Skip to main content

Network-Layer DLP (ICAP)

Govern browser and desktop AI — ChatGPT, Claude, Gemini — at the network layer, through your existing Secure Web Gateway over ICAP. Every AI request gets an inline pass, redact, or block from the same deterministic Guardian, with the same signed receipt as the rest of the platform.

What it is​

Most of your employees' AI usage doesn't go through your application stack — it goes through a browser to a public AI service. Network-Layer DLP plugs Trinitite into the path you already have: your Secure Web Gateway (SWG) speaks ICAP, and Trinitite is the ICAP-responder that inspects every AI request/response in flight. One deterministic brain, every AI path, same signed receipt — no agent on the laptop, no browser extension to maintain.

Why it matters​

  • Closes the biggest blind spot. Browser-AI usage is where most accidental data exfiltration happens; governing it at the network layer requires no endpoint change.
  • Reuses your SWG. No new proxy to deploy — your existing SWG (Zscaler, Netskope, Palo Alto, etc.) already terminates the traffic; Trinitite just answers the ICAP call.
  • Same evidence model. A browser-AI redaction produces the same signed ledger entry as a proxy-path redaction — one audit story across every AI surface.
  • Inline, not after-the-fact. redact strips the sensitive span before it ever reaches the public AI service; block refuses the request entirely.

How it works​

  1. The employee's browser sends a request to a public AI service.
  2. The SWG intercepts it and forwards to Trinitite over ICAP REQMOD/RESPMOD.
  3. The Guardian returns pass, redact (strip the sensitive span), or block.
  4. The SWG forwards the (possibly redacted) request — or refuses it.
  5. Every decision is a signed ledger entry.

Get started​

  • Point your SWG's ICAP service at the Trinitite responder (configuration in the API reference).
  • Configure per-destination policies (which AI services are governed, what is redacted vs blocked).
  • Stream the signed receipts into your SIEM via the Logs API.

→ ICAP API — responder configuration, per-destination policy. → Reversible Masking — the redaction engine. → Evidence & Verification — one receipt model across every surface.

Last updated on