How we work
The AI provider receives markers. You see your data.
Between you typing and the message leaving the browser, a local engine replaces every sensitive value with a reversible marker. The provider stores the marker; the real value stays on your machine, in an encrypted vault.
The scope, plainly: it covers what you type into ChatGPT and Claude, and attachments on the Team plan. It does not cover voice, scans with no text layer, or people's names unless your organisation is on the names route — included with the Team plan, or set by an administrator in the central managed policy on any paid plan. Each of those gaps has its own section below, named and explained.
The journey of one message
Four steps, in this order. The first three happen before the request leaves your browser.
Everything to the left of the dashed line happens on your machine. The only thing that crosses it is the marker.
You type
A national ID, an IBAN, a card number, an email address, a key. You type it in the same box as always: nothing to paste anywhere else, no new place to go, no new flow to learn.
The local engine substitutes
The deterministic engine recognises each value by its shape, validates its checksum, and swaps it for a marker like [BV:IBAN:…]. The real value goes to an encrypted vault that never leaves the browser. Requiring the checksum is what stops an order number from being redacted by mistake.
The provider stores the marker
What travels, and what stays saved in the provider's copy of the conversation, is the marker. That is not a promise: the table further down is what OpenAI's and Anthropic's servers handed back when we asked them.
The answer is rehydrated on your screen
When the model replies quoting the marker, the extension swaps it back for the real value as it paints. You read your data; the provider never held it.
What leaves your browser, by plan
The exact list of fields, not a summary. The deterministic protection is the same on all four plans; what changes is what is sent to BiVelio and what else is protected.
| What leaves | When | Fields it carries | Plans |
|---|---|---|---|
| Nothing to BiVelio | never — except one visible tab at privacy.bivelio.com/activar, opened once on a fresh install with no licence | no request of the extension’s own; nothing from it in that tab | Free |
| Seat heartbeat | every 12 h |
| Pro and Team |
| Usage counters | every 60 min, in batches |
| Pro and Team |
| Text to the names gateway | on each send, up to 20,000 characters on Pro and 50,000 on Team, in pieces of up to 4,000 |
| Team with a gateway |
by_type counts 7 entity families. They are counts: not the text, not the values, not who typed them, not which provider they were going to. The timestamp is rounded before it is stored, so the ledger cannot become a diary of one person's day.
The names gateway returns positions, not text, and stores nothing. It is the only route by which your text leaves for a server, and there are two ways onto it: the Team plan carries its address signed inside your organisation's licence, and on any paid plan an administrator can set one in the central managed policy, which takes precedence over the licence's.
Checked against the provider
On September 19, 2026 we uploaded four synthetic files from a browser on the Team plan, then read the conversation back as the provider's own API returns it. The proof is not the screen, which rehydrates: it is the copy the server kept.
The files carried the two public example values: 12345678Z · ES91 2100 0418 4502 0005 1332
| File | Provider | In the browser | What the provider stored |
|---|---|---|---|
| DOCX with an IBAN in the text and an ID photo embedded | ChatGPT | green card: attachment redacted |
The model quoted the marker and described the image as a transparent pixel: the ID photo never arrived. |
| PDF with a text layer, carrying the ID number and the IBAN | ChatGPT | green card |
Both markers, verbatim, in the stored answer. |
| Scanned PDF, image only | ChatGPT | red decision card: no page has a text layer; cancelled | nothing arrived The extension does not pretend to redact what it cannot read: it stopped and asked. |
| The same PDF with a text layer | Claude | green card; the thumbnail already shows the markers |
The screen showed the real values, rehydrated. The server only ever had markers. |
“no tengo acceso a los valores originales”
Claude, answering the redacted PDF
Four files, zero leaks. This is one day's check with synthetic files, not a certificate: what it shows is that the Team attachment path does what it says, on both providers.
What it does not do
This section is here because a product that only shows what works cannot be checked. It comes from the known-limits document the extension keeps in order not to over-claim, and it is re-run on every release.
People's names: only with a gateway
The deterministic engine recognises shapes with a checksum. A name has none, so the layer that detects them lives in a names gateway, and it comes into play on two roads: on the Team plan its address travels signed inside your organisation's licence, and on any paid plan an administrator can write one into the central managed policy, which takes precedence over the licence's. With no gateway from either source, names travel in clear.
Postal addresses: nine languages, read by their street grammar
The local engine recognises an address by its shape — street type, name, number, floor and door, postcode and town — in Spanish, Catalan, French, Portuguese, German, Italian, Dutch, Polish and English, with no network and on every plan. Outside those nine languages it does not: a Swedish or Czech street is seen only by the names gateway, on the same terms as a person's name. And inside them one case is left out on purpose: a street written in prose with nothing confirming it is an address — no postcode, no floor, no number marker, no word such as “lives at”. That shape is also an ordinary sentence — “the Wall Street banks”, “on the main street,” followed by how many neighbours signed — so redacting it would break the writer's own sentence.
Voice and realtime mode: not protected
A spoken turn travels over a separate audio transport the interceptor never sees, and a text redactor cannot redact audio in any case. If the turn carries sensitive data, type it rather than speak it.
Scans and images: no OCR
A PDF with no text layer, a photo or a scanned page cannot be read in the browser. The extension does not attach it blindly: it shows a card naming the actual cause and you decide.
Legacy Office formats: out of scope
The legacy Office binaries — .doc, .xls and .ppt — cannot be opened in a browser and are not redacted. The self-hosted gateway handles those.
Custom instructions: not when you save them
When the provider attaches them to a send, they are redacted. When you save them from the settings dialog, they are not: that save travels over its own endpoint the extension does not intercept, and that is the moment you actually typed them.
When a gap closes, it leaves this list in the same change that closes it. A limits document listing limits the product no longer has is as misleading as one hiding limits it does.
Measured
The names gateway's latency, measured on September 12, 2026 inside the plane image on a CCX33 box with eight dedicated vCPUs, running Presidio and GLiNER with the multilingual model off.
| Characters | p95 | With network (+40 ms) | Under the 1,500 ms ceiling? |
|---|---|---|---|
| 400 | 96 ms | 136 ms | yes |
| 1,700 | 414 ms | 454 ms | yes |
| 3,000 | 748 ms | 788 ms | yes |
| 4,000the default | 1,011 ms | 1,051 ms | yes |
| 5,000 | 1,334 ms | 1,374 ms | yes, with little margin |
| 10,000 | 2,605 ms | 2,645 ms | no |
The network column adds the real measured round trip from Andorra to Falkenstein, not an estimate. The ceiling is not a preference: past it the extension discards the answer, the send goes out with the deterministic layer only, and you see the card that says so. Each row is one request: a message longer than 4,000 characters is split into pieces of up to 4,000, checked in parallel, and the time a whole long message takes has not been measured, so none is published here.
- PDF redacted in the browser
- 92 ms end to end, for a single-page 3 MB PDF
- Text ceiling towards the gateway
- 4,000 characters per request; a message of up to 20,000 characters on Pro or 50,000 on Team goes as several requests in parallel
The gateway's document figures are measured on a different machine with a different implementation, so they are not comparable with the browser one. That is why they are kept apart instead of averaged into one flattering number.
Every figure on this page, and the ones that do not fit on it — the adversarial corpus, the document times, the three name stacks, the published package — is collected with its date and its machine on Measured.
Check it yourself
The extension is free for one person and makes not a single request to BiVelio. If you would rather see the inside, the gateway is self-hosted and the text never leaves your perimeter.