How we work
The AI provider receives markers. You see your data.
Between you typing and the message leaving the browser, a local engine replaces every sensitive value with a reversible marker. The provider stores the marker; the real value stays on your machine, in an encrypted vault.
The scope, plainly: it covers what you type into ChatGPT and Claude, and attachments on the Team plan. It does not cover voice, scans with no text layer, or people's names unless your organisation configures a gateway. Each of those gaps has its own section below, named and explained.
The journey of one message
Four steps, in this order. The first three happen before the request leaves your browser.
Everything to the left of the dashed line happens on your machine. The only thing that crosses it is the marker.
You type
A national ID, an IBAN, a card number, an email address, a key. You type it in the same box as always: nothing to paste anywhere else, no new place to go, no new flow to learn.
The local engine substitutes
The deterministic engine recognises each value by its shape, validates its checksum, and swaps it for a marker like [BV:IBAN:…]. The real value goes to an encrypted vault that never leaves the browser. Requiring the checksum is what stops an order number from being redacted by mistake.
The provider stores the marker
What travels, and what stays saved in the provider's copy of the conversation, is the marker. That is not a promise: the table further down is what OpenAI's and Anthropic's servers handed back when we asked them.
The answer is rehydrated on your screen
When the model replies quoting the marker, the extension swaps it back for the real value as it paints. You read your data; the provider never held it.
What leaves your browser, by plan
The exact list of fields, not a summary. The deterministic protection is the same on all four plans; what changes is what is sent to BiVelio and what else is protected.
| What leaves | When | Fields it carries | Plans |
|---|---|---|---|
| Nothing to BiVelio | never | no request at all | Free |
| Seat heartbeat | every 12 h |
| Pro and Team |
| Usage counters | every 60 min, in batches |
| Pro and Team |
| Text to the names gateway | on each send of up to 4,000 characters |
| Team with a gateway |
by_type counts 7 entity families. They are counts: not the text, not the values, not who typed them, not which provider they were going to. The timestamp is rounded before it is stored, so the ledger cannot become a diary of one person's day.
The names gateway returns positions, not text, and stores nothing. It is the only route by which your text leaves for a server, and it exists only if your organisation's administrator writes its address into the managed policy.
Checked against the provider
On September 19, 2026 we uploaded four synthetic files from a browser on the Team plan, then read the conversation back as the provider's own API returns it. The proof is not the screen, which rehydrates: it is the copy the server kept.
The files carried the two public example values: 12345678Z · ES91 2100 0418 4502 0005 1332
| File | Provider | In the browser | What the provider stored |
|---|---|---|---|
| DOCX with an IBAN in the text and an ID photo embedded | ChatGPT | green card: attachment redacted |
The model quoted the marker and described the image as a transparent pixel: the ID photo never arrived. |
| PDF with a text layer, carrying the ID number and the IBAN | ChatGPT | green card |
Both markers, verbatim, in the stored answer. |
| Scanned PDF, image only | ChatGPT | red decision card: no page has a text layer; cancelled | nothing arrived The extension does not pretend to redact what it cannot read: it stopped and asked. |
| The same PDF with a text layer | Claude | green card; the thumbnail already shows the markers |
The screen showed the real values, rehydrated. The server only ever had markers. |
“no tengo acceso a los valores originales”
Claude, answering the redacted PDF
Four files, zero leaks. This is one day's check with synthetic files, not a certificate: what it shows is that the Team attachment path does what it says, on both providers.
What it does not do
This section is here because a product that only shows what works cannot be checked. It comes from the known-limits document the extension keeps in order not to over-claim, and it is re-run on every release.
People's names: only with a gateway
The deterministic engine recognises shapes with a checksum. A name has none, so the layer that detects them lives in a names gateway and only comes into play if your organisation's administrator writes its address into the managed policy. Without that, names travel in clear.
Voice and realtime mode: not protected
A spoken turn travels over a separate audio transport the interceptor never sees, and a text redactor cannot redact audio in any case. If the turn carries sensitive data, type it rather than speak it.
Gemini: warning only
Gemini sends over a transport the extension cannot read. Rather than pretend to cover it, it marks the send as unprotected and tells you before it goes.
Scans and images: no OCR
A PDF with no text layer, a photo or a scanned page cannot be read in the browser. The extension does not attach it blindly: it shows a card naming the actual cause and you decide.
Legacy Office formats: out of scope
The legacy Office binaries — .doc, .xls and .ppt — cannot be opened in a browser and are not redacted. The self-hosted gateway handles those.
Custom instructions: not when you save them
When the provider attaches them to a send, they are redacted. When you save them from the settings dialog, they are not: that save travels over its own endpoint the extension does not intercept, and that is the moment you actually typed them.
When a gap closes, it leaves this list in the same change that closes it. A limits document listing limits the product no longer has is as misleading as one hiding limits it does.
Measured
The names gateway's latency, measured on September 12, 2026 inside the plane image on a CCX33 box with eight dedicated vCPUs, running Presidio and GLiNER with the multilingual model off.
| Characters | p95 | With network (+40 ms) | Under the 1,500 ms ceiling? |
|---|---|---|---|
| 400 | 96 ms | 136 ms | yes |
| 1,700 | 414 ms | 454 ms | yes |
| 3,000 | 748 ms | 788 ms | yes |
| 4,000the default | 1,011 ms | 1,051 ms | yes |
| 5,000 | 1,334 ms | 1,374 ms | yes, with little margin |
| 10,000 | 2,605 ms | 2,645 ms | no |
The network column adds the real measured round trip from Andorra to Falkenstein, not an estimate. The ceiling is not a preference: past it the extension discards the answer, the send goes out with the deterministic layer only, and you see the card that says so.
- PDF redacted in the browser
- 92 ms end to end, for a single-page 3 MB PDF
- Text ceiling towards the gateway
- 4,000 characters per send
The gateway's document figures are measured on a different machine with a different implementation, so they are not comparable with the browser one. That is why they are kept apart instead of averaged into one flattering number.
Check it yourself
The extension is free for one person and makes not a single request to BiVelio. If you would rather see the inside, the gateway is self-hosted and the text never leaves your perimeter.