Shadow AI and the Copy-Paste Problem: 223 Violations per Month
Research Source
Research across enterprise environments found an average of 223 PII paste events per organization per month into unsanctioned AI services. Employees copy customer data, employee records, financial figures, and medical information from business applications and paste them into ChatGPT, Claude, Gemini, and other AI services. These services are not approved by IT, are not covered by DPAs, and retain conversation data for model training or improvement.
Executive Summary
Employees paste PII into AI chatbots an average of 223 times per month per organization. These AI services are unsanctioned, lack data processing agreements, and may retain data for training. The copy-paste vector bypasses every network-level security control.
anonym.legal's Chrome Extension and Office Add-in intercept PII at the point of paste — the exact moment employees transfer data from business systems to AI services.
The Problem: The Copy-Paste Vector
Network-level security controls (firewalls, proxies, CASB) can block access to AI service domains. But blocking AI services entirely is increasingly untenable — employees need AI tools for legitimate productivity gains. The copy-paste vector operates within allowed browser sessions: an employee opens a CRM record (authorized), copies a customer's name and email (clipboard operation — invisible to network controls), switches to a ChatGPT tab (allowed through CASB), and pastes the data (keystroke — invisible to network controls). The PII moves from a protected system to an unprotected AI service through user behavior that no network control can intercept.
Irreducible truth: Copy-paste is a user-level data transfer that operates below network security controls and above endpoint DLP. The only interception point is the application layer — the browser extension or office add-in where the paste occurs.
The Solution: How anonym.legal Addresses This
Chrome Extension: Browser-Level Interception
The anonym.legal Chrome Extension (v1.1.37, Manifest V3) detects PII in AI chat input fields. When a user pastes text containing names, emails, phone numbers, or other PII into ChatGPT or Perplexity, the extension highlights detected entities and offers one-click anonymization. The anonymized text replaces the paste content before the user sends the message.
Office Add-in: Document-Level Interception
The Office Add-in (v5.23.25) for Microsoft Word enables users to anonymize PII in documents before copying content to AI services. Users can select text, detect PII, and anonymize within Word — then copy the anonymized content to any AI service. This shifts the anonymization step to before the copy, rather than after the paste.
Encryption Key Management
Both the Chrome Extension and Office Add-in use browser-local or Office.js-local encryption key storage. Keys never leave the user's device. This means the anonymization is truly client-side — anonym.legal's servers never see the original PII or the encryption keys.
Point-of-Paste Interception vs. Network Controls
| Control Layer | anonym.legal Extension/Add-in | Network Controls (CASB/Proxy) |
|---|---|---|
| Intercepts copy-paste | Yes — at the application layer | No — operates at network layer |
| Blocks AI access | No — allows anonymized use | Yes — blocks entirely or allows entirely |
| User experience | One-click anonymize | Blocked access or unrestricted access |
| PII detection | 285+ types, 48 languages | None — network-level only |
| Shadow AI risk | Reduced — users can work safely | High — users seek workarounds |
| Deployment | Browser extension + Office add-in | Network infrastructure |
Compliance Mapping
This pain point intersects with GDPR Article 5(1)(f) (integrity and confidentiality), GDPR Article 32 (security of processing), and the concept of 'appropriate technical measures.' Network controls alone are insufficient when the data transfer vector operates at the application layer.
anonym.legal's GDPR, HIPAA, PCI-DSS, ISO 27001 compliance coverage, combined with Hetzner Germany, ISO 27001 hosting, provides documented technical measures organizations can reference in their compliance documentation.
Product Specifications
| Specification | Value |
|---|---|
| Entity Types | 285+ |
| Detection | 3-layer hybrid: Presidio + NLP + Stance classification |
| Test Coverage | 100% (419/419 tests) |
| Languages | 48 |
| Anonymization Methods | Replace, Redact, Mask, Hash (SHA-256/512), Encrypt (AES-256-GCM) |
| Platforms | Web App, Desktop, Office Add-in, Chrome Extension, MCP Server, REST API |
| Pricing | Free €0, Basic €3, Pro €15, Business €29 |
| Hosting | Hetzner Germany, ISO 27001 |
| Compliance | GDPR, HIPAA, PCI-DSS, ISO 27001 |
Limitations & Considerations
Integration Complexity: Organizations implementing this solution should expect comprehensive organizational assessment, compliance framework evaluation, and technical infrastructure review before deployment. Integration complexity varies based on existing systems, data workflows, and regulatory requirements.
Data Volume Scaling: Performance characteristics vary with data volume, document format diversity, and entity pattern complexity. Organizations processing high-volume document streams should conduct benchmark testing with representative samples to validate throughput and accuracy targets.
Team Training Requirements: Requires 2-4 weeks of onboarding for security and compliance teams to configure custom entity patterns, establish organizational policies, and integrate with existing workflows. Dedicated privacy engineering resources accelerate deployment.
Not for: Organizations without dedicated privacy engineering resources or regulatory compliance mandates may find simpler solutions more cost-effective. Best suited for teams with stringent data protection requirements (GDPR, HIPAA, CCPA).