GenAI data loss prevention: tools that keep sensitive data out of LLMs

Where data leaks

OWASP’s LLM02 page lists personal data, financial details, health records, confidential business data, security credentials and legal documents among what can leak, plus proprietary algorithms and training data. The leak can start long before the model answers. The rows and control points below are our analysis, anchored to the OWASP risks.

Where it leaks	How it happens	OWASP risk	Control point (our analysis)
Prompts	People paste customer records, code or credentials into an AI tool, or an app forwards raw user data to a model	LLM02	User, and app
Uploads	Files go to a public chatbot or an assistant with no check on what they contain	LLM02	User
Retrieval (RAG)	A retrieval system returns documents the asker is not allowed to see, or mixes context between users	LLM08	Data
Logs and training data	Prompts and responses are stored with the sensitive values still in them, then reused or exposed later	LLM02	App, and data
Outputs	The model repeats sensitive values from its context, or from its training data, in an answer	LLM02	App

OWASP recommends sanitizing data so user data does not enter the training model, applying least privilege, restricting external data sources and publishing clear retention and deletion policies, and it lists tokenization and redaction with pattern matching among the techniques. For retrieval, its vector and embedding weaknesses page says weak access controls can expose embeddings that hold sensitive information, and context can leak between users of a shared database.

These tools make up the data protection layer, which keeps sensitive data out of prompts, uploads and retrieval in our AI Security Layers model. Finding the AI apps people use in the first place belongs to the discovery and posture layer.

How we picked

We include the tools in our data protection category with enough sourced facts to compare. Netskope is left out because we could not verify its product details on the vendor’s own pages. We compile from public repositories, documentation and vendor pages and do not run the products, so nothing here measures detection accuracy or false positives. Fact chips link each source and check date; the methodology explains the Coverage Score.

The three control points

Where you place the control decides what it can see. The table is our analysis.

Control point	What it sees	Typical form	Tools in this guide
1. The user	What people paste, upload or type into AI tools, including tools you did not approve	Browser extension, endpoint agent or network control	Harmonic Security, WitnessAI, Nightfall AI, Microsoft Purview DSPM for AI
2. The app	Text and files your own code is about to send to a model, and what comes back	Library, container or API called before the model call	Presidio, Limina (Private AI), Protecto, Tonic Textual
3. The data	Where sensitive values are stored and who can read them	Vault, tokenization service or discovery scan	Skyflow, Google Sensitive Data Protection

Control point 1: the user

Employees use AI tools that security never reviewed. These commercial products watch or block that traffic, and each tool page records how the vendor prices it.

Harmonic Security maps the AI tools a workforce actually uses, including AI features embedded in SaaS tools Source, checked October 21, 2026: harmonic.security · 2026-10-21 (opens in a new tab) . It detects sensitive data when an employee tries to share it with an AI tool and intercepts the prompt Source, checked October 21, 2026: harmonic.security · 2026-10-21 (opens in a new tab) , and it sets enforcement by data type, application and role, from silent logging to warnings, coaching and blocking Source, checked October 21, 2026: harmonic.security · 2026-10-21 (opens in a new tab) . Its deployment is listed as browser extension Source, checked October 21, 2026: harmonic.security · 2026-10-21 (opens in a new tab) . Best for security teams that want to see which AI tools employees use and coach or block sensitive data in the browser and on the endpoint.

WitnessAI discovers AI use across employees and agents and catalogs AI applications and MCP servers Source, checked October 21, 2026: witness.ai · 2026-10-21 (opens in a new tab) . It also redacts sensitive data in real time Source, checked October 21, 2026: witness.ai · 2026-10-21 (opens in a new tab) , and it tokenizes sensitive information as part of its guardrails Source, checked October 21, 2026: witness.ai · 2026-10-21 (opens in a new tab) . Its deployment is listed as saas Source, checked October 21, 2026: aws.amazon.com · 2026-10-21 (opens in a new tab) . Best for enterprises that want network-level visibility and policy over employee and agent AI use without browser extensions or endpoint clients.

