IronSeal Now Catches Sensitive Data Before You Send It

The mistake everyone makes

Most data leaks in messaging aren't dramatic hacks. They're a slip: you paste a Social Security number into a chat, type out a card number "real quick," or fire off a client's phone number without a second thought. The exposure happens the instant you hit send — and you can't take it back.

So we built a second pair of eyes that looks before the message leaves.

What IronSeal now does

As you type, IronSeal scans your draft for four kinds of sensitive data — email addresses, phone numbers, US Social Security numbers, and credit card numbers. If it spots one, it surfaces a quiet suggestion above the composer: lock this message with a PIN? One tap protects it; "send anyway" dismisses it.

A nudge, not a block

We deliberately made this a suggestion, not a hard stop. A tool that refuses to send your message because a number looks like an SSN is a tool people turn off in a week. IronSeal flags, you decide. The protection it offers is the same per-message PIN lock that's been in IronSeal all along — and it reuses a single PIN for the conversation, so you set it once.

Why precision matters

The hard part of a feature like this isn't catching things — it's not catching the wrong things. A detector that fires on every 10-digit number (order IDs, confirmation codes, dates) is noise, and noise gets ignored. So we tuned for precision:

• Credit cards are validated with the Luhn checksum — the same math card networks use — so random long numbers don't trip it.
• SSNs must be in real XXX-XX-XXXX format, not any nine digits.
• Phone numbers must actually be formatted like phone numbers, never a bare run of digits.
• Emails are matched exactly.

The part that matters most: it's on your device

Here's the question a security-minded person should immediately ask: if IronSeal is reading my draft to detect sensitive data, isn't that the opposite of zero-knowledge?

No — and the reason is where it happens. The detection runs entirely on your device, in your browser, before the message is encrypted and before anything is sent. Your draft is analyzed where it already lives — on your screen — and nowhere else. Nothing about the detection, and nothing about your text, ever reaches our servers. IronSeal still can't read your messages, and this feature doesn't open a back door where it suddenly can.

Honest limits

This is a safety net, not a guarantee. It catches the common, well-formed cases; it won't catch every exotic format or an SSN you deliberately obfuscate. And if your work means typing this kind of data all day, you can turn it off in Settings → Security. It's on by default because, for most people, the occasional "oops" is exactly the moment worth catching.

Try it

The feature is live now and free. Type a phone number or an email into a conversation and you'll see it in action.