What to take away
Preventing sensitive data leaks across ChatGPT, Claude, Google Gemini, and Microsoft Copilot requires three distinct layers: disabling model training in contracted work tenants, verifying whether employees are signed into work or personal accounts in the browser, and inspecting or masking sensitive prompts and text uploads before submission.
1. Separate the four ways company data leaks through AI tools
Teams often treat "data leaking into AI" as a single problem, then buy or configure a control that closes only one path. Before writing browser rules, map which of the four exposure paths actually happens in your workspace.
Contractual no-training terms protect inputs submitted inside your paid enterprise workspace, but they do nothing when an engineer signs into a personal Claude or ChatGPT tab on the same laptop, uploads a CSV export to a signed-out tool, or uses Copilot on a SharePoint site shared with the entire company.
| Leak path | What goes wrong | Control layer that addresses it |
|---|---|---|
| Consumer or personal AI account | Prompts may be retained or used for model training outside any corporate DPA | Browser account-context detection plus domain or session restrictions |
| Raw PII or secrets in prompts | API keys, IBANs, customer emails, or confidential terms are sent verbatim to an LLM | Inline browser prompt masking or targeted sensitive-prompt blocking |
| File and code attachments | Employees attach CSV, JSON, source code, or PDF files directly into chat composers | Attachment inspection for text/code plus upload rules for uninspected binary files |
| Overshared internal grounding | Microsoft 365 Copilot or connected agents surface files with overly broad internal ACLs | SharePoint, OneDrive, and Google Drive permission cleanup and OAuth review |
References: ANSSI - Security recommendations for a generative AI system · NCSC - Guidelines for secure AI system development
2. Lock down training, retention, and SSO in your approved AI tenants
Give employees at least one approved AI workspace with SSO and a signed Data Processing Addendum before restricting consumer tools. In business tiers such as ChatGPT Enterprise/Team, Claude for Work/Enterprise, Google Workspace with Gemini, and Microsoft 365 Copilot, verify that vendor model training on your organization’s prompts is disabled by default or turned off in admin settings.
Check retention windows, workspace export permissions, and shared-conversation link settings at the same time. A public "share chat" URL created inside an otherwise approved workspace can still expose internal prompts outside your tenant if link sharing is left open.
References: ANSSI - Security recommendations for a generative AI system · Google Workspace Admin Help - Generative AI privacy and governance · Microsoft Learn - Data, Privacy, and Security for Microsoft 365 Copilot
3. Mask or block sensitive prompts at the browser composer
Network proxies and DNS filters can block an entire domain such as chatgpt.com or claude.ai, but they cannot distinguish a harmless formatting question from a pasted production API key, nor can they tell a personal login apart from your corporate workspace without TLS decryption complexities.
Browser-level AI DLP inspects the draft inside the composer right before submission. Decide per data category whether to warn, mask in place with realistic fictional placeholders (for example replacing a real customer email, IBAN, or credential while letting the employee finish drafting), or block submission outright.
- Credentials and secrets (API keys, tokens, private keys): block or mask immediately and rotate any real secret that left the device.
- Customer and employee PII / PHI (names, emails, phone numbers, national IDs, health references): mask automatically in-draft so summarizing and translation tasks continue safely.
- Internal codenames and confidential financial figures: match custom company dictionaries or confidential categories and restrict to approved corporate tenants.
References: NCSC - Guidelines for secure AI system development · Elba Documentation - Browser extension security capabilities
4. Account for attachment formats and inspection boundaries
Employees do not only type prompts; they drag CSV exports, JSON payloads, source files, PDFs, and spreadsheets into ChatGPT, Claude, Gemini, and Copilot. Test how your control handles both text-based uploads and binary documents on every managed browser in your fleet.
Make sure your security team documents exact format boundaries rather than assuming every attachment is deep-scanned. Where a browser control inspects text and code excerpts up to a defined size limit while recording metadata only for binary formats such as PDFs, Office documents, images, or archives, pair browser checks with SaaS file-sharing hygiene and clear policy rules on binary uploads.
