Your staff paste customer data into ChatGPT every day.
Nothing in your stack sees it. E-mail DLP does not. Your CASB does not — the traffic is TLS to a site your policy already allows. ClipGuard sees it, and stops it at the keystroke.
The gap
The clipboard is the most-used and least-monitored exfiltration path you have
Copy from the CRM. Alt-tab. Paste into a chatbot to "just summarise this". No file was attached, no e-mail was sent, no upload crossed a proxy that could read it. The record simply left, and the only trace is in someone else's training-data policy.
Browser extensions catch the web tools and miss the desktop clients. Network DLP catches uploads and misses a paste inside an already-permitted TLS session. Endpoint suites can block the clipboard wholesale, which users route around within a week.
ClipGuard sits exactly where the decision happens: between the keystroke and the application.
14:22:07 clip_captured text 2.1 KB digest 8f3ac1… 14:22:09 paste_decision BLOCK target chatgpt.com (chrome.exe) rules aws_key, internal_url, email severity critical sample AK****************LE reason public_ai: AWS access key 14:22:09 keystroke swallowed — app never received it 14:24:31 paste_decision ALLOW excel.exe no findings
How it works
Four steps, under a tenth of a second
Capture
A clipboard listener picks up text, screenshots and file or video drops the moment they are copied — event-driven on Windows, not a polling loop.
Classify
17 rules with real validation: Luhn on card numbers, Verhoeff on Aadhaar, mod-97 on IBAN. Optional OCR on images. Optional local LLM escalation that never makes a network call.
Resolve destination
Foreground process plus the browser URL via UI Automation. A tab on claude.ai is not the same destination as your internal wiki, even in the same browser.
Decide
A destination × severity matrix returns allow, warn, redact or block — applied before the application ever sees the keystroke.
Detection is deterministic and auditable by default. AI is an opt-in escalation layer, never the gate — so a model outage can never turn into an allow.
Policy
Strict at the exits. Permissive where people work.
Blocking a card number on its way into the application that legitimately processes card numbers is how a DLP tool gets uninstalled in month two. Local apps are audited, not stopped. Enforcement lives at the egress points.
| Destination | Clean | Low | Medium | High | Critical |
|---|---|---|---|---|---|
| Public AI tools | allow | warn | redact | block | block |
| Paste & file-drop sites | warn | warn | block | block | block |
| Sanctioned AI tenant | allow | allow | allow | warn | block |
| Other browser tab | allow | allow | warn | redact | block |
| Local apps (Excel, LOB) | allow | allow | allow | allow | warn |
Redact is the verdict that keeps people working: the secret is swapped out, the rest of the paste goes through, and the user gets on with their day. Images and file drops to public AI are blocked outright — a screenshot cannot be partially redacted.
Built for the people who have to run it
Enterprise plumbing, not a side project
Central policy, signed
The admin server distributes HMAC-signed policy. A tampered document is rejected and raises an alert instead of quietly applying.
Tamper resistant
A service ACL denies stop and delete to standard users. Config is admin-write, user-read. A SYSTEM watchdog restarts the agent per session and audits the gap.
Privacy by construction
Only digests, rule ids and masked samples are stored. Raw clipboard content never touches disk or the network — the document a works council can actually approve.
Observe mode for pilots
Full detection, full audit, zero blocking. Two weeks of observe-mode data is the business case — and the works-council submission.
AI optional, both ways
Run rules-only for a fully deterministic deployment, rules-plus-AI for recall, or AI-first with rules as the fallback. The AI runs locally via Ollama or not at all.
Self-hosted, no tenant
FastAPI and SQLite. Runs on one box behind your reverse proxy. Your audit data never leaves your network, because there is nowhere for it to go.
Where it fits
ClipGuard focuses on clipboard paste enforcement.
| Approach | Covers | ClipGuard capability |
|---|---|---|
| Browser extension guards | Clipboard content and paste destination | ClipGuard inspects clipboard content and paste destinations on the endpoint |
| Network / CASB DLP | Paste policy evaluation before content reaches an app | ClipGuard evaluates the paste before it reaches the destination app |
| Endpoint DLP suites | Destination-aware rules for clipboard pastes | ClipGuard applies destination-aware rules to clipboard pastes |
| Doing nothing | — | ClipGuard records clipboard paste events for review |
| ClipGuard | Clipboard content, destination, and policy on the endpoint | ClipGuard applies policy to supported clipboard paste events |
If you already run a full endpoint DLP suite and it satisfies your auditors, you may not need this. If your answer to "what did staff paste into a chatbot last month" is a shrug, you do.
Honesty
What ClipGuard is not
Every one of these is in the repo's threat model too. A security tool that hides its limits is a security tool you cannot plan around.
- Drag-and-drop and file-picker uploads bypass it entirely. They never touch the clipboard. Pair ClipGuard with a network DLP control for those.
- A local administrator can stop the service. The control targets standard users, not the machine's owner. Anyone claiming otherwise without a kernel driver is selling you something.
- Windows is what ships today. macOS and Linux have a working abstraction layer but degrade to detect-and-scrub rather than true keystroke interception.
- It is not data lineage. ClipGuard proves that content matching a rule moved to a destination. It does not reconstruct where that content originally came from.
- Right-click → Paste is not a keystroke. Only the clipboard-swap on a redact verdict covers that path today.
Deploy
Three commands on an endpoint
# 1 — install # from the source checkout you receive with an engagement cd clipguard; python -m pip install -e ".[agent,server]" # 2 — harden: service SDDL, ACLs, policy key .\scripts\install.ps1 -Endpoint https://clipguard.corp ` -EnrollSecret <enroll secret> # 3 — verify sc.exe sdshow ClipGuardSvc; clipguard status policy source: server policy version: 3 service state: running agent running: True
Then the console
One process, one SQLite file, no tenant to provision. Put it behind your reverse proxy with TLS and SSO; the bearer token is the last line of defence, not the first.
$env:CLIPGUARD_ADMIN_TOKEN = "<long random>" $env:CLIPGUARD_ENROLL_SECRET = "<long random>" python -m clipguard.admin.server --port 8787
Want to see it work before installing anything?
python -m clipguard.agent --once --target chatgpt.com classifies whatever is on
your clipboard right now and prints the verdict it would have applied.
Start in observe mode. Look at the data. Decide then.
Two weeks of audit with nothing blocked will tell you whether you have a problem. If you do not, uninstall it and you have lost an afternoon.