Sovara

Stop secrets, PII and card numbers leaking into AI chat - checked locally, before you hit Send.

Sovara checks every message at the moment you hit Send in AI chat - locally, on your machine - and blocks secrets, PII and card numbers before they leave. No account. No signup. The free tier works entirely on-device. HOW IT WORKS 1. You hit Send on ChatGPT, Claude, Gemini, Copilot or Perplexity. 2. Sovara evaluates the draft against your policy, in the browser. The message text is never transmitted for the check - you can verify this in DevTools. 3. It allows, warns, redacts or blocks; when it intervenes, the reason appears in an overlay the site can't hide. WHAT IT CATCHES Twenty-four built-in detectors: card numbers (Luhn-validated), UK National Insurance numbers, SSNs, email addresses, IPv4/IPv6 addresses, phone numbers, JWTs, AWS access keys, GitHub tokens, Slack tokens, private-key headers, Stripe keys, Google API keys, Twilio keys, SendGrid keys, npm tokens, Azure connection strings, database URIs, generic API key headers, PyPI tokens, Docker Hub tokens, Mailchimp keys and GitLab tokens — plus your own custom regex and confidential-term rules. Invisible zero-width characters are normalised away first, so a card number spliced with hidden spaces is still caught. POLICY PRESETS Default, Finance (PCI-DSS: IBAN, sort codes, SWIFT, business-hours windows), Health (NHS numbers, MRN, patient IDs), and Legal (privilege markers, matter and court references). Or write your own rules. SITES GOVERNED ChatGPT (chatgpt.com, chat.openai.com), Claude (claude.ai), Gemini (gemini.google.com), Copilot (copilot.microsoft.com) and Perplexity (perplexity.ai) — verified blocking in real browsers, including Copilot's iframe composer. The extension runs only on these sites, nowhere else. PRIVACY, PLAINLY • The policy check runs inside your browser. 0 bytes of message text are sent for it. • Free tier: nothing is sent anywhere at all — there is no backend. • Team plans (optional): the extension syncs policy from your organisation and reports audit METADATA only (decision, rule id, site, timestamp, a user identifier; never message text) to your org's dashboard.