Get started

Architecture & security

Data handling

Blekline never stores raw prompts in the audit stream. Masking is in transit; events are metadata only.

View as Markdown

Blekline does not store raw prompts in workspace Activity, compliance export, or default event ingest.

What happens on mask

  1. The client (MCP, extension, SDK, or ingress) sends prompt text to POST /api/mask over TLS.
  2. The control plane runs PII/secret detection (Azure Language in SaaS; local regex on sidecar fast-path).
  3. The response returns maskedText and a short-lived tokenMap.
  4. The original prompt is not written to the audit log.

Optional Secure Vault in the browser extension encrypts a copy on the device (passphrase in session storage). That is local, not a cloud prompt archive.

What is stored

Audit events are metadata only:

StoredNot stored
kind, action, entitiesMasked, riskTierRaw prompt body
mcpToolName, clientSurface, requestIdFull tool argument payloads (default)
Mask provider / phase labelsAzure PII payloads as a durable store

See Trust boundaries for field examples and residency.

Governance events

blekline_log_governance_event / /api/events accept metadata. Do not send prompt bodies in those calls. Clients in this repo follow that contract.

Retention

  • SaaS Activity retention follows plan (Free: 7 days; higher plans longer).
  • Exports (CSV, SIEM) remain metadata-only unless you explicitly forward a different stream.

Next: Choose your path · Quick Start · Open workspace