Stanch on Your Work Computer

1. Who is responsible

Your organisation chose to use Stanch, decides which of its features are on, sets the rules and decides who in the organisation can see the results. Under data-protection law it is the controller of this data. Stanch provides the software and the service and processes the data only on your organisation’s instructions.

Stanch is designed for computers that your organisation owns or manages for work.

2. When Stanch looks at something

Stanch acts when information is about to leave your computer through a route your organisation has chosen to cover. Depending on its settings, that can include:

• text and files you send to AI assistants such as ChatGPT, Claude, Gemini or Copilot, and to other websites, in Chrome or Microsoft Edge;
• files you upload in the browser, and messages and attachments you send in web email and in messaging apps opened in the browser;
• requests that AI apps and some work apps on your computer send over the internet, when your organisation routes them through Stanch;
• what you copy and paste, for example from a company app into another app;
• documents you print;
• USB drives and phones connected for file transfer, and files saved into cloud sync folders such as OneDrive or Dropbox;
• audio you upload or send, which can be turned into text on your computer so that it can be checked.

Stanch looks for things like card and bank numbers, national ID numbers, passwords and keys, health record numbers, and the documents and values your organisation has registered as confidential. It uses patterns, checks such as the check digits of card numbers, and fingerprints of what your organisation has registered, and can also use text recognition for images; all of them run on your computer.

3. What you will see

When a rule applies, Stanch can let the action go ahead and record it, warn you and let you decide whether to continue, remove the sensitive part, or stop the action. When it warns or stops something, it tells you on screen, names the rule, and shows what kind of information it found without showing the information itself. Your organisation can also block some AI websites altogether; Stanch then shows a notice in place of the page. Stanch shows an icon on your computer, and your organisation also installs a Stanch extension in your browser.

4. What your organisation’s Stanch console receives

When something matches a rule, or a rule asks for it to be recorded, the console receives a record of the event:

• when it happened, the route (for example an AI chat, a file upload or a print job) and the application or website, as its name and a general form of its address with identifiers removed;
• what Stanch did (allowed, warned, removed the sensitive part or stopped it) and, after a warning, whether you chose to continue;
• which rule applied and what kind of information it found, with a masked or one-way coded version of the value, never the value itself;
• your computer’s name and the username you signed in with, and the program involved;
• for files, the file name and size; for printing, the printer, the document title and the number of pages; for USB devices, the make, model and a coded version of the serial number.

When you use AI tools that Stanch covers, it records each request, even when it finds nothing: your username, the app, which AI service and model were used and how much data went each way (sizes, not the words).

To keep protection working, your computer reports its name, operating system, the Stanch version, whether protection is working, and which AI apps and tools it finds on the computer, including the names (never the values) of keys configured for them. It checks in about once a minute.

Apart from those records of AI use, when Stanch finds nothing sensitive and takes no action, it generally keeps no record, unless your organisation has asked it to log that kind of event (for example, connecting a USB drive).

5. When the content itself is kept

By default, Stanch does not keep the text or files you send. Your organisation can turn on evidence collection for investigations. Then, for the incidents and routes it chooses, Stanch keeps a copy of the content behind the incident (for example the text you tried to send, or a file or the text taken from it) in a separate encrypted store, for the period your organisation sets. Only people your organisation specifically authorises can open it, each for a limited time; they must confirm their identity again and give a reason, and every access is recorded.

6. What Stanch does not do

• It does not log keystrokes.
• It does not record your screen or let anyone watch it. If your organisation lists certain apps as protected, Stanch can note that a screenshot was taken while one of them was open, and can remove that screenshot, but it does not look at what the image shows.
• It does not use your camera or listen through your microphone, and it does not cover calls or meetings.
• It does not track your location.
• It does not keep a history of the websites you browse. It looks only at what you send, upload or paste on the sites and routes your organisation covers, and records only the websites involved in those events and attempts to open AI websites your organisation has blocked.
• It does not read your messages inside desktop apps such as WhatsApp or Signal, or the memory of other programs.
• It does not scan your whole disk. It reads files only when you send, copy, print or save them through a route your organisation covers.

Stanch is made to protect information, not to measure how people work. It can compare how often sensitive information appears in a person’s activity with their usual level, to spot unusual spikes, and it keeps no productivity scores.

7. Who can see the records

The people your organisation gives access to its Stanch console, usually its security, IT or compliance team, according to the roles it assigns. Stanch staff cannot see your organisation’s records in the service. A few named Stanch administrators who run its servers can technically reach the stored data; that access is used only to keep the service running and secure, and is logged. If your organisation asks for help, it can approve a time-limited, read-only support session, which is recorded.

Stanch stores your organisation’s data in data centres in the European Union. If your organisation turns on Stanch Agent, the AI assistant in the console, the questions put to it are processed by Anthropic in the United States (see the subprocessors list).

8. How long records are kept

Your organisation sets how long records are kept. For organisations that start using Stanch now, the default is 30 days for event records; the console’s audit log is kept for the period your organisation sets. Evidence, where collected, is kept for the period your organisation sets for it.

9. Your rights and who to ask

Depending on where you work, you may have the right to know what data is held about you, to receive a copy, and to have it corrected or deleted. Your organisation’s privacy notice explains how monitoring at work is handled where you are.

Because your organisation is responsible for this data, please send questions and requests to it first: its IT or security team, HR, or its data protection contact. If you contact Stanch at contact@stanch.ai, we will pass your request to your organisation and help it answer.

Our Privacy Policy explains how Stanch itself handles personal data.