Nightfall AI targets shadow AI use, stopping corporate data from leaving through personal ChatGPT, unmanaged copilots and browser AI tools Source, checked October 21, 2026: nightfall.ai · 2026-10-21 (opens in a new tab) . It also inspects and blocks prompts, tool calls and responses inside a live AI session using inference hooks Source, checked October 21, 2026: nightfall.ai · 2026-10-21 (opens in a new tab) . Its deployment is listed as saas, api Source, checked October 21, 2026: help.nightfall.ai · 2026-10-21 (opens in a new tab) . Best for security teams that want one commercial DLP platform for employee AI use, MCP servers and SaaS apps.

Microsoft Purview DSPM for AI detects visits to third-party generative AI sites from browser activity and lists the AI apps and agents in use Source, checked October 21, 2026: learn.microsoft.com · 2026-10-21 (opens in a new tab) . It applies DLP policies in Edge, Chrome and Firefox to sensitive information pasted into AI sites Source, checked October 21, 2026: learn.microsoft.com · 2026-10-21 (opens in a new tab) , and it covers uploads as well as pasted text, with block-with-override for elevated risk users Source, checked October 21, 2026: learn.microsoft.com · 2026-10-21 (opens in a new tab) . On naming, Microsoft's docs say this article covers the classic version of DSPM for AI, which is now replaced with a new version named Data Security Posture Management. Source, checked October 21, 2026: learn.microsoft.com · 2026-10-21 (opens in a new tab) Check which version your tenant uses. Best for Microsoft 365 organizations that want AI usage reporting and DLP for Copilot and third-party AI apps in the Purview portal.

Control point 2: the app

When your own code calls a model, you can mask sensitive values before the request leaves your environment. Screening prompts for attacks is a different job, covered in our guide to LLM guardrails.

Presidio identifies PII in text with recognizers based on named entity recognition, regular expressions, rules and checksums Source, checked October 21, 2026: presidio.dataprivacystack.org · 2026-10-21 (opens in a new tab) . It also de-identifies detected PII in text using configurable operators Source, checked October 21, 2026: presidio.dataprivacystack.org · 2026-10-21 (opens in a new tab) , and it redacts PII found inside images using OCR and PII identification Source, checked October 21, 2026: presidio.dataprivacystack.org · 2026-10-21 (opens in a new tab) . On ownership, A Data Privacy Stack post (page marked last updated June 29, 2026) says the Presidio project has a new home under Data Privacy Stack, an independent, community-driven organization, and thanks Microsoft for supporting Presidio earlier. Source, checked October 21, 2026: dataprivacystack.org · 2026-10-21 (opens in a new tab) Best for engineering teams that want a free, self-hosted library to anonymize PII before text reaches a model or a log.

Limina (Private AI) detects PII, PHI and PCI across 50+ entity types in 52 languages Source, checked October 21, 2026: getlimina.ai · 2026-10-21 (opens in a new tab) . It also redacts detected entities by replacing them with markers or masking them with a character Source, checked October 21, 2026: docs.getlimina.ai · 2026-10-21 (opens in a new tab) , and it finds faces, license plates and text in images, then blurs or black-box redacts them Source, checked October 21, 2026: docs.getlimina.ai · 2026-10-21 (opens in a new tab) . Its deployment is listed as self-hosted, on-prem, api Source, checked October 21, 2026: getlimina.ai · 2026-10-21 (opens in a new tab) . On the name, The private-ai.com site redirects to getlimina.ai, and the documentation at docs.private-ai.com is branded Limina. Neither page states a rename date or reason. Source, checked October 21, 2026: docs.private-ai.com · 2026-10-21 (opens in a new tab) Best for teams that need PII, PHI and PCI de-identification of text, files and audio inside their own VPC or on-premises.

Protecto detects PII, PHI and confidential enterprise data across prompts, documents and outputs Source, checked October 21, 2026: protecto.ai · 2026-10-21 (opens in a new tab) . It also offers format-preserving tokenization and reversible masking Source, checked October 21, 2026: protecto.ai · 2026-10-21 (opens in a new tab) , and it auto-detects sensitive entities in free text, masks them under the active policy and unmasks them on request Source, checked October 21, 2026: docs.protecto.ai · 2026-10-21 (opens in a new tab) . Its deployment is listed as saas, on-prem, api Source, checked October 21, 2026: docs.protecto.ai · 2026-10-21 (opens in a new tab) . Best for teams that want an API to tokenize or mask data before it reaches LLMs and RAG pipelines and restore it afterwards.

