Tools

Before you paste

When you paste something into a chatbot, everything in it goes — the account number you forgot was in the email you copied, the colleague’s name in the thread, the API key in the stack trace. This page runs the same 17 patterns an organisation’s policy router runs on egress, so you can see what is in a message before you send it somewhere.

Nothing you paste leaves this page, and not because we promise. The detectors run in your browser, and this page has nowhere to send anything — no endpoint, no upload, no logging of what you typed. Close the tab and it is gone. You can check that claim rather than take it: open your browser’s network panel and paste something.

It runs in your browser and nothing is uploaded. It would be a poor joke to ask you to send us the text you were worried about sending somewhere. There is no endpoint on this page that accepts text — watch your network tab while you press the button.

Paste what you were about to send

Categories to check

financialPayment card number, IBAN, Account number, MNPI marker

identityUS SSN, UK National Insurance, Passport number, Date of birth

healthbroadMedical record number, NHS number, Diagnosis code

contactbroadEmail address, Phone number, Personal name marker, Street address

secretsAPI key or token, Private key block

The three precise categories are on by default. The two marked broad are off, because they match text that is not personal data at all — switch one on and its caveat appears with it.

0 characters

This runs in your browser. Nothing is uploaded — there is no endpoint here that accepts text, which you can confirm in your network tab.

What this is, honestly

Patterns, not comprehension

Every check here is a regular expression. It finds things shaped like a card number or an SSN. It cannot tell that a paragraph is about someone’s divorce, or that a product codename is confidential. No match is not a clean bill of health — it means these patterns found nothing, which is a much smaller claim.

Some of it over-matches, and we say which

The health and contact categories are marked broad and are off by default, because a diagnosis-code pattern fires on B12 and an NHS-number pattern fires on any run of 3-3-4 digits, including order references. Inside a company’s own router that over-matching is a deliberate, conservative choice. Presented to you as a finding about your text, it would just be wrong.

This changes nothing about what you send

It is a preview. Nothing here intercepts anything, and pasting into a chatbot afterwards sends whatever you paste. The only thing this can do is tell you what is in the text before you decide.

Where the real version sits

An organisation running the policy router does this on egress, before the provider is contacted, and writes a hash-chained record that it did — so there is evidence afterwards rather than a person’s recollection. That is the product; this page is the part of it that fits on one screen.

The patterns in full

Category	Looks for
financial	Payment card number, IBAN, Account number, MNPI marker
identity	US SSN, UK National Insurance, Passport number, Date of birth
health	Medical record number, NHS number, Diagnosis code
contact	Email address, Phone number, Personal name marker, Street address
secrets	API key or token, Private key block

The router records only that a category matched and how many times — never the value that matched. That is a property of the code, not a policy: see the method and the router.