References: Elba Documentation - Browser extension security capabilities
5. Validate account context and controls across every managed browser
Run a repeatable four-test script on enrolled devices whenever you roll out or update a rule: a benign prompt on an approved corporate AI account, a synthetic credential or IBAN prompt that should trigger masking or blocking, a personal or signed-out session check, and representative CSV and PDF uploads.
Deploy extensions via MDM or browser management policies (Google Admin for Chrome, Intune or Group Policy for Edge, enterprise policies for Firefox, and Apple Declarative Device Management or macOS installer packages for Safari) so employees cannot silently disable protection.
References: Elba Documentation - Browser extension security capabilities · Elba Documentation - Deploying the browser extension across MDM and browsers
How Elba protects prompts and uploads in ChatGPT, Claude, Gemini & Copilot
Elba’s browser extension runs across Chrome, Edge, Firefox 128+, and Safari 26+ (requiring macOS 26+ and MDM package deployment) and covers ChatGPT, Claude, Google Gemini, and Microsoft Copilot. It detects local account context (work, personal, signed-out, or unknown) without harvesting credentials, blocks unauthorized AI domains, and enforces Browser Security Playbooks.
When configured, Elba blocks sensitive prompts or automatically masks PII, PHI, credentials, financial data, and confidential terms directly inside the composer draft using fictional replacement values (failing closed if classification exceeds its 18-second timeout). For file uploads in ChatGPT, Claude, Gemini, and Copilot, Elba inspects text and code attachments up to 5 files / 16,000 characters; binary files (PDFs, Office documents, most images, and archives) are recorded as metadata only. AI classification runs statelessly via OVHcloud AI Endpoints in Gravelines, France, while stored findings retain only classifications, SHA-256 hashes, and required metadata on OVHcloud EU core databases (or Neon in the US), never raw prompt text.
References: Elba Documentation - Browser extension security capabilities · Elba Documentation - Deploying the browser extension across MDM and browsers
Checklist to prevent AI prompt and upload leaks
Your checks stay on this page and reset when you reload it.
Common questions
Does ChatGPT Enterprise or Claude for Work stop leaks on its own?
It protects data submitted inside that contracted workspace from vendor model training, but it does not stop an employee from opening a personal ChatGPT, Claude, or Gemini account in another browser tab or pasting live production secrets that should never leave your environment.
What is the difference between prompt blocking and automated prompt masking?
Prompt blocking stops the message from being sent and explains the policy rule. Automated prompt masking replaces detected sensitive spans (such as names, emails, IBANs, or keys) with realistic fictional values inside the draft so the employee can review the sanitized text and complete their task without exposing real data.
Can browser AI DLP inspect PDFs and Excel files uploaded to ChatGPT or Claude?
Always verify format limits per tool. In Elba’s browser workflow, text and code attachments (such as TXT, Markdown, CSV, JSON, and source files) provide bounded excerpts up to 5 files / 16,000 characters for inspection, whereas binary files such as PDFs, Office workbooks, images, and archives record metadata only.
Does inspecting prompts mean security admins can read everything employees type?
It should not. Follow data-minimization guidance from ANSSI and the NCSC: in Elba, classification runs ephemerally and stored findings retain only the triggered category, SHA-256 hash, and event metadata rather than raw prompt contents.
Sources & further reading
Primary documentation used to review this guide. Product settings and edition requirements can change; check the linked documentation before making changes.
- ANSSI - Security recommendations for a generative AI system
- NCSC - Guidelines for secure AI system development
- Google Workspace Admin Help - Generative AI privacy and governance
- Microsoft Learn - Data, Privacy, and Security for Microsoft 365 Copilot
- Elba Documentation - Browser extension security capabilities
- Elba Documentation - Deploying the browser extension across MDM and browsers