Your data doesn't leak through a port. It leaks through a prompt.
Legacy DLP watches files, endpoints and uploads. Agents don't move files — they read, summarize, transform and transmit. Gödel classifies content in motion, on your device, follows it through every transformation, and decides whether it may leave — before the call is made.
Every path data can take out.
One policy engine covers all of them — no separate module per channel.
See data loss prevention in action
Watch Gödel intercept an agent uploading a summary derived from a restricted HR file — classified, traced through the rewrite, and blocked in under 5 ms.
Six ways data walks out.
Six verdicts before it does.
Real traces from the enforcement path. Every action is attributed to its user and agent identity, checked against the data it actually touches, and decided in under 5 ms — locally, before the payload leaves the process.
Customer PII into a public model
REDACTEDbrowser-agent → 4,812 rows → openai.com
Names, emails and card fragments detected on-device in the outbound payload. The prompt still goes through — the identifiers don't.
Source to an unapproved endpoint
BLOCKED · 4 MScursor → POST api.personal-llm.io/v1
A personal API key routing proprietary repo contents to a model outside your approved list. Destination policy is evaluated per call, not per app.
Credentials in model context
REDACTEDclaude-code → AWS_SECRET_ACCESS_KEY
Keys, tokens and connection strings are stripped from file contents and prompt context before the payload leaves the machine.
Derived data from an HR file
BLOCKED · 3 MSdesktop-agent → summary.md ← comp.xlsx
The file was summarized, renamed and rewritten. The classification travelled with it. Regex on the original filename would have seen nothing.
PHI through a third-party MCP server
BLOCKED · 4 MSlanggraph → mcp://crm/create_note
Patient identifiers headed to an external tool with no BAA. Tool calls are inspected as an egress channel — because that's what they are.
Screen capture of a customer record
HELDdesktop-agent → screencapture → vision
Screenshots are classified as content, not pixels. Regulated data on screen pauses for explicit human confirmation.
Agents don't copy data.
They rewrite it.
Pattern-matching DLP sees nothing here — new name, new format, nothing sensitive-looking on the way out. Gödel moves the handling requirement with the content, not the filename.
comp_2026.xlsx
Classified on-device at the moment of access: HR + PII, restricted, no external output.
Agent summarizes
Content is condensed into prose. Names dropped, bands retained. Filename gone.
~/notes/summary.md
A new artifact with no sensitive-looking name, path or extension.
Upload attempt
Destination is external. The inherited requirement says no external output.
Legacy DLP was built for a perimeter agents don't use.
Endpoint and network DLP watch file operations, uploads and known applications. An agent acting on your behalf produces none of those signals in a recognisable form.
| Endpoint / network DLP | Gödel Security Gate | |
|---|---|---|
| Unit of detection | File operations and app-level uploads | The agent action, plus the data that action touches |
| Derived content | Loses the label when content is summarized or rewritten | Handling requirements inherited through every transformation |
| Who acted | A user, or a process name | User + agent identity + session + model, on every decision |
| Egress channels | Web, email, USB, print | Model APIs, MCP tool calls, shell sockets, file writes, screen capture |
| Decision point | After the copy — alert and investigate | Before the call leaves the process — allow, redact, hold or block |
| Where content is inspected | Shipped to a cloud service for scanning | On-device. Content never leaves the endpoint to be classified |
| Determinism | Varies by rule tuning | Same action, same verdict, every time — and it's in the audit trail |
Detected in milliseconds,
on the endpoint.
Detection runs locally as content enters, moves through, or attempts to leave an agent workflow. In SaaS deployments content is never sent anywhere for processing; air-gapped self-hosting is available.
PII
Names, emails, national IDs, addresses
PHI
Patient identifiers, diagnoses, claims
PCI
PANs, CVVs, cardholder data
Secrets & credentials
API keys, tokens, connection strings
Source code & IP
Proprietary repos, models, algorithms
Financial & M&A
Forecasts, deal rooms, unreleased results
HR & compensation
Salary bands, reviews, employee records
Legal & contracts
Agreements, privileged material, NDAs
References indicate the obligations these data classes typically fall under. Applicability depends on your jurisdiction, sector and processing role — Gödel supports enforcement of your policy and is not a determination of compliance.
All six controls,
working on this outcome.
Data Loss Prevention isn't a bolt-on module. Every Gödel enforcement capability contributes to it, under one policy engine.
Session Visibility & Oversight
Every prompt, file read and tool call across agents — live and historical, tied to user and agent identity.
Content Classification
PII, PHI, PCI, secrets, source code and confidential docs identified the instant they enter agent context.
Action & Execution Guardrails
Network calls, file writes, clipboard and shell egress risk-scored and gated before execution.
AI Attack Defense
Indirect prompt injections that try to instruct an agent to exfiltrate are stripped before the agent reads them.
Data Loss Prevention
Redact, hold or block sensitive content at every egress path — model APIs, MCP servers, browser and endpoint.
Audit & Compliance
An immutable trail of every data decision, streamed to your SIEM — SOC 2, ISO 27001, HIPAA, GDPR, EU AI Act.
How Gödel secures data loss prevention
Legacy DLP was built for a perimeter that agents bypass completely. They don't move files — they read files, condense them into reasoning tokens, transform them across tool calls, and transmit new artifacts through model APIs, MCP tools, and external services. Gödel tracks data authority and handling policies through every transformation step directly inside the runtime loop.
Every action is evaluated locally on the endpoint before a byte leaves the process. Classifications travel with derived context so that even if a restricted HR spreadsheet is summarized into a plain Markdown note with an innocuous name, the egress block is enforced deterministically in under 5 ms.
See DLP enforced on your surface.
Put a gate in front of your data.
Local-first enforcement, deployed in minutes. Your agents keep working — your regulated data stays where it belongs.