The most common enterprise AI leak in 2026 is not a hack. It is an employee pasting a contract, a board note or a block of source code into a public AI tool to finish a task faster. The moment they press enter, that content leaves the building. The uncomfortable part for security teams is that the employee did nothing malicious. They ran into a missing boundary, and the boundary is the real story.
A note before we begin. This is an architectural and security discussion, not legal advice. Where it refers to the Digital Personal Data Protection Act, 2023, it describes how architecture supports obligations, never that any product makes an organisation compliant on its own.
The leak is the person doing their job
Look at what the research has been saying through 2026. A large majority of employees admit to sharing sensitive company data with AI tools, and roughly a third of everything people paste into AI is now sensitive, up sharply from a couple of years earlier. The most cited cautionary tale is still an engineering team that pasted confidential source code into a public assistant to debug it, and only later learned the code had travelled to a vendor's servers. None of these were break-ins. They were people using the fastest tool on their desk.
Security teams have a name for this now: Shadow AI. Staff draft contracts, summarise presentations, analyse competitor data and write code in whatever assistant is one tab away, without procurement, without data classification, and without IT knowing it happened. It has quietly become one of the largest insider-risk vectors in the Indian enterprise, precisely because it does not look like risk. It looks like productivity.
You cannot train your way out of an architecture where the fastest path to getting work done also sends your documents outside the building.
Why a DLP add-on is a band-aid
The market's answer has been a wave of AI data-loss-prevention tools: browser extensions and inline inspectors that sit between your people and a public model and try to catch sensitive content in the split second before it leaves. They help. They are also, structurally, a band-aid on the wrong wound.
Think about what that tool is actually doing. It is standing guard at a door that should not exist, hoping to recognise a customer record or a piece of source code inside freeform text before it crosses to someone else's cloud. It has to be right every time, in real time, against every new phrasing and every new AI app your staff discover. Traditional pattern-matching misses plenty, and each new tool opens a new door to guard. You are policing egress instead of removing it.
The question worth asking is simpler than the tooling debate. Why does the document have to leave at all?
The control that actually matters: private-document egress
Move the AI inside your own boundary and the problem changes shape. When the platform, the models, retrieval and computation all run on infrastructure you control, ordinary use does not send your documents anywhere. There is no public model on the other end of the prompt. The everyday leak, the pasted contract, the summarised board note, simply has nowhere to go.
What is left is a small, deliberate set of outbound actions: an optional web search, an email your team chooses to send, a call the assistant proposes. These reach external systems by their nature, and this is where the real control lives. We call it the consent boundary for private-document egress, and it is the highest-stakes line in the whole system, because a mistake there is the one that lets document content leave the building. So it is designed to fail closed:
- Redaction on the way out. Your private workspace terms are stripped from any outbound query, so a live web search cannot carry your confidential language into the open internet.
- Human consent for consequential sends. Sending an email or placing a call waits for a person's explicit, in-the-moment confirmation. The assistant proposes; a person decides.
- Everything logged. Any outbound activity is recorded and screened for sensitive content, so egress is accountable rather than invisible.
The honest framing matters here. This is not a claim that nothing can ever leave. It is a design where nothing about your documents has to leave the infrastructure you control, and where the few things that do go out are deliberate, redacted and logged. Every other security control, authentication, workspace isolation, audit, is defence in depth around that single line. You can read how each one is built on the security and governance page, and how the reasoning is enforced in the Intelligence Framework.
The Indian lens: DPDP and data leaving the country
For an Indian enterprise, egress is not only a trade-secret question. When a prompt carries personal or customer data to a public AI service, that data can be processed on servers outside India. That is precisely the processing the Digital Personal Data Protection Act, 2023 makes you accountable for as a Data Fiduciary, and it is a cross-border transfer you may not have decided to make. Shadow AI turns hundreds of individual prompts into hundreds of small, undocumented transfers.
Keeping processing inside your own infrastructure supports data-minimisation, purpose-limitation and localisation objectives, and it turns residency into a decision you make rather than one a vendor makes for you. It does not, on its own, make you compliant; your consent practices, records and legal review still do that. But it removes the default that quietly works against you. For the institutional version of this posture, see sovereign AI in India.
Five questions to test your own egress boundary
Whether you build, buy or subscribe, put these to any AI system that touches sensitive documents:
- When someone asks a question, does the document content stay on infrastructure you control, or does it travel to a vendor's cloud to be answered?
- Is there a single, named boundary where outbound activity is decided, or is egress scattered and implicit?
- Are your private terms redacted from anything that does go out to the open web?
- Does a consequential send, an email or a call, require a person's confirmation, or can the system act on its own?
- Can you produce a log of what left, when, and why, without asking a supplier?
A rented, cloud-hosted assistant struggles with the first question, and the rest follow from it. A private deployment is built to answer yes down the list. If you want the fuller governance version of this test, our free AI readiness checklist maps the same ideas to kill switch, oversight, explainability and audit.
Closing the door instead of guarding it
The instinct when data leaks is to add a filter. The more durable move is to ask why the data had to travel at all, and to remove the default that sends it out. Private-document egress is the one boundary that decides whether your organisation's documents stay yours. Name it, put it under consent, make it fail closed, and the Shadow AI problem stops being a game of catching leaks and becomes a matter of design.
If you want to see that boundary working on your own documents and your own connectors, request a demonstration and bring a real use case, or simply get in touch. See also the platform and how it is deployed inside your environment.