Tonic Textual detects common sensitive entities out of the box, with support spanning 50+ languages Source, checked October 21, 2026: tonic.ai · 2026-10-21 (opens in a new tab) . It redacts sensitive entities consistently Source, checked October 21, 2026: tonic.ai · 2026-10-21 (opens in a new tab) , and it replaces sensitive entities with synthetic values Source, checked October 21, 2026: tonic.ai · 2026-10-21 (opens in a new tab) . Its deployment is listed as saas, on-prem, api, library Source, checked October 21, 2026: tonic.ai · 2026-10-21 (opens in a new tab) . Best for teams preparing free text, documents or call audio for LLM training, RAG or testing.

Control point 3: the data

This fix keeps raw sensitive values out of every place a model can reach. A vault holds the real values and hands out tokens; a discovery scan shows where sensitive data already sits.

Skyflow stores sensitive data in a data privacy vault that is segregated from your other infrastructure and reachable only through privileged access Source, checked October 21, 2026: docs.skyflow.com · 2026-10-21 (opens in a new tab) . It also replaces sensitive values with vault tokens, including format-preserving tokens Source, checked October 21, 2026: docs.skyflow.com · 2026-10-21 (opens in a new tab) , and it states that it prevents sensitive data from leaking into models, prompts, RAG systems, tools, traces and agent workflows Source, checked October 21, 2026: docs.skyflow.com · 2026-10-21 (opens in a new tab) . Its deployment is listed as saas, api Source, checked October 21, 2026: docs.skyflow.com · 2026-10-21 (opens in a new tab) . Best for teams that want a vault for regulated data and tokenized values to feed LLMs and RAG.

Google Sensitive Data Protection detects sensitive data with built-in infoType detectors or custom infoType detectors you create from dictionaries or regular expressions Source, checked October 21, 2026: docs.cloud.google.com · 2026-10-21 (opens in a new tab) . It de-identifies data by masking, redaction, replacement, bucketing, date shifting and tokenization Source, checked October 21, 2026: docs.cloud.google.com · 2026-10-21 (opens in a new tab) , and it lists inspecting and redacting LLM prompt inputs before storage as a use case Source, checked October 21, 2026: docs.cloud.google.com · 2026-10-21 (opens in a new tab) . On naming, Google's release notes page states that Cloud Data Loss Prevention (Cloud DLP) is now a part of Sensitive Data Protection and that the API name remains the same. Source, checked October 21, 2026: docs.cloud.google.com · 2026-10-21 (opens in a new tab) Best for Google Cloud teams that want an API to de-identify data before it reaches storage, analytics or LLM prompts.

Rollout order

Our suggested order; each step builds on the one before.

1. Decide what counts as sensitive. Start from the data types OWASP lists, then add what your regulators and contracts name.
2. Get visibility first. Run a user-side tool in logging mode to learn which AI tools people use and what they send.
3. Mask at the boundaries you control. Put redaction or tokenization in front of every model call your code makes, and in front of logs.
4. Fix retrieval permissions. Follow OWASP’s LLM08 advice: permission-aware vector stores, partitioned datasets and logs of retrieval activity.
5. Move from coaching to blocking for the riskiest data types, once false positives on your own data are acceptable.
6. Set retention rules for prompts and responses, and review them on a schedule.
7. Test for leaks. Our guide to open-source AI red teaming tools lists tools that probe applications for data leakage.

Limits

These limits are our analysis.

• Detectors miss things. Every tool here detects automatically, so a value in an unusual format can pass. Keep access control behind detection.
• User-side tools see only the traffic they sit on. A browser extension does not see an API call from a script, and a network control does not see an unmanaged device.
• Redaction can break the answer. If the model needs a value to do the task, masking it degrades the result; tokenization with restore after the answer is the usual workaround.

Agent controls that limit what an AI agent can read and send are covered in securing AI agents.