A four-phase pipeline that strips private student data out of prompts and uploaded files before anything leaves the device, including the standout trick: swapping real student names for synthetic ones so the AI vendor never sees who is who.
DLP stands for Data Loss Prevention. The risk is simple and constant: a student or teacher pastes something sensitive into an AI tool, a roster, a grade book, an IEP, a parent's phone number, and now that data sits in a third party's cloud. Tenet cleans prompts and uploaded files on the device, before they reach the AI vendor, so the sensitive parts never leave the browser.
Pattern-based removal of the obvious identifiers: emails, phone numbers, Social Security numbers, dates of birth, addresses, credit card and routing numbers, and district-defined student ID formats. This is free in Basic and covers both chat and files.
Because Pro knows the district's actual roster, it can catch a real student's name even when there is no pattern to match, for example “Sarah W.” in the middle of a sentence. Patterns alone would miss that; a roster does not.
Instead of just blanking names out, Tenet swaps each real name for a believable synthetic one before the prompt goes out, then restores the real name locally when the AI replies. The conversation stays natural and the vendor never learns who the student is.
Tells the difference between “Sarah went to Paris,” which is a peer, and “Sarah, the capital of,” which is not a person. This cuts false positives so legitimate work is not mangled.
Student types: “Help Sarah Wilson revise her essay.”
Tenet sends the AI: “Help Jordan Maple revise her essay.”
AI replies about Jordan Maple.
Student sees: the answer with Sarah Wilson restored on screen.
The synthetic name is gender-coherent so the reply still reads naturally. The map from real to synthetic lives only in that browser tab's memory and is destroyed when the tab closes. No competitor does this.
The same scrubbing runs on uploaded files, which is where a lot of the real risk lives, because a single file can contain an entire class roster.
PDF, Word, Excel, PowerPoint, RTF, CSV, and plain text are parsed and scrubbed in the browser before upload.
On-device text recognition reads text inside images, so a screenshot of a roster is scrubbed too.
Spreadsheets and CSVs get cell-aware treatment, so names and identifiers in a grade book are caught.
The FERPA conversation gets concrete: student PII is removed before it ever reaches an AI vendor, on the device, and the pseudonym mapping is never persisted.
The defensible answer to “are we leaking student data to ChatGPT?” is no, and here is the mechanism.
A safety net for the honest mistake of pasting a roster or a grade into AI. Tenet catches it so the teacher does not have to.
The student-record classifier flags a student who tries to share IEP, 504, or discipline details with AI.