Security and data flow
What leaves your device, and what never does.
Tightlip finds sensitive values and swaps them for placeholders on your side. Only the placeholder version goes to the AI. The table that turns placeholders back into real values stays where it was made.
Your device
protect() finds “Maria Delgado” and “4471009233” and swaps them for [PERSON_1] and [BANK_ACCOUNT_1]. The swap table stays here.
AI provider
Receives only the placeholders and answers with them.
Your device
restore() puts the real values back. You read “Maria Delgado”.
Tightlip
Extension, SDK and proxy send us a credit count and your API key. In the web workspace, protected text passes through our server to the model and is not stored or logged.
Surface by surface
| Where | Sent to the AI provider | Sent to Tightlip | Never leaves your side |
|---|---|---|---|
| Free leak check (/try) | Nothing. There is no AI call. | Nothing beyond loading the page. | Your text, the detections and the swap table, all inside the browser tab. |
| Web workspace | The protected text, with placeholders, sent by our server to Anthropic. | The protected text in transit to Anthropic and back. We do not store it or log it. We record the credits used. | Your originals, dropped files (read in your browser), your always-protect list (browser storage) and the swap table (tab memory). |
| Browser extension | The protected text, sent from your browser straight to ChatGPT, Claude, Gemini, Copilot or Perplexity. | Your API key, a credit count and the word “extension”. No text. | Your originals and the swap table (browser session memory, cleared when the browser closes, unless you turn on remembering for 30 days). |
| SDK and proxy | The protected text, sent from your server straight to your AI provider. | Your API key, a credit count and the word “sdk” or “proxy”. No text. | Your originals and the swap table, in your process memory. |
What the model provider does with workspace text
In the web workspace, Tightlip sends the protected text to Anthropic’s Claude API on our commercial account. Anthropic publishes these rules. We quote them rather than paraphrase them.
- Training. Anthropic’s Commercial Terms say: “Anthropic may not train models on Customer Content from Services.” (Commercial Terms, effective 17 June 2025.) Its privacy centre adds that by default it will not use inputs or outputs from its commercial products, including the Anthropic API, to train its models (privacy centre, updated 18 August 2026).
- Retention. Anthropic says: “For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation”, with exceptions for longer-retention features, separate agreements, enforcing its Usage Policy, and legal requirements. Content its systems flag as violating the Usage Policy may be kept for up to 2 years (privacy centre, updated 1 July 2026).
- What that covers. Only the placeholder text you send in the workspace. With the extension, SDK and proxy, your own AI provider’s terms apply, because your text goes to them directly.
What the Chrome extension can access
Security researchers have found browser extensions copying people’s AI chats (reported by The Hacker News and Dark Reading). An extension like that needs two things: access to the chat page, and a way to send what it reads somewhere.
Tightlip needs the first, because it has to read your message to protect it. It does not have the second. Its only network calls go to /api/v1/meter and /api/v1/balance, and they carry a credit count. Here is every permission it asks for.
| Permission | Why Tightlip needs it | What it allows, and nothing more |
|---|---|---|
| storage | Keeps your settings, your always-protect list, your API key, the weekly count of protected items and each chat’s swap table. | Only Tightlip’s own storage on your computer. It cannot read any website’s data or another extension’s data. |
| declarativeNetRequestWithHostAccess | Runs one fixed rule that blocks Perplexity’s as-you-type suggestion service, which sends your unfinished message on every keystroke, before you press send. | Blocking that one connection while Tightlip protects Perplexity. It cannot read, record or change any request or page. The rule ships inside the package. |
| Runs on chatgpt.com, chat.openai.com, claude.ai, gemini.google.com, copilot.microsoft.com, copilot.com and perplexity.ai | Reads the message box when you press send, swaps sensitive details for placeholders, and shows the real values again in replies. | No other website. The script on those pages contains no network code at all, and the build fails if any appears. |
| Access to tightlipai.com | Two requests: /api/v1/meter records a credit count after a protected send, and /api/v1/balance shows your remaining credits. | Only those two addresses, carrying your API key and a number. Never text, detections or the swap table. |
| Access to suggest.perplexity.ai and perplexity.ai | The browser requires it for the blocking rule above to apply on Perplexity. | Blocking the type-ahead connection. Nothing is read or changed. |
Not requested
The extension asks for no access to your tabs, history, bookmarks, downloads, cookies or clipboard, or to all websites. Other sites and extensions cannot message it. It runs only the code in the package and sends no analytics or error reports.
How that is checked
A build step scans the packaged extension and fails if any network call appears other than the two credit addresses. A browser test runs every supported site and fails on any other request.
Replies stay private on the page
Real values in replies are drawn inside closed shadow DOM, which the chat site’s own scripts cannot read. The site keeps seeing the placeholders.
Install it yourself, read it first
The extension ships as a zip you load yourself, so you can read every file before you install it. See the download page.
What Tightlip cannot control
- Tightlip changes your message at the moment you press send. While you type, the text sits in the chat site’s own message box. In our checks, ChatGPT and Gemini sent nothing typed before the send. Perplexity sent every keystroke to its suggestion service, which is why the extension blocks that connection.
- Other browser extensions, such as grammar checkers, can read what you type into any page. Tightlip’s own text boxes ask them not to.
- Anything detection misses goes to the AI as written. Check the protected version before you send.
Inside the web workspace
- Files you drop in (.txt, .pdf, .docx) are read by your browser. They are never uploaded.
- The swap table lives in the tab’s memory. Reload or close the tab and it is gone.
- Your always-protect list is kept in your browser’s local storage on that computer.
- The chat request carries protected messages only. Our server adds a short system instruction, forwards the request to Anthropic, streams the reply back and records the credits used. It does not write the messages or the reply to a database or to logs.
- Please do not put patient health information into the workspace. Harbor Software LLC is not a business associate and does not sign business associate agreements.
Sub-processors
| Company | What for | What they hold |
|---|---|---|
| Vercel | Hosts the website and the API. | Standard request logs: IP address, address requested, browser type. No request bodies. |
| Stripe | Payments and the credits ledger. | Your email, payment details and your credit balance history. |
| Clerk | Accounts and sign-in. | Your email, name and sign-in sessions. |
| Anthropic | AI model for the web workspace only. | Protected text you send in the workspace, and the model’s reply. |
| Slack | Internal notices to the Tightlip team. | Sign-up email addresses, top-up amounts and messages sent through our contact form. Never prompt text. |
Limits and honest answers
Detection is automatic, so it can miss things
Numbers with check digits are reliable. Names and free-text details are harder. Read the protected text before you send, and add names that matter to your always-protect list.
No certifications are claimed
Tightlip is new. We describe what the software does and where data goes, and nothing more. Single sign-on, an admin console, audit export and an independent security audit are on the roadmap.
Fail closed
If the check itself fails, Tightlip stops the send. If you are out of credits, the extension and SDK stop the send and say why. They never send the unprotected text in its place.
Report a problem
Found a leak, a bug or a weakness? Email hello@tightlipai.com with “Security” in the subject. We read every one.
Questions from your security team?
Send them here and we will answer in writing. The message goes straight to the people who build Tightlip.