Why this path exists#
The Salus API covers applications where a component you control can call Salus deliberately. Employee AI use is the opposite case: ChatGPT in a browser tab, a desktop AI client, a specialist vertical tool — applications whose request path contains nothing you can modify. Salus Desktop closes exactly that gap, including the shadow-AI surface of consumer AI interfaces on company laptops, and it covers devices wherever they are — on the corporate network, at home, or roaming.
More than text#
What people paste is rarely the whole story — the sensitive part is the contract they attach, the screenshot of a customer record. Salus Desktop applies the same protection to files and images as to typed text: documents are parsed, images pass through OCR and visual detection where configured, and generated files coming back from the model are restored before delivery.
What IT and security teams should expect#
- Deployment — packaged for managed distribution (Intune / Jamf); rollout is a standard managed-software push.
- Scope — capture is limited to the governed AI destination allowlist; TLS handling is customer-controlled and applies to that slice only, with explicit bypass rules where policy allows.
- Identity — attribution comes from your device management and identity provider mappings.
- Conservative defaults — governed destinations that cannot be protected are blocked rather than silently unprotected, a posture most security teams consider a feature.
One contract behind both paths#
Salus Desktop is not a separate protection model — it implements the same protection contract as the Salus API: the same token grammar, the same Context semantics, the same fail-closed defaults, converging on the Salus Engine. Where Salus Sits covers how the two paths divide the work.