Saklam – mask data in ChatGPT & Co. by Stefan Böck

What it does

Saklam detects sensitive details the moment you send a message to an AI chat and replaces them with placeholders. The provider sees [PER_a1b2c3d4] instead of "Gül Öztürk". In the reply, placeholders are turned back into plain text on your machine only — highlighted in orange so you can see what was replaced.

Detected are names, organisations, addresses and places, email addresses, phone numbers, IBANs, credit card numbers and case/reference numbers, among others.

Alongside the detection model, a rule-based layer picks up numbers attached to an anchor word ("Our reference", "Staff no."), company names without a legal form, and titles preceding a name. The anchor word itself stays readable: "Aktenzeichen 12 C 345/24" becomes "Aktenzeichen [CAS_…]", so the sentence keeps its meaning.

Where detection runs

Entirely in your browser. On first use Saklam downloads the German detection model and its vocabulary table (about 114 MB in total) once from saklam.com, then works offline via WebAssembly. Your text and the placeholder mapping never leave your device — not even to us. We never see your content.

Alternatively the extension connects to your own Saklam Bridge (Docker, on-premise or in your data centre), keeping the mapping inside your own infrastructure.

Fail-closed by design

If masking is not possible, nothing is sent and nothing is inserted. A blocked message beats a line of plain text at the provider.

Three ways back to plain text

1. Live in the reply as it streams in
2. When copying from the reply
3. From the toolbar menu: mask and unmask the clipboard — which also covers applications outside the browser

Preconfigured services are listed in the settings, where you can add your own web services (a translator, for example); you grant access explicitly per domain.

Trial and licence

After installation you get 7 days of full protection — no account, no email address, no payment details. After that Saklam keeps detecting and counting sensitive details and warns you before sending, but no longer masks. Full protection starts at €99/month (B2B); one key covers the browser extension, the desktop app and the Docker bridge.

Honest limits

• In voice mode (audio conversation) no browser extension can mask — Saklam shows a visible warning there.
• Attachments and images are not masked.
• Restored values live in the page DOM and are technically readable by the site's JavaScript. To rule that out, switch off live restoring and use the copy or clipboard path instead.

Saklam masks who appears in the text, not what it says: the substance stays usable for the model, only the identifiers stay home.

No telemetry, no ad networks, no analytics.