shadow ai · browser extension · data privacy · chatgpt · security culture

How to stop pasting sensitive data into ChatGPT (without banning it)

Review sensitive drafts with Sether Shield: local text processing, Free essentials, optional Pro workflows and the limits of browser-side controls.

Godfrey Lebo Founder, Sether July 9, 2026 · updated October 17, 2026 · 9 min read

Sether™ / Field notes shadow ai Review the draft before Send. Keep useful context while inspecting sensitive details.

What do people actually paste into ChatGPT?

A support ticket can contain a customer name and email. A customer list can include identifiers in ordinary columns. A copied configuration can contain a live key. The task may need the question or error message while needing very little of that identifying detail.

SetherThe idea, illustrated Your map. Your side.

Nobody does this maliciously. They do it because it works: the model writes the reply, finds the bug, summarizes the list. The sensitive data was just along for the ride, and once it is sent, you cannot unsend it.

This is a different problem from your product's own API calls to OpenAI or Anthropic. Those run through code you control and are covered in our complete guide to PII redaction for LLM apps. This post is about the humans and their browsers.

Why do blanket bans fail?

A restriction is easier to follow when people have an approved way to do the task. Without one, someone may switch to an unmanaged account or device. That is a risk to plan for, not a claim that every ban or every team behaves the same way.

Give users a clear alternative: which tasks are allowed, which details to remove, how to review replacements and when not to send a request at all. A browser control supports that workflow; it does not replace organization policy or device controls.

The seatbelt analogy is useful if its limits stay visible. The guard helps at the moment a person reviews a draft. It does not turn every AI use into an approved use, and it cannot protect channels it does not inspect.

What does browser-side guarding look like?

The idea is simple. Something watches the prompt input box on the AI chat sites, the same way Grammarly watches a text field. When it sees an email, a phone number, a card number, or an API key in the draft, it tells you before you hit send.

In the compatible licensed pilot, the default Mask action edits matched values to masks. Optional Pro decoys use realistic stand-ins; an explicit Redact selection or watchlist redact action can use placeholders such as [redacted-1]. Review the result before sending. The website may already read text in its own page, and detection can miss a value.

This is the human-side complement to API-side redaction, not a replacement for it. Your app's server-side calls need a library in the request path, in TypeScript or Python. The extension covers the copy-paste habits no server-side code can see.

How does Sether Shield work?

Sether Shield is a Chrome extension (Manifest V3) with protected-site input controls for compatible editors, including chatgpt.com, chat.openai.com, claude.ai and gemini.google.com. It complements the library integration by helping people review drafts in their browser.

• Input watcher, not a proxy. Shield watches compatible editable fields on protected origins. It edits page text rather than filtering the actual outgoing network request. Review the result before sending.
• Floating shield with a live count. As you type or paste, the shield shows how many pieces of PII are currently in the draft.
• Choose the handling action. Mask is the default in the compatible licensed pilot. Optional Pro decoys insert realistic stand-ins; explicit selection/watchlist redact actions can produce [redacted-N] placeholders. Review the edited text rather than assuming one action or format across every release.
• Undo and restore. Originals and replacements are mapped in page memory and Chrome memory-only session storage, so a mapping can survive a refresh and is cleared when the browser closes. Settings, watchlists and limited replacement history are stored locally across restarts. Known-mapping restore remains Free after trial or paid access expires.
• Real detectors, not toy regex. It runs the same detector packs as the open-source @raeven-co/sether/browser build: validated email, phone, card with Luhn, IBAN with mod-97, the secrets pack for API keys and tokens, plus conversational detection for phrases like "my name is..." and "I live at...".
• Local text processing. Shield’s detection and replacement do not upload prompt text, replies, watchlists or vault mappings for analysis. It uses storage, context-menu and page-access permissions. Free essentials need no Pro account; explicit trial or license activation in compatible releases exchanges account/license metadata with Sether, separate from prompt processing.

The detector libraries remain fully MIT and free at github.com/raeven-co/sether. Shield source is available for inspection. Free essentials remain available without a Pro account; new official releases introduce optional Pro. See pricing for compatible-build and pilot availability before starting a trial.

The tool pilot offers seven days of Pro only after an explicit in-app opt-in; installation alone does not start the clock, and no card or automatic charge is involved. The pilot paid periods are $5 for one calendar month or $48 for one calendar year, manual renewal, for one person across both tools. Check pricing for compatible builds and availability; older store builds may retain legacy Free features.

Try a fictional draft first: use an email, a phone and one company term you want to keep private. Inspect the matches, choose the replacement style, read the result and rehearse undo. To restore a reply, the session mapping must still exist. Showing originals on the page exposes them to that page’s scripts; copying a restored reply puts them on the system clipboard instead.

What can a browser extension not do?

Being honest about limits matters. Sether Shield watches compatible input fields and supported rendered replies. It is not a network proxy and does not filter actual outgoing HTTP traffic.

• It does not cover your product's API calls to LLM providers. That needs a server-side layer: see the TypeScript walkthrough or the Python one.
• Its prompt controls activate on origins in the protected-site allowlist. You can add other origins, but a custom editor or changed site interface may be incompatible.
• It cannot catch what detectors do not detect. Validated patterns and conversational cues cover a lot, but a name dropped mid-sentence with no cue can slip through. It is a seatbelt, not a force field.
• It is a Chrome extension today. Prompt controls do not inspect file uploads, attachments, images or your application’s server-side API traffic.

How do you roll this out to a team?

The goal is not zero AI use. The goal is that the fast path and the safe path are the same path, so nobody has a reason to route around you.

Written by Godfrey Lebo

Founder of Sether. Ships production software for a living and reads every comment below. More about the team.