Strip the sensitive data before pasting into AI.
Every day, someone pastes a contract, spreadsheet or log into an assistant without noticing what goes with it. Here, the text is scanned and masked in your own browser, it does not pass through any server, including ours.
- Module
- Sovereignty
- Input
- Some text
- Runs on
- Your browser
- Cost
- Free, no signup
Whatever you paste into an AI has left your company
Pasting text into an assistant means sending it to a third-party server. Most of the time, it is harmless. The problem is the day a customer's CPF, a card number, a repository API key or a log with a production token goes with it, and no one notices because the text was long and the rush was greater.
The tool scans text for twelve types of sensitive data and replaces each one with a format-preserving mask, so the text remains readable. CPF, CNPJ and card numbers go through check-digit validation, without it, any sixteen-digit order number would be marked as a card.
- 01
Choose what should be looked for
Twelve types available. The ones that are almost always a real leak come switched on.
- 02
Paste the text
The scan runs as you type, inside your browser. No request leaves this page.
- 03
Copy the masked version
The format is preserved, a CPF still looks like a CPF, so the model understands the context without receiving the data.
- 01
Is my text sent anywhere?
- No, and that is the entire point of the tool. Detection and masking happen in your browser, in JavaScript. There is no API route behind this page: it would be self-defeating to ask you to send our server the very text you want to protect.
- 02
Which kinds of data are recognised?
- National and company ID numbers, credit cards, emails, phone numbers, postcodes, IP addresses, API keys and JWTs, payment keys, IBANs, passports and dates. IDs and cards are validated by check digit, not just by shape.
- 03
Why validate the check digit?
- To avoid marking what is not there. A sixteen-digit order number looks like a card, an eleven-digit protocol number looks like a CPF. With validation, only what could actually exist gets through, and the text does not end up covered in incorrect masks.
- 04
Is masking enough to comply with privacy law?
- It is a step, not a certificate. Removing direct identifiers cuts the risk sharply, but personal data can live in a name, a job title, an address, or in a combination of details the tool cannot judge. Treat this as basic hygiene before pasting, not as legal advice.
- 05
Does the tool find everything?
- No, and it is important to say so. It recognizes well-defined patterns. A person's name, a written-out address and a secret in an unusual format can get through. Read the result before pasting, the tool reduces risk, it does not replace review.
- 06
What if the data genuinely has to reach the model?
- Then the answer is not masking, it is choosing where the model runs. An open-weights model on your own infrastructure processes the data without it leaving the company. That is the path Rovemark exists to make possible.
And if the data cannot leave at all, even masked?
Some work does not allow masking. For those cases, the way forward is to run the model in-house, which Rovemark's sovereign infrastructure makes possible.