Everything Prinn does happens on your own computers. Traffic never leaves the device, secrets are never stored in plaintext, no Prinn server in the path.
Everything Prinn does (filtering, key detection, and the paste guard) happens on your device. Here’s what that means for your data, and the guarantees you get.
There is no Prinn cloud in the request path. Filtering, key detection, and the paste guard all run in the local process. The only thing that can ever leave is your team ledger, and only if you turn it on, only encrypted, and only under your control.
Your traffic stays on your machine. Prinn has no server to send it to. Your secrets are masked or hashed, never written to disk or the cloud in plaintext. Your vault lives in the OS keychain, matched by hash, unlocked by you. Your team ledger is opt-in and end-to-end encrypted: trends, never the secrets.
Detected keys are masked or removed in flight. The vault stores values in your OS keychain and matches them by hash. The plaintext secret is never persisted by Prinn.
Turn Protection on and off whenever you want, and undo the one-time setup approval at any time. Every detected secret is your call, allow, mask, remove, or deny. Nothing is locked in.
Prinn protects the apps you run through it; in-page cosmetic rules need the companion browser extension. We’d rather tell you than let you assume.