# Data Loss Prevention

Two layers of protection.

Gateway DLP (before requests leave the gateway)

Rule = regex + action (block / mask / log), up to 50 rules.

Factory rules: API keys (sk-...) blocked; bank card / phone / ID numbers masked (first 4, last 4 kept).

Scan scope: the last user message; block hits in history degrade to [REDACTED]. Rules hot-apply instantly.

Client-Side Local Rules

policy.clientRules execute on the device (no gateway round-trip): blocked words and blocked URLs. Delivered with policy, effective within ~60 seconds.

Hit Auditing

All hits are logged and searchable in the admin console.