Protected Handoff

Use Protected Handoff when your company works in a vendor chat (Claude, ChatGPT, Gemini or Copilot) that VeriPrompt cannot sit in front of. You protect the prompt and its files in VeriPrompt, drag the result into the chat, and paste the answer back into VeriPrompt to see the real names again.

Open it from the sidebar: Shield → Protected handoff (/shield/handoff). It needs a plan that includes Shield data protection; otherwise the page tells you to ask your company admin.

Testing a library prompt? In Studio, a prompt version can build these files for you, one per test case, with the test values filled and protected: see Test a Prompt in a Chat.

What happens to your data

• Personal data that Shield finds is swapped for stand-ins before anything leaves VeriPrompt. A stand-in looks real but carries a short code, for example Anna Schmidt → Jon Doe-665gf1, anna@acme.de → jon.doe-665gf1@example.com, 12.03.2026 → 14.05.2026-ab12cd.
• The same value keeps the same stand-in across your handoffs, so a document you saved in the chat's library still matches later answers. Only when an admin gives your stand-ins a fresh start (New stand-ins for a scope) do new handoffs get new ones; the old ones keep restoring until they expire.
• Only you can swap stand-ins back. Colleagues and company admins cannot restore your handoffs.
• The prompt travels inside protective instructions: the assistant treats attachments as data, not as orders, starts its answer with a one-line security check, and answers both in the chat and as a Markdown file.
• Shield cannot catch everything. What you type into the chat yourself is still yours to judge.

What happens to PDFs

A PDF is turned into clean Markdown text before it is protected: headings, lists, paragraphs and tables survive; everything a reader cannot see, or that could act on its own, does not.

In the PDF	What travels	What you see on the tile
Hidden text (invisible, white, tiny or off the page)	[Hidden text removed]	⚠ Hidden text was removed…
A page that is only a scan	[Page N has no text layer…]	⚠ Left out because it has no text layer (a scan): page N.
A scan with an OCR text layer	the OCR text, protected, under [Scanned page: this text comes from its OCR layer…]	⚠ Page N is a scan: its text comes from the OCR layer…
Pictures	[Image removed], or [Image: attachment-1-image-1.jpg] and a thumbnail when your admin allows thumbnails	N images removed. · ⚠ N pictures travel as thumbnails…
Links, form fields, embedded files, scripts	nothing	…were not carried over.
Author, title and other properties	nothing	—

Hidden text matters because it is where instructions aimed at an AI model ("ignore your rules…") hide. A PDF that is only scans has no text to protect and is refused; export it with text, or paste the text.

Scans that went through OCR are different: the scanner software laid the recognised text, invisibly, over the picture of the page. Shield keeps that text (it is what the page says) and protects it like any other text, but it cannot compare it with the picture. If the OCR misread a name, Shield may miss it, so read the attachment before you carry it over. Example: a scanned invoice for Anna Schmidt travels as Invoice for Jon Doe-665gf1, and the tile warns Page 1 is a scan…. Invisible text on an ordinary, typed page is still removed: that is where hidden instructions live.

Each tile shows which of your files it came from ("Attachment · from Contract.pdf"). That name stays on your screen: the files you carry into the chat are called attachment-1.docx, attachment-2.md, and so on, always numbered, because a file name can itself contain personal data.

What happens to Word and Excel files

A .docx or .xlsx comes back as a .docx or .xlsx: the same layout, fonts and tables, with each personal value swapped for its stand-in where it was. Shield reads the whole file, not only the body: headers, footers, footnotes, text boxes and every sheet, so a name in a letterhead is protected too.

In the file	What travels	What you see on the tile
Hidden text (Word's "hidden" font, also through a style)	nothing	⚠ Hidden text was removed…
Links (e-mail, web)	kept, pointing to the stand-in	—
Comments and tracked changes	nothing; insertions are kept as normal text, deleted text never travels	Comments and tracked changes were removed…
Formulas (Excel)	their last computed values	N formulas were replaced by their values.
Formulas with no saved value (a file never opened in Excel)	an empty cell	⚠ …had no saved value and arrive empty. Open and save the file in Excel once.
Title rows above a table's header row (Excel)	nothing: Shield reads a sheet from its header row down	—
Hidden sheets, rows, columns (Excel)	made visible	Hidden sheets, rows or columns were made visible…
Pictures	nothing, or [Image: attachment-1-image-1.jpg] and a thumbnail when your admin allows thumbnails (Word only)	N images removed. · ⚠ N pictures travel as thumbnails…
Charts, SmartArt, embedded objects, macros	nothing	N images removed. · …were not carried over.
Author, company, title and other properties	nothing	—

Example: Vertrag Anna Schmidt.docx has a footer Confidential for Anna Schmidt and a tracked deletion 01.01.2026 by Peter Meier. It travels as attachment-1.docx with the footer Confidential for Jon Doe-665gf1, and the deleted text is not in the file at all.

If Shield cannot swap a value inside the file without changing it (rare: a value split by a tab or a field), the file goes as Markdown text instead (attachment-1.md) and the tile says Sent as text…. CSV, TXT, Markdown and JSON files keep their format as well (attachment-1.csv and so on).

