Catch sensitive data before it leaves your device.
Riidact reads what you're about to send, wherever you type it, and looks inside the files you attach. It holds back the things you'd regret sending: a live API key, a customer's phone number, the deck marked confidential, the spreadsheet you dragged in. All of it is checked right on your machine, and nothing you type ever leaves your device.
How can I help?
I'm handing our project over to the new team. Can you tidy my notes into a summary?
Of course. Paste whatever you have and I'll structure it.
What it catches
The things you'd want a second pair of eyes on.
Five kinds of sensitive information, recognised on sight and, where it matters, checked against the words around them so a real ID never hides behind a plain-looking number.
Keys and credentials
One stray paste can turn into an incident report, so Riidact knows hundreds of formats on sight.
API keys & tokens
AWS, GitHub, Stripe and 200+ more
Passwords
In config, env files or prose
Connection strings
Credentials inside a database URL
Private keys
SSH and PEM key blocks
Access & session tokens
Bearer tokens, OAuth, cookies
Example
Personal details
Whether they belong to you or a customer. It reads national formats from 55+ countries, and where a number carries a check digit it confirms that too before flagging.
Emails
Personal and work addresses
Phone numbers
Checked against real country plans
Bulk data exports
One alarm when a paste looks like a CRM or database export
Card & bank numbers
Cards and IBANs, checksum-verified
Street addresses
Postal lines like 1 Bakerfield Place
Passports
Machine-readable passport numbers
Tax & national IDs
SSN, TFN and more from 55+ countries
Health IDs
Medicare, NHS and health numbers
Names
People's names in plain writing, read on-device
Example
Confidential material
Anything labelled as not-for-sharing gets held at the door.
Confidential
Marked confidential or classified
Internal only
Not meant to leave the company
Under NDA
Covered by a non-disclosure agreement
Attorney-client
Privileged legal material
Embargoed
Held until a release date
Classified & restricted
Government markings, TLP labels and export controls
Risky document shapes
Logs, database exports, legal and financial documents
Example
Your own watchlist
Tell Riidact once, and it watches for them everywhere you type.
Project codenames
Internal names for unreleased work
Client names
Accounts you'd rather not mention
Unreleased products
Anything not yet announced
Custom formats
Any word or pattern you add
Example
Files and screenshots
Attachments are read on your device before they're sent. A photo of a whiteboard counts.
PDFs & documents
Read on-device before they upload
Spreadsheets
Scanned cell by cell
Slides & decks
Checked page by page
Screenshots
Text pulled out with OCR
Photos
A snap of a whiteboard counts
Example
The three checks, what stays on your device, and the pieces behind it.
Privacy
We can't read your messages.
The checking happens inside the extension, on your computer, so there is nothing for us to read. When something gets caught, the only thing that reaches your dashboard is a receipt:
timestamp · site · category · severity · action · rule id
That's the whole record. The words themselves never leave your machine, and neither do your files. Once events pass your retention window they're deleted for good.
Your device
…my key is sk-live-4fJ9…
checked here · held here
Your dashboard
never the text itself
Where it works
Coverage, stated plainly.
The essentials don't depend on language at all. The deeper checks reach across the languages and countries listed here, exactly as they stand today.
Regardless of language
- Keys, passwords and secrets
- Email addresses
- Phone numbers, against every country's dialling plan
- Payment cards and IBANs
- Your own watchlist, in any script you write it
Names & places · 85+ languages
Our own on-device model reads people's names and place names across scripts. Each language listed here is benchmark-verified:
Government, tax & health IDs · 55+ countries
150+ ID formats · 80+ checksum-verified
Each ID is recognized in its own language: a Japanese マイナンバー, a Swedish personnummer and a French numéro de sécurité sociale all count. Where a number carries a check digit, it's verified with the same maths the issuing country uses.
Argentina
Australia
Austria
Belgium
Brazil
Bulgaria
Canada
Chile
China
Colombia
Croatia
Czechia
Denmark
Ecuador
Estonia
Finland
France
Germany
Greece
Hong Kong
Hungary
India
Indonesia
Ireland
Israel
Italy
Japan
Latvia
Lithuania
Luxembourg
Malaysia
Malta
Mexico
Netherlands
New Zealand
Nigeria
Norway
Philippines
Poland
Portugal
Qatar
Romania
Russia
Saudi Arabia
Singapore
Slovakia
Slovenia
South Africa
South Korea
Spain
Sweden
Switzerland
Taiwan
Thailand
Türkiye
UAE
Ukraine
United Kingdom
United States
Confidentiality markers match English phrasing. Screenshot reading covers English and other Latin-alphabet languages, plus Chinese and Japanese.
How it works
The smarts stay on your device.
Three things do the catching, and every one of them runs inside the extension on your own machine. Nothing you write is sent away to be checked, because there's no server in the loop to send it to.
A local AI model
A small model runs right in your browser and recognises personal details the way a person would. It spots names, addresses, contact details and ID numbers, even ones that don't follow a set format.
