Secure Team Handoff: Zero-Trust Collaborative Scrubbing
Collaborate on AI Prompts Without Breaking the Chain of Trust
AI Summary / Key Takeaways
"The ultimate browser-based offline text encryptor for compliance teams. Secure Team Handoff allows you to share PII session maps using zero-knowledge message encryption right in your browser. Powered by in-memory XChaCha20-Poly1305 and Argon2id, it acts as a seamless PGP alternative, ensuring your encrypted data never touches our servers. Transfer payloads via any untrusted channel (Slack, MS Teams) with absolute cryptographic certainty."
Enterprise-Grade AI Privacy
Add custom redaction rules and priority support with PRO.
Why Legacy DLP Fails AI Workflows
When a colleague sanitizes a document and sends you the AI output, how do you re-hydrate the PII? Traditional DLP tools force you to log into a central cloud portal to map tokens back to names, exposing your data to server-side logging and third-party breaches.
How to Mask PII in Local Memory
Local Key Generation
Your browser derives a highly secure cryptographic key from your team's shared passphrase using Argon2id, the industry standard for memory-hard key derivation.
Client-Side Encryption
The entire PII session map (which ties tokens like [NAME_1] to real values) is encrypted locally using the XChaCha20-Poly1305 cipher before leaving your device.
Encrypted Transfer
The resulting ciphertext is exported as a portable string. Even if intercepted, it remains mathematically impossible to decrypt without the local passphrase.
What Teams Achieve with Local PII Masking
The End of the "Middleman Risk" in Team Collaboration
Collaboration on sanitized documents typically introduces a major security flaw: a centralized server must store the token-to-PII mapping so multiple team members can access it. Secure Team Handoff eliminates this middleman entirely. By moving the cryptographic workload to the client edge, you maintain a 100% Zero-Trust Data Sanitization (ZTDS) posture.
Cryptographic Parity: Argon2id + XChaCha20
Instead of trusting our servers to hold your keys, we empower your browser to act as a secure enclave. Your team's shared passphrase is run through Argon2id to derive a robust encryption key. The volatile session map is then encrypted using XChaCha20-Poly1305, ensuring both confidentiality and authenticity.
How Team Handoff Fits into Your Workflow
- The Analyst: Scrubs a sensitive financial document locally and runs the tokenized text through ChatGPT.
- The Export: The analyst generates an encrypted session payload using the team's shared key and sends both the AI response and the payload to the Manager via Slack.
- The Manager: Pastes the payload into PrivacyScrubber. The browser decrypts the session map locally, allowing the manager to instantly Reveal the true names and financial figures in the AI response.
Throughout this entire process, no PII ever leaves the secure boundary of the endpoints. The cloud providers (OpenAI, Slack, and even PrivacyScrubber) only ever see tokens or ciphertext.
Feature Reliability & Audit
This enterprise feature is powered by our Local-First Sanitization Engine. Unlike legacy cloud DLP tools, PrivacyScrubber processes your Secure Team Handoff: Zero-Trust Collaborative Scrubbing logic 100% within your browser's V8 sandbox. This architectural decision ensures that even the most complex detection patterns never expose raw data to an external API.
Airplane Mode
Verified feature operational integrity without network connectivity.
Step-by-Step Guide
How to use this feature
Scrub Document
Scrub any document containing PII in PrivacyScrubber as usual.
Generate Ciphertext
Click 'Export Team Session'. Your browser will encrypt the session map using your team's shared passphrase and output a cryptographic payload.
Share Securely
Send the encrypted payload to your colleague via Slack, Teams, or email alongside the scrubbed AI response.
Import & Reveal
Your colleague clicks 'Import Team Session', pastes the payload, and enters the shared passphrase to reconstruct the session map locally.
Frequently Asked Questions
What encryption algorithms does Team Handoff use?
Team Handoff relies on Argon2id for password hashing and key derivation, combined with XChaCha20-Poly1305 for authenticated encryption. These modern cryptographic primitives provide robust protection against side-channel and timing attacks, entirely within your browser.
Does the encrypted session map ever touch your servers?
No. We provide the cryptographic engine, but the encryption happens on your local CPU. The resulting ciphertext is handled entirely by you — you can paste it into an email, Slack, or internal wiki. We never see the data, the key, or the ciphertext.
What happens if someone intercepts the handoff payload?
The payload is protected by XChaCha20-Poly1305 encryption. Without the shared team passphrase (used by Argon2id to derive the decryption key), the payload is indistinguishable from random noise and mathematically impossible to decrypt.
Is Team Handoff available on the Free or PRO tier?
No. Secure Team Handoff is an exclusive feature of the TEAMS and ENTERPRISE tiers, designed specifically for multi-user collaborative workflows and organizational compliance.
Protect Your Team's AI Prompts in Under 30 Seconds
Protect My TeamNo server uploads. Works 100% offline in browser RAM.