---
title: "Why we built Omit"
description: "Before Omit we worked on Telos, an app people fill with the most private things about themselves. Making it useful meant sending some of that to a language model, and nothing would strip the personal details out first without uploading them somewhere. So we built that step."
canonical_url: https://omitsys.com/blog/why-we-built-omit/
author: "Ranjan Singh"
date: 2026-07-23
published: false
---

## In short

Omit runs entirely offline because training and policy cannot stop a paste. Research cited in this post found that 77 percent of employees paste company data into GenAI prompts, and that copy-paste has overtaken file transfer as the leading corporate data-exfiltration vector. Detection and redaction happen on the machine in front of the user, so disconnecting the network changes nothing about how Omit behaves.

Before Omit, we worked on Telos, an app where people write down the most personal things about themselves: what they want to change, what they are struggling with, who they are trying to become. To make the product useful, some of that writing had to go to a language model. That is the moment the problem stops being abstract. A private reflection somebody typed at midnight becomes a payload in an API request to a company they have no relationship with, and once it has been sent, no policy written afterwards calls it back.

So we went looking for something that would take the personal details out first, before anything left the machine. What existed either wanted to upload the text to a cloud service in order to find the names in it, which is the original problem with an extra hop, or was a set of libraries you had to assemble and tune yourself. We ended up building that step, and the step turned out to be more interesting than the thing we built it for.

It is also not a niche problem, and not one confined to teams wiring up AI features on purpose. It is what everybody is already doing, all day, by hand.

The [LayerX Enterprise AI and SaaS Data Security Report](https://layerxsecurity.com/blog/ai-is-now-the-1-data-exfiltration-vector-in-the-enterprise-and-nobodys-watching/) puts a number on how ordinary it is: 77 percent of employees paste company data into GenAI prompts like ChatGPT and Copilot, and 40 percent of files uploaded to GenAI tools contain PII or PCI data. The same research found that copy-paste has overtaken file transfer as the leading corporate data-exfiltration vector, as covered by [SC Media](https://www.scworld.com/news/copy-paste-now-exceeds-file-transfer-as-top-corporate-data-exfiltration-vector). File-centric data-loss-prevention tools were built to watch files leave, so a clipboard paste is structurally invisible to them. And it is not only text. Fierce Healthcare and HIPAA Journal reporting suggests roughly 1 in 4 of ChatGPT's 800 million-plus weekly users submits a healthcare-related prompt in a given week, into a consumer product that is not built or contracted to be HIPAA-compliant. Netskope's 2026 threat research puts the average organization at 223 GenAI data-policy violations a month. None of that requires an attacker. It only requires a deadline and a copy shortcut.

Here is the conclusion we kept coming back to: you cannot train, warn, or govern your way out of this at scale. Every policy, every DLP rule, every "please do not paste PII" reminder is a request that a person, on a deadline, with good intentions, has to remember to honor every single time. That is not a control. It is a hope. The only fix that actually holds is structural: make the sensitive data never leave the device in the first place. If nothing goes out, there is nothing for a chatbot, an inbox, or a cloud API to leak, no matter what anyone pastes or forgets to redact.

That is why Omit runs entirely offline. Not offline as a checkbox for a compliance form, offline as the whole architecture. Detection, redaction, transcription, and summarization all happen on the machine in front of you. There is no account to create, no telemetry being collected, and no server on the other end of a network call, because there is no network call. It is not a promise you have to take on faith. Pull the network cable and Omit keeps working exactly the same, because it was never depending on the network to begin with.

Omit is one suite built around that single idea, expressed across four apps. Redact finds and redacts PII in text, email, CSV, Excel, PDF, and scanned images. Voice handles private voice typing and offline transcription with transcript redaction built in. Convert does local file conversion and metadata scrubbing. Meet does bot-free meeting recording, local transcription, diarization, and offline summaries. And Protect, which ships inside Redact instead of as an app of its own, sits between copy and paste in any app or browser, redacting on the way in so a chatbot never sees the raw text at all, with a deliberate, logged override for the moments you do need to paste the real thing. Every app shares one offline engine and one design, so it behaves the same way whether you are redacting a PDF or guarding a clipboard paste.

We also wanted to know, honestly, whether a fully offline engine could actually detect PII as well as a cloud service built for exactly this. So we built our own benchmark and ran it against Google Cloud DLP twice, once using Google's default configuration and once giving Google the exact entity types to look for, across a synthetic corpus that is mostly German and English and covers everything from national IDs to bank routing numbers. Of the 34 entity types we tested, 13 turned out to be ones Google offers no text detector for at all, so a like for like comparison is only possible on the other 21. On those 21, Omit matched or beat Google's default configuration on all 21, and matched or beat Google's best possible configuration on all 21 as well. This is our own harness and our own corpus, scored against Google Cloud DLP v2 predictions frozen on 2026-07-22 and re-measured on our side on 2026-08-14, and it measures our Fast tier, the lighter of our two detection tiers and the one bundled with every install. Every entity type in that corpus is a structured identifier, which is what a pattern-based tier is best at, so the Accuracy tier and a corpus of ordinary prose are measured separately.

Correction, 13 August 2026: this paragraph originally claimed 34 of 34 against Google's defaults and 30 of 34 against its best configuration. Those numbers were overstated, because a scoring bug counted the 13 entity types Google does not offer as Google failures rather than excluding them. The figures above are the corrected ones. The full working, including the entity types we lose, a second way of counting that is less flattering to Google, and one benchmark cell that is invalid because we misconfigured our own harness, is in [part one of our Google Cloud DLP comparison](/blog/how-omit-compares-to-google-cloud-dlp/).

We are not done. There are entity types we are actively improving, and we will keep saying so plainly as that work lands, the same way we are being plain about the benchmark above. What we will not do is compromise on the offline part. That is the whole point.

Omit Redact is available now, in beta, for Windows. Voice, Convert and Meet are coming, along with a tray launcher that pulls them together. If you want to know the moment the rest ship, reach us at [sales@omitsys.com](mailto:sales@omitsys.com) and we will let you know.