Data types and on-device detection

Data-typed policies act on what is actually in a prompt — not just on the fact that someone used an AI tool. That requires detection, and Shield's detection runs where the data is: on the device.

The data types

When building a policy you select the data types it covers:

• PII (personal data) — email addresses, phone numbers, national and tax IDs. (IBAN and card numbers are covered by Financial data.)
• Financial data — IBAN, credit and debit card numbers, BIC/SWIFT, routing numbers.
• Source code — code blocks, function and class definitions, script syntax.
• Secrets / credentials — API keys, access tokens, JWTs, private keys.
• PHI (health data) and Contracts — on the roadmap; shown in the picker as coming soon.

An All data types option exists for broad policies.

On-device detection

Detection runs locally in the browser, via Shield Web. The content of a prompt or paste is never sent to a server to classify it — only the resulting category labels (for example pii, secrets) travel with the audit event, never the values themselves. That is what makes data-typed enforcement compatible with the consent guarantees.

Admins control this under Settings → Governance → On-device content detection (recommended, and on by default). With detection off, data-typed policies match all content — which over-warns — so leave it on unless you have a specific reason not to.

How it plays with enforcement

Combine data types with enforcement modes for precise rules: transform PII before it reaches a chat window, block secrets outright, warn on source code. Your organization's starter policies are exactly such combinations.