Built-in smart rules
Riidact arrives already knowing hundreds of risky things on sight: API keys, tokens, passwords, tax and health IDs, confidentiality labels. They're matched the instant they appear.
Your own rules
Add the words and formats that are sensitive only to you, like client names, codenames or internal IDs. They sync down to the extension and match locally, like everything else.
It tells a real ID from a random number
Riidact reads the words around what you type. A number on its own is left alone. The same number sitting next to a label like “SSN” is caught. That's how it stays quiet until something is genuinely sensitive.
Setup
Point it at any site.
Riidact comes ready for the tools you already use. On a new site, show it around once: click the box where you type, click send, and the badge takes it from there.
Dashboard
See what got caught, not what got typed.
Create an account and every catch shows up as a receipt you can search, filter, export, or stream straight to your own tools: the time, the site, the kind of thing flagged, and how it was handled.
A live activity feed
Every catch as it lands: the site, the kind of thing flagged, and whether it was removed, sent, or blocked.
Filter and export
Narrow by category, site, or how it was resolved, and download any window as a CSV for your own records.
Your rulebook
Manage the words and patterns that are sensitive to you, on their own or in groups. On a team, share the ones you choose.
Trends at a glance
How much is being caught, by category and site, and whether it's climbing or settling down.
Stream to your systems
Send catch receipts to your endpoint or SIEM the moment they happen, so your own tools stay in the loop.
Wire catches into your stack
Point a webhook at your endpoint or SIEM and each catch is posted the moment it happens, signed so you can verify it came from us.
POST to your endpoint
{
"site": "chatgpt.com",
"detection": "Driver licence",
"severity": "critical",
"action": "removed",
"member": { "email": "sam@acme.co" }
}Your rules
Teach it what's sensitive to you.
Some things are only sensitive to your company. A client nobody knows about yet, or the way your invoice numbers look. Describe them to Riidact the way you'd describe them to a colleague, and it keeps an eye out everywhere you type.
You add a rule
Riidact catches
“Flag ‘Halcyon Partners’ anywhere it shows up.”
…the Halcyon Partners deck moved to Friday…
“Our contract numbers are CTR- followed by six digits.”
…billed under CTR-104829 last quarter…
“Anything ending in .internal.acme.co stays inside.”
…logs from staging.internal.acme.co…
For teams
Set the rules once. Everyone's covered.
Bring your people into one team. You keep the shared rulebook, it reaches every member's browser, and the checking still runs on each person's own device. You see what got caught across the team, never what anyone typed.
A shared rulebook
Publish a rule once and it lands in every member's extension within seconds. Each person can still keep rules that only they see.
One view of what's caught
The team dashboard shows each catch as a receipt: time, site, category, action. What anyone actually typed never leaves their machine.
Names off when you want
Switch to team-level counts with no member attribution, so the dashboard shows totals and never points at a person. Built for works councils and privacy-first teams.
Set a floor no one can drop below
As your team grows, lock a category on, turn a warning into a hard block, and decide whether people can pause. Protection stops being optional.
A quiet rollout for IT
Deploy Riidact through your managed browser settings. People are covered the moment their browser opens, with no sign-in to chase.
A record of every change
Every rule and policy edit is logged, so there's always a clear answer to who changed what, and when.
Publish once, protect everyone
You keep the shared rulebook. The moment you add or change a rule, it syncs down to every member and starts matching on their device. Anything a person marks as their own stays private to them.
You publish
Halcyon Partners
Every member
Pricing
Start free. Go Pro when you need the reach.
The free plan stops the mistakes that cost the most, and it always runs on your device. Pro widens the net to more of the world and reads context, so it flags the real thing instead of every number that looks a bit like one.
What it catches
Free
$0
forever
Pro
$5
per month
14-day free trial
Some of this category is included. Expand a row to see exactly what.
Prices in USD, per month. On Pro you can start a team: your plan plus $5 for each person you add.
FAQ
Questions, answered.
Does Riidact send my text to a server?
No. Every check runs on your own device, inside your browser. What you type is read and checked locally and is never transmitted, so there's no server in the loop to send it to.
Does it work with ChatGPT, Claude and other websites?
Yes. Riidact works with the major AI tools like ChatGPT, Claude, Gemini and Copilot, and with any other site that has a text box and a send button. There's a quick one-time setup on each site where you point it at the box you type in and the send button, and it watches there from then on.
What does Riidact catch?
Live API keys and credentials, personal details like emails and phone numbers, confidential or internal material, and any terms you add to your own watchlist.
Is Riidact free?
Yes. Catching keys, secrets, emails and phone numbers is free on every plan. Pro adds confidential-material detection, on-device name recognition, and shared team watchlists.
Which browsers does it support?
Chrome and Firefox, plus other Chromium browsers like Edge, Brave and Opera.
Can my team share rules?
Yes. On a team, the owner publishes a shared watchlist that syncs to every member's browser within seconds. Each person can still keep private rules of their own.
Give your words an airlock.
Create an account and add the extension. About two minutes from now, the next risky paste gets caught before it goes.