Security and data
Built so personal data never has to leave the computer
We protect your client data without ever collecting it. Checks happen in the browser, the log never holds what anyone wrote, and the records you keep use IDs instead of names and can't be quietly changed.
- UK data regionOn every plan
- Never sees your promptsThe check happens on your computer
- UK GDPR paperwork includedDPIA, records, AI policy, breach register
- Independent UK companySimpleKPI Ltd, London, since 2007
What happens to a prompt
From the moment someone types to the moment they read the answer.
- 01
Someone writes a prompt
Someone on your team types or pastes into an AI tool in their browser, just as they always have.
- 02
Saiela checks it on the computer
The extension looks for personal details right there in the browser. We never see the text.
- 03
The AI tool gets placeholders
Names, numbers and other personal details are swapped for placeholders before the prompt is sent.
- 04
The real details come back on screen
When the answer arrives, the real details go back in, on that person's screen only.
Typed in the browser
Draft a reminder to Jane Smith that her tax return is due on 31 January.
Received by the AI tool
Draft a reminder to [PERSON_1] that her tax return is due on 31 January.
What we keep, and what we never see
The audit log shows what happened without holding the personal data it protected. It never records what anyone wrote.
What we keep
- What kind of personal data was found, such as two names and an email address
- Which AI tool it was heading for, and what Saiela did: swapped, warned or blocked
- When it happened and which team, with the person shown as an ID, not a name
- Your settings, rules, policies and documents
Never sent to us
- The text of anyone's prompts
- The answers the AI tool gives
- The personal details that were swapped for placeholders
The controls behind it
The few records we do keep are safe, fair and in your control. Here's how.
A UK data region
Every Saiela account is stored in a UK data region, Microsoft Azure's UK South, on every plan.
IDs, not names, by default
People appear in the audit log as IDs. Seeing a name needs a reason, and every time someone looks, it's written to the admin access log.
A log you can check
Each log entry is locked to the one before it (technically, a SHA-256 hash chain). One click checks the whole chain in your browser, so you can see nothing's been changed.
Secrets never leave
Passwords, API keys and private keys are blocked on every AI tool, approved or not. There's never a good reason to send them.
Safe when it can't check
If the extension can't check a page, we suggest it pauses sending there until it can. Or you can choose to just warn people and let them carry on.
Sign-in and access
Two-step sign-in on every plan. Team adds single sign-on, verified domains, roles and time-limited read-only access for an auditor or insurer.
Retention you control
On Team, keep records for 12, 24 or 36 months, and place a legal hold to pause deletion during a complaint or claim.
Suppliers you can see
Every company that processes customer data for us is listed on our sub-processors page, and we tell customers before that list changes.
Fair to staff
We record the type of data, never what people wrote, which is far less intrusive. Small teams are grouped together so nobody's singled out, and we draft the notice that tells your team what's recorded.
How to check any AI extension is safe to install
Ask these four questions of any browser extension that touches what your team types, including ours.
- 01
What can it read?
Look at the permissions it asks for when you add it. An extension that can read every website needs a good reason. One that only works on AI tools is a smaller risk.
- 02
Where does the checking happen?
Ask whether what people type is checked on their own computer or sent to the company's servers first. Saiela checks it on the computer, so we never see it.
- 03
What does it store?
Find out what's kept, for how long and where. Saiela keeps a log of what happened, never what anyone wrote, in a UK data region.
- 04
Who's behind it?
Check there's a real company you can look up, with a registered address and a privacy notice. Saiela is made by SimpleKPI Ltd, company 06191007.
More on keeping client data safe when your team uses AI.
Reporting a security issue
Found something that looks like a security problem in Saiela? Tell us privately through our contact form. Please give us a reasonable chance to fix it before sharing it publicly, and don't access or change other people's data while testing. We'll acknowledge your report and keep you updated.
Questions
What IT leads and data protection leads ask.
Can Saiela read what my team types into AI tools?
No. The check happens in the browser on the person's own computer, so we never see their prompts or the answers. The audit log records only what kind of data was found, which tool and what happened.
Where is my data kept?
In a UK data region. Every Saiela account uses it, on every plan.
Can my team switch the protection off?
Only if you let them. On Team you choose what people can do in the extension, for example whether they can pause protection, and they have to give a reason. Running out of Free's monthly prompts never switches warnings or blocking off.
Do we need to tell our team about Saiela?
Yes. The Information Commission (ICO) expects employers to tell staff before monitoring starts, and to explain what's recorded and why. Saiela drafts a staff privacy notice that does this for you.
Protection that never sees your client data.
Try it free for 7 days and check for yourself.