AI Submission Privacy & Evidence Checker

Review text or one file for common personal-data, secret, metadata, and evidence signals before you upload it to an AI service.

Local processing · Your input stays in this browser tab

This tool has no network code. It reads the selected file in browser memory, does not save it, and clears the in-page reference when you select Clear.

1. Add what you plan to submit

Paste text, select one file, or use both. Do not use real sensitive data just to test the checker.

Maximum 10 MiB. Plain text, source code, PDF, Office files, and common images receive format-aware checks where supported.

2. Confirm evidence handling

What this check cannot decide

Pattern matching misses context and can produce false positives. It does not unpack every archive, OCR images, validate C2PA Content Credentials, determine copyright or permission, read a service's current privacy policy, or prove that a claim is accurate.

Open document properties, comments, tracked changes, hidden sheets, and image location details in the original app.
Review the AI service's current data-use, retention, training, and sharing settings before upload.
Remove unnecessary personal or confidential material. Keep the original and verification sources separately.
Ask a qualified reviewer when legal, contractual, medical, employment, or regulated data is involved.

Direct render of the approved working interface.

Use this AI Submission Privacy & Evidence Checker to review common personal-data, secret, traceable-metadata, and evidence signals before you send text or a file to an external AI service. The checker runs in your browser. Its code makes no network request, and it does not save the selected file.

The interactive tool and its direct-render capture are included in the HTML review edition. The checker does not guarantee that a submission is private, safe, accurate, or permitted.

How to use it

Paste the text you plan to submit, select one file, or use both.
Confirm whether you kept the unchanged original, verification sources, and upload permission.
Select Run local check.
Review every finding and complete the manual checks before upload.

The file boundary is 10 MiB and the text boundary is 200,000 characters. The tool calculates a local SHA-256 digest for a selected file. Keep that digest with your own evidence record if it helps your workflow; a hash alone does not prove authorship, accuracy, or permission.

What the checker reviews

Personal-data patterns: email addresses, phone-like numbers, IPv4 addresses, US Social Security number patterns, and payment-card-like numbers that pass a checksum test.
Secret patterns: private-key headers, bearer tokens, JWT-like strings, selected cloud or repository key formats, and assigned password, token, or API-key values.
Traceable metadata: file-name signals, file-signature and extension mismatch, and supported PDF, JPEG, PNG, Office, XMP, EXIF, and possible C2PA markers.
Evidence handling: whether you confirmed an unchanged original, verification sources, and permission to upload.

Findings are review prompts, not verdicts. A match can be harmless. A missed pattern can still be sensitive.

Three examples

A draft contains a personal email address and a token-shaped string. Replace unnecessary identifiers and revoke a real exposed secret before sending the draft anywhere.
A file named evidence.jpg starts with a PDF signature. Confirm the file type and origin instead of trusting the extension.
An image contains EXIF or location markers. Open the original image properties and decide which metadata the recipient actually needs.

Manual checks the browser cannot finish

Open document properties, comments, tracked changes, hidden sheets, and image location details in the original app.
Read the selected AI service's current data-use, retention, training, and sharing settings.
Confirm copyright, contract, client, employer, school, and regulated-data rules.
Keep the unchanged original and the source material needed to verify claims.
Treat Content Credentials as provenance signals, not proof that an image or claim is true.

Why this matters

OWASP's 2025 guidance lists personal information, confidential business data, security credentials, and legal documents among sensitive information that can be exposed through LLM use. NIST AI 600-1 recommends diligence around privacy and intellectual-property risk and includes content provenance in evaluation work. CISA notes that file metadata such as author and creation time can remain visible even when file contents are encrypted. C2PA explains that provenance records can support origin and history checks, but provenance can be incomplete and does not decide whether content is true.

FAQ

Does “No configured match” mean the upload is safe?

No. The checker uses limited patterns and format markers. It does not understand every context, archive, image, policy, or legal obligation.

Does the tool upload my text or file?

No. This candidate contains no network-request code. It reads the selected file in browser memory and does not save it. A future blog page may load normal theme resources, so the claim applies to the tool's handling of the submitted input.

Can it remove metadata or redact secrets?

No. It reports selected signals. Make a reviewed copy in the original application and preserve the unchanged original separately.

Can a SHA-256 digest prove authorship or truth?

No. It helps identify whether bytes changed. It does not establish who created the file, whether the content is accurate, or whether upload is allowed.

Does a Content Credential prove an image is true?

No. It can provide tamper-evident provenance information when present and valid. C2PA states that provenance alone does not determine whether content is true or factual.

Related tools

Run the checker before your next AI upload, then finish the manual review for the service and data involved.

이 블로그 검색

AI 업무 실전 노트