Security and the law: what the program does and how it works.

GDPR · Art. 4(5)

'pseudonymisation' means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

The extension: the chat receives replacements for the detected data, and the "additional information", meaning the replacement map, is kept separately, in the program on the user's computer, separately for each chat tab; its backup copy is encrypted with a key from the system keychain.

GDPR · Art. 5(1)(c)

adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation');

The extension: the model provider does not need a real national ID number (PESEL) or surname to write a letter. It gets the structure and content, with the detected identifiers replaced.

GDPR · Art. 5(1)(f)

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality').

The extension: masking happens before sending, automatically, in files too, so it limits the impact of accidentally pasting client data into a chat.

GDPR · Art. 25(1)

Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.

The extension: pseudonymization built into the means of processing, not into the terms of use. The measure is deployed once, by policy, and works every time it is used.

GDPR · Art. 32(1)(a)

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (a) the pseudonymisation and encryption of personal data;

The extension: both: pseudonymization of text and files, and encryption of the replacement map copy (XChaCha20-Poly1305), which disappears when the tab is closed.

GDPR · Art. 44

Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation.

The extension: detected personal data is replaced before the message reaches the model provider, which narrows the data that the question of transfers outside the EEA applies to. Whether that is enough is for the data controller to assess.

NIS 2 · Art. 21(1)

Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services.

The extension: a proportionate technical measure that reduces the risk of data and secrets leaking through public AI chats.

NIS 2 · Art. 21(2)(d), (g), (h), (i)

(d) supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers; […] (g) basic cyber hygiene practices and cybersecurity training; (h) policies and procedures regarding the use of cryptography and, where appropriate, encryption; (i) human resources security, access control policies and asset management;

The extension: the AI provider is a service provider in the supply chain; the technical profile replaces detected passwords, keys and infrastructure names before sending, and the encryption of the replacement map and the program's lack of network connections can be written straight into the cryptography and cyber hygiene policies.