Section: semantic DLP for the LLM era · Connor Wellbourne-Wood

Your sales team is pasting customer lists into ChatGPT to write follow-up emails. Your developers are leaking API keys into debug prompts. Your healthcare staff are sending PII to whatever model the browser autofilled.

None of it is malicious. None of it is visible. And blocking the model is not a strategy.

The Section operator console — an overview dashboard showing requests, transformed and blocked prompts, latency and top detectors. — The operator console — every prompt, decision and reveal in one place.

This is the shadow AI problem, and traditional DLP as we knew it does not handle it. Regex on outbound HTTP cannot read intent. CASB cannot detokenise a response. Your SIEM has no idea a prompt ever existed.

Today I am open-sourcing Section, a proof of concept for a semantic Data Loss Prevention tool in the LLM era. DLP for modern workflows.

It sits between your people, your apps, and any model provider (OpenAI, Azure OpenAI, Anthropic, Ollama, self-hosted, etc.), and gives you the visibility and control you already have for every other class of traffic.

How it works

Prompts route through the Section gateway instead of going direct to the model.
Every prompt is scanned for 40+ classes of sensitive data: PII, PHI, financials, credentials, source code, infra secrets, internal identifiers.
Your policy-as-code decides what happens: allow, reversibly tokenise, format- preserving encrypt, redact, or block.
The clean payload goes to the model. The response comes back, gets re-scanned, and original values are restored only for authorised principals.
Every decision is written to a hash-chained, tamper-evident audit trail your GRC team can actually query.

For CISOs, Section offers a single enforcement point for every LLM your company touches, sanctioned or not.

For GRC and compliance, cryptographic evidence for every prompt, every decision, every reveal. Map it to SOC 2, HIPAA, GDPR, EU AI Act and stop guessing.

For builders, the § 0 · BEGIN wizard inside the operator console walks you through six steps in under five minutes. Pick a path, bring it up, wire a client, watch decisions land.

If you are a CISO trying to get out of the “ban or pray” trap, a GRC leader who needs real evidence instead of policy PDFs, or a builder who wants to ship AI features without becoming the next breach headline — I would love your eyes on this.

Star it, break it, question it. It’s now available.