Confidentiality guardrails for AI agents
Your agents write at scale. Nothing leaves without passing through the chamber.
Prompt instructions do not stop an AI agent from putting the wrong information in front of the wrong reader. Signato is a deterministic check you wire into each point your agents act, before a tool call runs, it checks the content and its destination against who-can-know-what and blocks a forbidden pair. It runs entirely on your machine: your data never leaves it.
100% local. No account, no cloud upload, nothing to configure before you see your first block.
- Deterministic, not a prompt instruction
- Local-first, your data never leaves the machine
- Testable: every wall ships with test scenarios
For teams running coding agents, MCP tools, retrieval pipelines, and LLM back-office automation over data that has any internal boundary, client versus client, deal team versus firm, one customer’s records versus another’s.
The problem
The mistake that has no way back.
An agent doing its task well can, along the way, put the wrong information in front of the wrong reader, not through a jailbreak or an attack, but through the ordinary operation of a model deciding what to say next. Multi-turn and multi-agent setups make it worse: agents are far more likely to disclose sensitive information after seeing another agent do it, and the exposure lives in the actions between agents, not just the final reply.
Frontier models leak contextually confidential information in 39% of measured scenarios, and multi-agent systems in multi-turn interaction make it worse, up to 45% in a 2026 follow-up study.
ConfAIde benchmark, ICLR 2024, extended by a 2026 multi-agent study. Adding explicit privacy instructions reduced the leak but did not remove it, it stayed above 37.8% even with those safeguards in place, because the leak happens inside the model’s own reasoning, not in a rule it forgot to follow.
That is the argument for why the defense cannot live inside the prompt. A system instruction is a request the model can misweigh against everything else it is reasoning about in that turn. The defense has to be a layer the model does not control: external to it, deterministic, and checked at each point the agent acts, not just on the final output someone remembers to double-check. Read the sourced argument →
How it works
Three steps, from your first matrix to a defensible record.
Confidentiality treated as testable, auditable code, the same discipline regulated markets already apply to trading walls, brought to any operation that has to keep people apart on paper.
Build the matrix in minutes
A visual assistant interviews you in plain business language: who receives information, which subjects have an owner, who must never learn what. Segment templates and contact import get you started without writing a line of configuration by hand.
Wire it into where the agent acts
On Claude Code it runs as a PreToolUse hook, so it sees each tool call before it executes, not just the
final answer. Person and subject are cross-checked in the same event: the forbidden pair is blocked hard,
or flagged soft, you choose the enforcement mode. The signato check command verifies any
file or text the same way.
Prove it, test it, attest it
Test scenarios are generated automatically, every change can be simulated before it takes effect, and the matrix carries an audit trail and a periodic attestation, so confidentiality is a record you can show, not a promise you make.
Pricing
Public pricing, no surprises.
Annual license per operation, not per seat. Cancel the monthly plan anytime. Annual plans carry a 90-day, full-refund guarantee.
Essential
- The full product, per agent pipeline / policy matrix
- PreToolUse hook and
signato checkCLI - Automated test scenarios
- Attestation and change simulation
- Guided onboarding included for founding customers
- Email support
Institutional
- Full implementation (4 weeks)
- Integration across your agent fleet and channels
- Team training and SLA
- Custom test scenario suite
90-day guarantee on annual plans, full refund, no questions asked. Your data was never with us, so there is nothing to return beyond your money.
Also free
Weekly AI-governance intelligence for the EU AI Act and US hiring law, plus a compliance Starter Kit, for teams who want to track the regulation before they need the chamber.
Direct questions
What people ask before they trust us.
Does my data ever reach your servers?+
There is no “our servers” in this picture. Signato runs entirely on your machine: the matrix, the checks, and the telemetry are your own files, on your own infrastructure. That is the structural difference against any cloud DLP tool: sending your content out to check its confidentiality creates exactly the leak you were trying to prevent.
Which AI and which channels does it work with?+
The checker is agnostic: any text about to go out, an email, a draft, an assistant’s reply, can
pass through the chamber via the command line or an integration. A ready adapter exists today for Claude
Code (hooks), and the signato check command verifies any file or text directly. Setup
guides, the adapter contract, and synthetic examples live in the public
integration docs on GitHub.
Channel integrations for email and messaging are part of implementation on the assisted plans.
What if I configure the wall wrong?+
That is the real risk with any security tool, which is why the product does not leave you alone with it: the visual assistant interviews you in business language, a linter flags known anti-patterns, every wall ships with automated test scenarios, and any change can be simulated before it takes effect. For founding customers, guided onboarding is included, and your data never leaves your machine.
Can I cancel?+
On the monthly plan, anytime. On the annual plan, a 90-day full-refund guarantee. Because everything runs on your machine, cancelling never holds you hostage: your matrix and telemetry files remain yours, in place, after you stop paying. What stops, after a 14-day grace window, is the service itself: verification commands lock until you renew, and reactivating picks up exactly where you left off.
Before someone asks
Make confidentiality something you can attest to.
Install it, run the demo with synthetic data, and see your first block in a minute. Build your real matrix when you are ready, still without a single byte leaving your machine.