 54, "Read": 31, "mcp": 8, "other": 3 },
"programs": { "git": 21, "grep": 14, "python3": 6, "other": 13 },
"classes": { "network": 3, "privilege": 1 }
}
}
}
]
}ISO/IEC 27001:2022
What the auditor will ask for, and what you will show.
A control only counts if it exists, if it runs, and if you can prove it. Neverseen covers all three.
| Control | What the auditor expects | What you show |
|---|---|---|
| A.8.12 — Data leakage prevention | A DLP measure exists on the AI channel. | The agent, installed and running on every endpoint. |
| A.8.16 — Monitoring activities | You know the measure is actually running. | Live fleet view and alerting on silent agents. |
| A.8.15 — Logging | Logs that hold up: timestamped, tamper-evident, exportable. | Hash-chained proof log, CSV and JSONL export. |
| A.5.36 — Conformance with policies | Every endpoint applies the policy you decided on. | Version, locales, substitution mode and the categories actually masked, in every heartbeat. |
| A.5.19 to A.5.23 — Suppliers and cloud services | The processor is identified and auditable. | EU hosting, and a backend that receives no content at all. |
Model
The agent is free. What you pay for is the proof.
Protecting a workstation should not carry a price tag. What has a cost is proving to an auditor that all twelve machines on your team have applied the same policy for six months.
Your teams can finally use AI with their real data.
Without handing it to the models.
Protect locally. Monitor centrally. Prove continuously.