Shield by Cinder Labs

Prevent sensitive data leaks to AI. Scans text, file uploads, and images (OCR) in real time. Shadow AI detection. Enterprise DLP.

Shield protects your organization from sensitive data leaking into AI services like ChatGPT, Claude, Gemini, Copilot, and 20+ others. KEY FEATURES Real-time DLP scanning: Detects Social Security numbers, credit cards, AWS keys, private keys, database connection strings, API tokens, and more before they leave the browser Format-preserving substitution: Instead of replacing a detected value with a placeholder that breaks whatever receives it, Shield swaps in a syntactically valid stand-in — a real-shaped SSN, a card number that still passes Luhn, a working-looking email address — drawn from reserved ranges that can never belong to a real person. Downstream tools and AI models keep working on well-formed data. Substituted values can optionally be annotated so the recipient knows a swap occurred. File upload protection: Extracts text from PDFs, Word documents, Excel spreadsheets, and plain-text files at attach time and applies the same DLP rules — sensitive files are blocked before they reach the AI provider Image OCR: Optically scans pasted, dropped, or attached images (PNG/JPG/screenshots) so a screenshot of a customer record is treated like the typed text would be Shadow AI detection: Monitors and logs employee access to unsanctioned AI services with configurable allow/monitor/block policies per service Smart enforcement: Four modes per rule — log silently, substitute the sensitive value and let the rest through, prompt for a written business justification, or hard block — so policy can match the sensitivity of the data instead of stopping everything Override audit trail: When users override a block, they must provide a business justification that gets logged for compliance Enterprise deployment: Supports Chrome managed policies (GPO/MDM) for zero-touch rollout across your organization Works without a server: Built-in DLP rules protect against common data leaks even before connecting to a Shield server 100% client-side extraction: File contents and OCR run inside the browser — file bytes never travel to Cinder Labs or any third party HOW IT WORKS Shield intercepts data at the browser level before it reaches AI services. It scans outbound requests (fetch, XHR, WebSocket, form submissions, paste events, file uploads, and URL parameters) for sensitive data patterns. For file uploads, Shield extracts text from PDFs (PDF.js), Word docs (mammoth), spreadsheets (SheetJS), and images (Tesseract OCR) entirely inside the browser, then runs the same DLP rules against the extracted text. When a match is found, the extension blocks the request and shows a clear notification explaining what was detected. The extension connects to your Shield server for centralized policy management, event reporting, and custom DLP rules. IT admins can push configuration via Chrome enterprise policies for hands-free deployment. WHAT IT DETECTS PII: Social Security numbers (with and without dashes) Financial: Credit card numbers (with Luhn validation to reduce false positives) Credentials: AWS access keys, secret keys, API keys, bearer tokens Secrets: Private key blocks (RSA, EC, DSA, OpenSSH) Infrastructure: Database connection strings (PostgreSQL, MySQL, MongoDB, Redis) Custom rules: Define your own regex patterns via the Shield server PRIVACY Shield only scans data that is actively being sent to websites. It does not read browsing history, track user behavior, or collect any data beyond what is needed for DLP enforcement. Detected values are masked before any event leaves the browser. All event data is sent exclusively to your organization's Shield server — never to third parties. REQUIREMENTS Chrome or Chromium-based browser (Edge, Brave, etc.) Optional: Shield server for centralized management and reporting Built by Cinder Labs — https://cinderlabs.ai