Architecture and data flow

BeeSensible has five parts: a browser extension for Chrome and Edge, a desktop app for macOS and Windows, a hosted API, an admin dashboard and a detection service that BeeSensible runs. Together they recognise sensitive data while people work. The organisation only receives counts.

The extension runs only on the websites in its permission list: common AI tools, email and chat applications, social platforms and the BeeSensible site itself. In the dashboard, an admin chooses which apps are included for your organisation. The desktop app does the same in desktop applications such as Outlook, ChatGPT, Claude and Microsoft Copilot.

#What happens when you type

When a signed-in user types in a supported app, the text in the input field is checked for sensitive data. That check runs on BeeSensible infrastructure in the EU. No external AI services such as OpenAI, Anthropic or Google are called.

Detection returns which sensitive values were found, where they are and what level they have. That information is used to draw the highlights on the page.

#Where detection runs

The extension and the desktop app send the text to the BeeSensible API. Detection runs there in working memory, and the text is then discarded. None of the text is stored or written to disk. Only plain counts, with no text and no user ID, go to the dashboard.

The API, the database and the storage run on Scaleway in the Amsterdam region. The models run on a dedicated server at Hetzner in Germany. Both are European companies, not a European region of an American cloud: Scaleway is 96% owned by the French Iliad group; Hetzner Online GmbH is based in Gunzenhausen, Germany. That means there is no US parent company that could be ordered under the US CLOUD Act to hand over data.

#What the extension reports about AI use

With the AI Governance module switched on, the extension reports which AI domains were opened, totalled per organisation per day, without the URL path or page content. Every prompt sent is counted by tool and use-case category. To determine the category, the first prompt of a conversation goes to the API, where it is classified and immediately discarded. The rest of the conversation inherits the category through a cache on the device.

How often someone uses AI is tracked by the extension on the device. Once a month it reports that as a single category: daily, weekly, occasionally or not active. When BeeSensible shows a notice on an AI tool, it records that the notice was shown and what the outcome was. None of these reports contains a user ID.

#What happens to a document

Documents can be anonymised in the dashboard, the extension or the desktop app. The dashboard and the extension handle PDF (including scanned PDFs), Word, Excel, PowerPoint, OpenDocument, RTF, plain text, Markdown, CSV and images; the desktop app handles PDF only. The document is processed in working memory on BeeSensible's servers in the EU, stays there for at most 15 minutes and is never written to disk. The dashboard counts only the number of documents and the number of items removed.

#What admins see

The dashboard shows figures in aggregate: by period, app, data type and level, and for AI use by tool and use-case category. It shows no message text and no per-employee view. The dashboard only receives rows with no content and no user ID. What is stored, and what is not lists exactly what those rows contain.

When an organisation rolls BeeSensible out centrally, the dashboard also records the installation status per user. This includes the version of the extension and the desktop app, whether the extension was installed through policy, whether the sign-in policy is configured, whether the user allows the extension in private windows, whether sign-in was managed or manual, and whether the desktop app is installed machine-wide. The client reports these installation details about itself, and admins can see them. They contain no detection content and give no picture of when or how someone worked.

#Sending stays with the user

BeeSensible helps users notice sensitive data before they share it, and does not block sending by itself. Text only changes when something is masked or removed: because the user chooses to, or on paste, attach or send, depending on the masking setting the organisation has chosen.

#Requesting documents

For the data processing agreement (DPA), the DPIA or security documentation, email trust@beesensible.eu. We reply in Dutch or English.