Controls & Monitoring
AI Agent Risk Monitor
Monitors agent actions for risky or unexpected behavior.
Controls & Monitoring
AI Data Leakage Monitor
Sensitive data appearing in AI outputs, logs or exported files is caught and flagged before it spreads further.
AI tools are good at repeating what they see, including customer records, passwords and private text. This monitor scans the outputs, logs and exports your AI tools produce for the data categories you define. Matches are flagged with severity and context, masked where your rules allow it, and sent to a named person. You decide what counts as sensitive and what happens next.
- Sensitive data caught in AI outputs, logs and exports
- Categories defined around your own data, not a generic list
- Approved matches masked before they spread further
$5,400
20–30 working days
Optional maintenance $270/mo
What it is
AI Data Leakage Monitor is an agent that scans the outputs, logs and exports produced by your AI tools for sensitive data such as personal information, credentials or proprietary text, and flags any match it finds. It watches content, not traffic, unlike a network or API monitor.
Why businesses buy it
When sensitive data leaks through an AI tool, the cost is rarely the first leak. It is the copies: the transcript stored for months, the export emailed around, the log nobody checks. Catching a match early keeps one mistake from becoming a reportable incident. This monitor watches the content your tools produce, close to the moment it is produced. The written scope sets the systems, categories and monitors covered, so you know exactly what is being watched before you order.
Problems this solves
AI tools may return personal data that should never be shared
The agent scans the outputs your AI tools produce for personal information and other sensitive data. Any match is flagged so your team can act on it.
Credentials end up in AI logs and exports by accident
Logs and exports are scanned for credentials as well as personal data. A key that slips into a log file is flagged rather than left sitting there.
Proprietary text leaks out through AI-generated responses
Your policies, up to 20 documents, help define what counts as proprietary text. Output containing that protected material is flagged before it travels any further.
No one checks AI output once it leaves the tool
The monitor watches content, not network traffic. It reviews what your AI tools actually produce, which is where sensitive data can slip out without anyone noticing.
A good fit if
Your AI applications handle customer records, internal documents or other data that should not appear in a chat response or a log line.
You want a defined list of sensitive data categories, such as personal information or credentials, watched for automatically.
You already have logs or exports from your AI tools that nobody is systematically reviewing for exposure.
You want alerts and, where feasible, redaction when sensitive content is found, rather than discovering it after a customer complains.
Not the right fit if
Your concern is unusual request volume or unauthorized callers hitting your APIs, not the content in responses; see AI API Security Monitor.
You want monitoring across your systems generally, not focused specifically on data exposure; see AI Security Monitoring.
Your priority is malicious input reaching your models, not sensitive data leaving them; see AI Prompt Injection Defense.
You need this combined with broader agent guardrails and action limits in one build; see AI Agent Security Layer, our broadest option.
How it works
- We connect to your AI application outputs, logs and configured export locations. This gives the monitor visibility into what the AI is actually producing and storing, not just what it was asked.
- Sensitive data categories are defined with you. Personal information, credentials, customer records or proprietary text you specify, each described precisely enough to be checked for reliably.
- Outputs, logs and exports are scanned against those categories on an ongoing basis. A response, a stored transcript or an exported file is checked as it is produced, not weeks later in a batch review.
- Matches are flagged with severity and context. A single incidental mention looks different from a full record appearing somewhere it should not, and the monitor reflects that difference in how it ranks a finding.
- Redaction is applied where feasible, based on rules you approve. Some matches can be masked automatically before they reach a log or a downstream system; others are flagged for a person to review first.
- Alerts reach Slack so a person closes the loop. The monitor tells you what left and where; deciding what happens next, including any notification obligations, stays with your team.
What you provide within 72 hours
Your portal lists these the moment you order. Delivery starts the working day after everything is in and your access is checked.
- Written authorization confirming which AI applications, outputs and logs we may scan.
- The list of sensitive data categories you want watched, such as personal information or credentials.
- Any existing data handling policies these categories should follow.
- Read access to the relevant outputs, logs and export locations, as needed.
- A named IT or security owner who can review flagged matches after launch.
- Admin access and API keys for every connected system, shared by adding our team as a user or creating a key you control, never by email.
- One decision-maker who can approve the detection categories and sign off the launch.
The 72-hour rule. Send everything on your checklist, including access, within 72 hours of ordering so your build starts on time.
Timeline
Start
Systems, sensitive data categories and scope confirmed.
Weeks 1–2
Scanning built and tuned to the categories you defined.
Week 3
Output, log and alerting connections completed.
Weeks 3–4
Documented test scenarios run and results sent to you.
Week 4
Your review and two rounds of changes to the categories.
