Lustena AI DLP

Classifies on this device what you send to AI chat apps and reports findings to your Lustena workspace, or keeps them local.

Lustena AI DLP helps companies know when sensitive data is sent to AI chat apps. Classification happens on this computer, and the text you write does not leave it. What is sent, and when - Nothing, until the extension is connected to a Lustena workspace: by your organisation's policy, or by you, when you paste an enrollment token and click Connect in the Connection panel. Before you click, the panel says what will be sent. - Once connected, only content-free data goes to https://api.lustena.ai: findings (the kind of data, severity, count, app, channel, time and a keyed fingerprint from which the value cannot be recovered) and metadata about conversations (a derived id, each turn's number and time and, in a custom GPT or project, a code derived from it, never its name) and about the computer. For attachments, the file type, its size and a fingerprint of its name. Your e-mail is included only if your organisation configured it or you typed it when connecting. - Optional, and off by default: an admin can turn on redacted capture. The text of each turn and the AI's answer are then sent with every recognised value replaced by its kind, for example "my email is [pii.email]". Values it does not recognise, such as names, stay in the text, and raw text is never sent. While capture is on, the extension's page shows "Captura de conteúdo: ATIVA (texto redigido)". - Data goes only to the connected workspace, never to another: switching tokens or disconnecting discards anything not yet uploaded. What it does - Works only on chatgpt.com, chat.openai.com and claude.ai. - When you send a prompt, paste text or attach a file, it looks for Brazilian identity documents, email addresses, phone numbers, card numbers and credentials such as API keys. Each match becomes a finding. - It observes and reports: it does not block or change what you send. How to connect Your IT team can deploy it through enterprise policy (Google Admin, Microsoft Intune, Jamf or Group Policy); it is then managed and cannot be reconnected by hand. Without a policy, open the findings page from the extension's icon and, in the Connection panel, paste an enrollment token created in your workspace. Disconnecting returns to local mode. What you can see The findings page shows whether the extension is local, connected by you (workspace, token, the connection date, content capture and a Disconnect button) or managed, and everything recorded here. Privacy policy: https://lustena.ai/trust/privacy/extension Published by C-137 Labs for Lustena customers. Without a workspace to connect it to, it only lists findings locally.