Classic DLP uses regex patterns to detect credit card numbers, SSNs, and email addresses. It has no concept of natural language, context, or the bidirectional nature of AI conversations.
A prompt like "analyse this customer profile: John Smith, born April 12 1985, account ending 4412" contains PII that no regex will catch — but Kovral's LLM-aware classifier will.
Traditional DLP only scans outbound data. AI responses can leak data too — a model might repeat back sensitive information from its context window. Only Kovral scans both directions.
DLP can't understand that "the patient mentioned above" refers to previously stated PII, or that a code snippet contains an embedded API key in a non-standard format.
Kovral's DLP engine uses the same semantic understanding as large language models to detect sensitive data — in all its natural language variations.
18 built-in data categories: PII, PHI, PCI (credit cards, bank accounts), credentials (API keys, passwords), source code, legal documents, financial data, and more. Custom categories supported.
Every prompt is scanned before reaching the AI model. Matched data can be redacted (replaced with a placeholder), blocked (prompt rejected), or logged (allowed with audit entry).
AI responses are scanned before returning to the user. If a model inadvertently includes sensitive data from its context window or training data, it's caught before the user sees it.
Four redaction modes: mask (replace with ***), token (replace with a reversible token for analytics), substitute (replace with synthetic data), or block (reject the interaction entirely).
