For your people · Maskflare User Coaching
Coach People at the Moment They're About to Share Too Much
What the employee types
Draft a reply to Ada Lovelace about her
refund of CHF 2,400 to card
4532 7781 0021 9047
IBAN CH93 0076 2011 6238 5295 7
What the AI provider receives
Draft a reply to mf_mask_170b about her
refund of mf_mask_9c2e to card
mf_mask_41af
IBAN mf_mask_d7e0
574
Built-in detectors for personal data and secrets
47
Country packs, checksum-validated where the format has one
9
AI providers behind one gateway, plus the desktop agent and proxy
Sound familiar?
Why the usual answers fall short
“We block everything sensitive.”
Then people stop using the approved tool, or find a way around it. Blocks need an explanation and an alternative.
“We ran a training last spring.”
Training fades. A short message at the moment of the paste is the reminder that actually lands.
“Our users complain about false positives.”
Give them a way to say so. Their feedback is the fastest way to tune rules.
Most data that ends up in AI tools isn't leaked on purpose. Someone is under time pressure, pastes the whole email thread, and doesn't notice the customer's account number at the bottom. A silent block teaches them nothing, and a block on every prompt teaches them to switch to their phone.
Security teams also need the other side of the story: when someone does need to send something sensitive, why, and how often. Without that, policy is guesswork.
How Maskflare User Coaching works
Each rule has an action: mask, warn, block or monitor. When a warn rule matches, the prompt is held and the Maskflare tray shows a short dialog: what was found (categories like "IBAN" or "health data", never the values), your message and AI policy link, and three choices. Mask and send replaces the sensitive values with tokens and sends the prompt. Send anyway asks for a reason, records it, and lets that one prompt through. Cancel lets the person edit. Admins see every justification in the console, and a "this is wrong" button turns false positives into allowlist suggestions.
- 01
Start in monitor mode
New organizations start with sensitive data counted, not blocked. A week of data shows where the risk really is.
- 02
Choose a response per category
Mask the routine identifiers, warn on health data or contracts, block secrets and card numbers.
- 03
Write your message
Add your AI policy link, a support contact and the approved alternative, in English, German, French, Italian or Albanian.
- 04
Review and tune
Read justifications and feedback in the console, and turn repeated, legitimate cases into rule exceptions through four-eyes approval.
Benefits
Four responses
Mask, warn with justification, block or monitor, set per detector or category and per group.
Explains, never exposes
The dialog names the categories that matched, never the values themselves.
Justifications on record
Who sent what category to which app, the reason given and the choice made, exportable for audits.
Your words, your policy
Custom messages, your AI policy link and an approved alternative, in five languages.
Feedback that tunes rules
"This is wrong" reports roll up per rule and suggest allowlist entries for review.
Works for developers too
API callers get a clear warning response and can acknowledge it with a header; SDK helpers handle it.
Capabilities
When to use each response
Mask for identifiers the AI doesn't need; warn for data people sometimes need to share, like contract terms; block for secrets and card numbers; monitor while you learn.
Monitor-first rollout
Count first, enforce later. A one-click "move to enforce" step proposes the change for four-eyes approval.
Notifications
Desktop notifications for masked and blocked prompts, with a details window that links your policy and support contact.
Reporting
Justifications and feedback in the console, and as events to Slack, Microsoft Teams or your SIEM.
What it does not do
We'd rather you hear it from us.
- Coaching dialogs run on managed devices with the desktop agent; API callers receive the same decision as a response they handle in code.
Explore related capabilities
See how Maskflare applies the same masking rules to related AI and data-protection workflows.
Related guides and explainers
Frequently asked questions
What's the difference between warn and block?
Block stops the prompt. Warn holds it, explains what was found, and lets the person mask and send, send anyway with a reason, or cancel.
Does the warning show the sensitive value?
No. It names the category, such as IBAN or health data, so the message itself never repeats sensitive data.
Where do justifications go?
Into the Maskflare console, visible to owners, admins and security reviewers, and optionally to Slack, Microsoft Teams or your SIEM as events.
Can we write our own message?
Yes. Set your text, AI policy link, support contact and approved alternative once, and they appear in every notification and warning.
How do we avoid annoying people?
Start in monitor mode, warn only on categories that matter, mask the routine ones silently, and use the "this is wrong" feedback to tune rules.
Is a justification an approval?
It's a recorded decision by the user for that one prompt. If the same case comes up often, turn it into a rule exception through four-eyes approval.
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →