FROM THE APPS YOUR TEAMS ALREADY USE, WITHOUT CHANGING THEM
1
Capture on the device. Salus Desktop watches an allowlist of governed AI destinations — browser AI like ChatGPT, Claude, and Gemini, plus desktop AI applications — and handles TLS for that governed slice only, under a certificate configuration you control.
2
Detect and review. Sensitive values in the prompt, the attached document, or the screenshot are detected before egress. Where policy requires it, the review window shows the user exactly what was caught, correctable before anything is sent.
3
Tokenize and forward. Detected values cross the boundary as tokens — [PHONE_8f3a1d], not the subscriber's number. The provider serves the request exactly as it would any other.
4
Restored stream back. The response is restored inline on your side of the boundary — the user sees a live answer with real values, in the same browser tab or app they started in.

Why this path exists#

The Salus API covers applications where a component you control can call Salus deliberately. Employee AI use is the opposite case: ChatGPT in a browser tab, a desktop AI client, a specialist vertical tool — applications whose request path contains nothing you can modify. Salus Desktop closes exactly that gap, including the shadow-AI surface of consumer AI interfaces on company laptops, and it covers devices wherever they are — on the corporate network, at home, or roaming.

More than text#

What people paste is rarely the whole story — the sensitive part is the contract they attach, the screenshot of a customer record. Salus Desktop applies the same protection to files and images as to typed text: documents are parsed, images pass through OCR and visual detection where configured, and generated files coming back from the model are restored before delivery.

What IT and security teams should expect#

  • Deployment — packaged for managed distribution (Intune / Jamf); rollout is a standard managed-software push.
  • Scope — capture is limited to the governed AI destination allowlist; TLS handling is customer-controlled and applies to that slice only, with explicit bypass rules where policy allows.
  • Identity — attribution comes from your device management and identity provider mappings.
  • Conservative defaults — governed destinations that cannot be protected are blocked rather than silently unprotected, a posture most security teams consider a feature.

One contract behind both paths#

Salus Desktop is not a separate protection model — it implements the same protection contract as the Salus API: the same token grammar, the same Context semantics, the same fail-closed defaults, converging on the Salus Engine. Where Salus Sits covers how the two paths divide the work.