Agentic data loss prevention
The prompt stays.
Only the evidence leaves.
complens.ai is a data-loss-prevention (DLP) application for generative-AI tools. A managed browser extension inspects what employees send to ChatGPT, Claude, and Gemini, classifies it on the device, and reports only a metadata verdict — never the message text — to an administrator console. It is built and operated by Ross IT Solutions, LLC.
complens detects sensitive data in what your people send to ChatGPT, Claude, and Gemini — classified on the device, at the moment of send, even offline. Your console receives the verdict: what kind of data, how risky, on which machine. Never the words themselves.
The message text never leaves this machine. It is hashed, classified, and released or held — right here.
{
"event_type": "dlp.flag",
"detectors": ["aws_access_key"],
"risk": 0.92,
"context_hash": "sha256:9f2c…",
"site": "chatgpt.com",
"device_id": "d-4a1f"
}
No message field exists in this event — or anywhere in our schema. The server drops unknown fields before storage.
How it works
A detection pipeline that runs where the data is
A lightweight browser extension — force-installed by your Chrome Enterprise, Intune, or GPO policy — watches submissions to AI chat tools and classifies them with an engine that lives entirely on the endpoint.
Intercept at submit time
The extension hooks fetch, XHR, and WebSocket sends to AI
chat tools in the page itself — before the request leaves the browser.
Classify on the device
A tiered engine — pattern floor plus a local model — scores the draft in real time. No network round-trip, so it works offline and adds no perceptible latency.
Report metadata only
Flagged sends produce an event: detector, risk score, SHA-256 context hash, site, device. In enforce mode, risky sends can be held for the user to confirm or cancel.
If a send is benign, nothing is sent to us at all. Not a hostname, not a hash, not a counter. Ordinary browsing produces zero telemetry — an event exists only when a detector fires.
Google sign-in
What we ask Google for, and why
On managed devices, the extension can verify who owns a device by asking Google to confirm the signed-in Workspace account. We request the two smallest scopes Google offers, and nothing else.
- openid, email Your work email address and Workspace domain. Used for exactly one thing: attributing a managed device to its owner in your organization's console. The token is verified server-side and discarded — it is never stored.
- nothing else No Gmail, no Drive, no Calendar, no contacts. We never read, transmit, or store the content of anything you type — that is the entire point of the product. See the privacy policy for the full disclosure, including our Google API Services User Data Policy commitment.