Protect API keys & secrets before they reach AI prompts
One tired Ctrl+V while debugging a .env file, webhook payload, or customer ticket can expose live credentials to an external prompt history. SafeRelay transforms sensitive values locally into readable placeholders before inserting context into your armed destinations.
Unprotected Source Context
Contains a live API key, a customer email address, and a project codename added via Ctrl+Alt+G.
Pattern + Custom Term Match
Structural meaning is preserved so AI models understand the variable types without seeing raw values.
Inserted Into Armed Target
Inserted into your armed prompt box or editor. Review the protected output before pressing Send.
Add Custom Protected Terms Instantly with Ctrl+Alt+G
Built-in regex and structural detectors catch common credential formats, but internal project codenames (like FALCON), proprietary client names, or internal hostnames are unique to your organization.
With SafeRelay Desktop:
-
Highlight any word or phrase in your current window and press
Ctrl+Alt+G(Protect Selection). - SafeRelay registers that selection as a Custom Protected Term.
-
Subsequent relays replace matches with
[CUSTOM_TERM_1],[CUSTOM_TERM_2], etc., alongside standard DLP detectors.
Supported Local Detector Categories
SafeRelay runs local pattern detectors on your machine for established credential, network, and PII formats:
-
API Keys & Cloud Credentials: OpenAI keys (
[OPENAI_KEY_1]), AWS access keys ([AWS_KEY_1]), Bearer tokens, and PEM private key blocks. -
Contact & Infrastructure Identifiers: Email addresses (
[EMAIL_1]) and private/internal IPv4 addresses ([INTERNAL_IP_1]). -
Financial, Identity & Custom Terms: Credit card numbers, SSNs, IBANs, Bitcoin/Ethereum addresses, and user-defined Custom Protected Terms (
[CUSTOM_TERM_1]).
How Placeholder Redaction Differs from Session Vault
SafeRelay keeps ordinary DLP placeholder generation conceptually separate from Session Vault:
-
Local DLP Placeholder Transformation: When you relay text, detected sensitive values are transformed into placeholders (such as
[OPENAI_KEY_1]or[EMAIL_1]) in the outgoing protected text. - Session Vault (Separate In-Memory Feature): Session Vault is a separate, session-only capability that holds sensitive mappings in memory during your active session and clears them automatically when SafeRelay exits. Not every detected or redacted value is persisted to disk.
Operational Guardrails & Honest Limitations
SafeRelay is engineered as a practical local safety layer, not a reason to skip human review:
Review Protected Output Before Sending
Pattern detection is not infallible. Unusual token formats, custom internal secrets not yet added as Custom Protected Terms, or context-specific logic may not match a built-in pattern. Because SafeRelay inserts text without pressing Enter, always review the prompt before sending. If you use Safe OCR on screenshots, remember that OCR is best-effort and requires visual verification.