Go-live
Live, recorded handoff session, 30 days of support begin.
| Option | Delivery time | Price |
|---|---|---|
| Standard | 20–30 working days | $5,400 |
| Express | 15–25 working days | $6,200 |
| Rush | 10–20 working days | $7,000 |
What you receive at handover
- A data leakage monitor scanning outputs, logs and exports from up to three AI tools
- Up to five detection rules or policies for personal data, credentials and proprietary text
- Flags viewable in an admin console or written report
- A control test log from testing
- An admin guide, a recorded handoff session and 30 days of post-launch support
Expected benefits and how to measure them
- Sensitive data in AI output can be caught early.
- Your team can see where leaks tend to happen.
- Privacy and security reviews can draw on a clear record.
- Matches flagged by type
- Count flags each month by type from the console or report.
- Confirmed exposures
- Track flags confirmed as real exposure in your incident log.
- Time to resolve a flag
- Log the time from each flag to its resolution.
Before you start: List the AI tools in scope and where their outputs, logs and exports go. Record any known exposure incidents.
These are things to track, not promised results. Outcomes depend on your data, your team and your market.
Running costs
The build price is one-time. Running the monitor costs roughly $20 to $300 a month in your own accounts, for hosting, logging and the monitoring tools it relies on day to day.
AI model usage during the build and testing is billed the same way, directly to your accounts, so you keep ownership of every provider relationship involved.
Ask about running costsCustom requirements
If you need something outside the Scope Card, such as scanning across more than three systems, add a note at checkout. You get a written Change Quote, and that work only starts once you accept it. Larger or bespoke projects go through the Custom AI request form instead.
Request a custom versionKeep it running
Monthly maintenance covers monitoring, fixes, updates, a health report and change hours for things such as adding a data category or tuning redaction rules. It starts after the 30 days of included support and can be cancelled any month.
$270/mo (5% of the build price a month, includes 2 change hours)
Optional. Starts after the post-launch support period. Cancel any month.
How maintenance worksHow this compares
| Do it yourself with a SaaS tool | Hire a custom agency | Upmark Labs | |
|---|---|---|---|
| Price | A data loss prevention tool charges per seat or data volume, monthly | A security firm quotes after a scoping call | Ours is one fixed price, shown on this page before you buy |
| Scope | A data loss prevention tool applies generic categories out of the box | An agency agrees scope during the engagement | Ours is tuned to the categories you actually define |
| Delivery | A data loss prevention tool still needs weeks of tuning to be accurate | A security firm engagement often takes weeks to schedule | Ours has a fixed delivery time shown before you buy, with faster options |
| Coverage | A data loss prevention tool often covers email and file storage only | An agency build depends on what was agreed | Ours watches AI outputs, logs and exports specifically |
| Guarantee | A data loss prevention tool may market a detection rate figure | An agency build depends on what was agreed | Ours flags likely matches; no monitor catches every exposure |
Questions about this product
What sensitive data categories does AI Data Leakage Monitor watch for?
It watches for whatever categories you define during setup, commonly personal information, credentials, customer records or proprietary text. There is no generic default list; the categories are agreed with you so the monitor checks for what actually matters to your business, not a one-size-fits-all set copied from somewhere else.
How is AI Data Leakage Monitor different from AI API Security Monitor?
This monitor watches the content of AI outputs, logs and exports for sensitive data exposure. AI API Security Monitor watches traffic patterns around your endpoints instead, such as request volume and source. One is about what is inside a response; the other is about how the request arrived at all.
Does AI Data Leakage Monitor redact sensitive data automatically?
Where feasible and based on rules you approve, yes, some matches can be masked before they reach a log or downstream system. Other matches are flagged for a named person to review first, since not every case is safe to redact automatically without a human making that call.
How much does AI Data Leakage Monitor cost to run each month?
Plan on roughly $20 to $300 a month in your own accounts for hosting, logging and the scanning tools the monitor relies on. The figure depends mostly on how much output and log data passes through each month. You pay those providers directly, with no per-scan fee from us. The one-time build price for each delivery speed is shown in the price panel on this page.
What happens when sensitive data is found?
An alert with severity and context routes to Slack, and a named person on your team reviews it and decides what happens next, including any notification obligations your business may have. The monitor flags and, where approved, redacts; it does not make that judgment call in your place.
Can I add more data categories later?
Yes. Adding or adjusting a category fits inside the monthly change hours that come with maintenance. Scanning across more systems than the three included in scope, or a substantially larger set of outputs and logs, comes through a Change Quote, priced and agreed with you before that work starts.
Who owns the flagged data log once the monitor is live?
You do. The categories, the scanning configuration and the history of flagged matches all live in your own connected accounts, not a separate platform we control, so you retain full access and can adjust the setup at any time without needing our involvement. We keep no separate copy that would lock you into working with us going forward.
Know when sensitive data leaves through your AI tools.
Order AI Data Leakage Monitor and it starts scanning your AI outputs and logs, live on a fixed delivery date.
Works well with
Controls & Monitoring
AI Security Policy System
Maintains security policies and checks systems against them.
Controls & Monitoring
AI Security Monitoring
Centralizes security events from AI systems with alerting.