Information barriers for the AI era
Between your AI and the world, nothing goes out without passing through the chamber.
Your operation serves counterparties, deal teams, or advisors who cannot know the same things, and your AI now drafts for all of them at scale. Signato checks each AI draft and agent action, person against subject, and blocks the wrong send before it happens. It runs entirely on your machine: your data never leaves it.
100% local. No account, no cloud upload, nothing to configure before you see your first block.
- Deterministic, not a prompt instruction
- Local-first, your data never leaves the machine
- Testable: every wall ships with test scenarios
Built for operations where AI writes at scale and walls are a duty: AI-native teams running agents, law firms with ethical walls, private equity and M&A with segregated deal teams, wealth management and consultancies with conflict walls, and multi-advisor family offices.
The problem
The mistake that has no way back.
One email, one draft, one AI-assisted reply reaching the wrong person breaks years of segregation: the counterparty on one side of the wall learns what only the other side was meant to know. With AI assistants drafting at scale, that error stops being an occasional human slip and becomes structural risk, repeatable every time someone asks the assistant to write.
In the ConfAIde benchmark (ICLR 2024), even the best-performing frontier model leaked contextually confidential information in 39% of measured scenarios, and others did worse; multi-agent systems in multi-turn interaction push it higher still, up to 45% in a 2026 follow-up study.
ConfAIde benchmark, ICLR 2024, extended by a 2026 multi-agent study. Instructing the model in the prompt does not fix this: the leak happens inside the model’s own reasoning, not in a rule it forgot to follow.
That is the argument for why the defense cannot live inside the prompt. A system instruction is a request the model can misweigh against everything else it is reasoning about in that turn. The defense has to be a layer the model does not control: external to it, deterministic, and checked on every outbound message that passes through it, not just the ones someone remembers to double-check.
How it works
Three steps, from your first matrix to a defensible record.
Confidentiality treated as testable, auditable code, the same discipline regulated markets already apply to trading walls, brought to any operation that has to keep people apart on paper.
Build the matrix in minutes
A visual assistant interviews you in plain business language: who receives information, which subjects have an owner, who must never learn what. Segment templates and contact import get you started without writing a line of configuration by hand.
The chamber checks every send
Person and subject are cross-checked in the same event: the forbidden pair is blocked, or flagged, you choose the enforcement mode. Ships today as a pre-send hook for AI agents (Claude Code adapter included) and as an on-demand check for any text or exported mailbox.
Prove it, test it, attest it
Test scenarios are generated automatically, every change can be simulated before it takes effect, and the matrix carries an audit trail and a periodic attestation, so confidentiality is a record you can show, not a promise you make.
Where the chamber sits today, plainly
- AI agents, turnkey. A ready adapter registers as a pre-send hook in Claude Code: every agent action passes through the chamber automatically, from the first run.
- Any text or file, on demand.
signato checkverifies a draft before it goes out;signato scanaudits an exported mailbox and reports exposure, aggregate counts only, never the content. - Email gateways and other hosts: not self-service yet. Plugging the chamber into Outlook, Gmail, or a document pipeline is implementation work we do with you on assisted plans, or a custom adapter on the same open contract. We say this here so you do not discover it after installing.
Proof, not persuasion
Run it on your own history, before you trust a word of this.
Point Signato at a local export of your own mailbox and it replays every message through the same chamber, then tells you which person-and-subject pairs would have been walled. Nothing is uploaded: the scan runs entirely on your machine, and it reports the exposure by category and count, never by reprinting the protected content itself.
It turns “trust the model” into “look at your own data”: a retroactive audit of what would have crossed a wall, on data that never leaves your infrastructure. The same run writes a self-contained report a risk committee can open offline, and the same engine then checks every new send going forward.
Pricing
Public pricing, no surprises.
Annual license per operation, not per seat. Cancel the monthly plan anytime. Annual plans carry a 90-day, full-refund guarantee.
Essential
- The full product, nothing held back
- Visual assistant and segment templates
- Automated test scenarios
- Attestation and change simulation
- Guided onboarding included for founding customers
- Email support
Institutional
- Full implementation (4 weeks)
- Integration with your outbound channels
- Team training and SLA
- Custom test scenario suite
90-day guarantee on annual plans, full refund, no questions asked. Your data was never with us, so there is nothing to return beyond your money.
Also free
Weekly AI-governance intelligence for the EU AI Act and US hiring law, plus a compliance Starter Kit, for teams who want to track the regulation before they need the chamber.
Direct questions
What people ask before they trust us.
Does my data ever reach your servers?+
There is no “our servers” in this picture. Signato runs entirely on your machine: the matrix, the checks, and the telemetry are your own files, on your own infrastructure. That is the structural difference against any cloud DLP tool: sending your content out to check its confidentiality creates exactly the leak you were trying to prevent.
Do I need to connect it to an AI, and which channels does it work with?+
You do not give Signato a model, and it never needs access to one: it checks the text on its way out,
an email, a draft, an assistant’s reply, not the AI that wrote it. On an assistant like Claude Code, a
ready adapter registers as a pre-send hook pointed at your matrix file, so every draft is checked before it
leaves. To run it yourself, signato check verifies any file or text on demand and
signato scan audits an export of your existing mailbox. Email and messaging channel
integrations are part of the assisted plans.
Where does the code run, and is there a license key that phones home?+
Everything runs on your machine: the package installs locally, your matrix is a plain file you own, and the check happens in your own process, with no call to us at install or at check time. The 30-day trial has no key at all, it starts itself the first time you run it. A paid license is a signed token your copy verifies offline, against a public key built into the package, still with no network call, and the license is enforced offline too: if it lapses, there is a 14-day grace window with warnings, and then verification commands lock until you renew — still with no network call, nothing deleted, nothing uploaded. The lock refuses to run; it never fails open, so an expired copy will not wave a blocked pair through. An active plan is what keeps the product running and entitles you to new releases as we ship them, support, and reports stamped as licensed instead of as evaluation copies.
What if I configure the wall wrong?+
That is the real risk with any security tool, which is why the product does not leave you alone with it: the visual assistant interviews you in business language, a linter flags known anti-patterns, every wall ships with automated test scenarios, and any change can be simulated before it takes effect. For founding customers, guided onboarding is included, and your data never leaves your machine.
Can I cancel?+
On the monthly plan, anytime. On the annual plan, a 90-day full-refund guarantee. Because everything runs on your machine, cancelling never holds you hostage: your matrix and telemetry files remain yours, in place, after you stop paying. What stops, after a 14-day grace window, is the service itself: verification commands lock until you renew, and reactivating picks up exactly where you left off.
Before someone asks
Make confidentiality something you can attest to.
Install it, run the demo with synthetic data, and see your first block in a minute. Build your real matrix when you are ready, still without a single byte leaving your machine.