Three tiers. Zero tolerance for data leaks.
A 3-tier DLP pipeline — regex pattern matching, ML entity recognition, and AI-powered contextual validation — inspects every AI request before it reaches any model.
Escalation by confidence, not by guesswork
Each tier handles what the previous one can't. Fast where possible, thorough where needed.
Regex & Checksum
High-speed pattern matching detects structured sensitive data: credit card numbers, Social Security numbers, IBANs, government IDs, and API keys. Where the entity carries a check digit or structural format spec — IBAN (MOD-97), ABA routing, NPI (Luhn), DEA, ITIN, EIN, Canadian SIN, IMEI, SWIFT/BIC, and similar regulated identifiers — a validator confirms the data is structurally real, not just a matching format, eliminating false positives on invoice numbers and arbitrary digit strings.
ML Entity Recognition
AI-powered entity recognition catches names, addresses, medical record numbers, financial account identifiers, and more. Handles unstructured content that regex cannot reach.
AI-Powered Contextual Validator
An AI-powered contextual validation model evaluates each match against surrounding context to confirm or reject it — at under 2ms p99 latency. An account number in an expense report is different from one in a healthcare record. The contextual validator understands the difference — reducing false alarms and ensuring enforcement is proportionate to actual risk.
Escalation Logic
Each tier hands off to the next only when needed. Low-ambiguity patterns resolve at Tier 1 — fast and cheap. High-ambiguity or unstructured content escalates through entity recognition and contextual validation. The pipeline scales compute to content risk, not the other way around.
Sensitivity Controls
Configure detection thresholds per rule, per org, and per compliance framework. Raise sensitivity for financial data, lower it for low-risk internal tools. Platform-level rules for PCI-DSS, HIPAA, and GDPR are non-suppressible — no configuration error creates a compliance gap.
Rule Distribution
Manage detection rules centrally and push them to every connected environment. No per-environment configuration drift, no version mismatches. Policy updates propagate without redeployment — a single change covers your entire fleet.
Enforcement Actions
Block requests that contain regulated data before they reach any model. Redact sensitive fields and allow the rest through. Log-only mode captures detections for analytics without blocking — useful for measuring false positive rates before rolling out enforcement.
Compliance Framework Mapping
12 regulatory frameworks — PCI-DSS, HIPAA, GDPR, GLBA, SOX, CCPA, BSA/AML, SEC Reg FD, FERPA, the EU AI Act, NIST AI RMF, and ISO/IEC 42001 — are pre-mapped to detection rules across all 3 tiers. Activate a framework and Arbitex Gateway applies the correct detectors, enforcement actions, and retention policies automatically.
Input and Output Inspection
Inspect both the prompt sent to the model and the response returned. Catches data exfiltration patterns in model outputs — not just what employees send in, but what AI sends back.
How it works
Requests enter the pipeline
Every prompt sent through Arbitex Gateway enters the DLP pipeline before reaching any model. Tier 1 regex detectors run first — fast pattern matching against structured sensitive data types. Low-confidence matches and unstructured content pass to the next tier.
Entity recognition and context validation escalate as needed
Ambiguous or unstructured content moves to the AI recognition layer, which extracts entities from free text. If confidence remains uncertain, Tier 3 contextual validation evaluates the full context around each match. Only high-confidence detections trigger enforcement — reducing false positives without sacrificing coverage.
Enforcement actions execute instantly
Matched content triggers the configured enforcement action: block the request, redact the sensitive field and allow the rest through, or log the detection. Compliance framework rules fire automatically based on the active bundles for the organization. All decisions are logged to the tamper-evident audit trail.