Pictures (when your admin allows thumbnails)

By default every picture inside a PDF or Word file is removed and counted: Shield protects text, and it cannot see what a picture shows. A company admin can switch this to thumbnails when pictures matter to the task (a site photo, a chart, a diagram):

• Each picture travels as its own file next to its attachment, attachment-1-image-1.jpg, attachment-1-image-2.png and so on, and the protected text says [Image: attachment-1-image-1.jpg] where the picture was, so the AI model knows which picture belongs where.
• A thumbnail is a new image made from the picture's pixels: at most 512 px on its longest side and 300 KB, JPEG (PNG when the picture has transparency). Camera data (EXIF, GPS position, author), colour profiles, comments and anything hidden in or after the image data are gone.
• What the picture shows is not checked. A name on a badge, an address on a letter in a photo or an instruction written into a picture reaches the chat as it is. That is why the review lists every thumbnail with a preview and a warning, and you decide per handoff: Leave out takes a picture out of the bundle (the zip and the file count follow), Put back returns it.
• Never sent as thumbnails: a page that is only a scan (the picture is the page's unchecked content), pictures on an OCR page, icons smaller than 24 px, pictures drawn off the page, and pictures in Excel files. They are removed and counted, as before. At most 20 thumbnails travel per handoff; a picture shown several times (a logo in every header) travels once.
• The prompt file tells the AI model that up to that many pictures may follow, and that a picture named in the text but not attached was left out on purpose, so leaving one out never confuses it.

Example: Site report.docx has a photo with GPS data, a logo in the header and a small icon. With thumbnails allowed it travels as attachment-1.docx ([Image: attachment-1-image-1.jpg] where the photo was) plus attachment-1-image-1.jpg (512 × 384, no GPS) and attachment-1-image-2.png (the logo); the icon is removed. You leave the logo out, and the bundle holds the prompt, the document and the photo.

For admins: Shield → Settings → Pictures in the Protected Handoff, choose Send as thumbnails and Save. The card spells out the risk before you save, the change is recorded in the audit log, and Remove switches it back.

Example: summarise a contract in Claude

1. Drop or paste. Drag Vertrag Anna Schmidt.docx onto the card (or click Add files) and write the prompt: "Fasse den Vertrag für Anna Schmidt zusammen und antworte an anna@acme.de." You can also paste a file or text anywhere on the page.
2. Pick the chat. Under Pasting into, choose Claude. The page remembers your choice.
3. Protect. Click Protect. After a moment the card shows:
   • What we protected: for example People 1 · Emails 1 · Dates 1.
   • Your bundle: prompt-….md (the prompt with its protective instructions) and attachment-1.docx (the contract with stand-ins, still a Word file). Original file names are never sent, because a file name can itself contain personal data.
4. Carry it over. Open Claude in a new chat and drop in all files, the prompt file first. Use Download all (.zip), download single files, or drag a tile straight into the chat where your browser allows it. For a prompt without files, Copy prompt and paste it.
5. Come back. Copy Claude's answer, including its first line (VERIPROMPT-CHECK: CLEAN), then on the handoff page click Paste answer and Restore. You can also drop the returned .md file on the Restore an answer bar, or paste straight onto the bar with Ctrl/Cmd+V.
6. Use the result. The restored answer shows the real names again. Copy or Download it.

Reading the restore result

You see	It means	What to do
The assistant reported no hidden instructions.	The answer starts with a clean security check.	Use the answer.
The assistant withheld its answer: …	The assistant found instructions hidden in a file and refused.	Check the file; do not re-send it unprotected.
The answer has no security check line.	The first line is missing, so the assistant may have ignored the instructions.	Read the answer with care.
No stand-ins of yours were found.	The text holds none of your stand-ins: another account's answer, or the chat rewrote them.	Ask the chat to keep the stand-ins exactly as written.
… belong to an expired handoff	The handoff expired, so those values can no longer be restored.	Protect the source again.
… codes look like stand-ins but match nothing	Probably a stand-in the chat changed, or one from a deleted handoff.	Compare with the original.

What is marked in the answer

The restored answer marks every place Shield changed something, so you can check the result at a glance:

• Green: a real value put back, for example Anna Schmidt. Point at it to see what it is (Restored: People).
• Amber: a stand-in that stayed, because its handoff expired or was deleted (Not restored…).
• Amber, dotted: a code that looks like a stand-in but matches none of yours; the chat probably changed it (Compare with the original).

Example: you restore "Summary for Jon Doe-665gf1, signed on 14.05.2026-ab12cd. Contact Max Roe-7k2p9x.". You see Summary for Anna Schmidt, signed on 12.03.2026, both green, and Max Roe-7k2p9x dotted amber: that stand-in is not one of yours, or the chat changed a letter.

Mark changes switches the marks off. Copy and Download always give the plain text, without marks.

How long a handoff lives

Every handoff has one of three time limits. Your company admin sets the numbers.

Time limit	How long	Who chooses it
Expires when unused (the default)	7 days after you create it or last restore from it; each restore extends it	your admin sets the days (1 to 30)
Keep	until you delete it, but never longer than your company's maximum after creation (1 year unless your admin changed it)	you: tick Keep it when you protect, or Keep in Recent handoffs later
No limit	no maximum	only where your admin allows it, with a recorded reason

Keeping never makes a handoff end sooner: if it is already close to the maximum and would expire earlier when kept than it does now, Keep is refused and the handoff stays as it was.

Use Keep for files you save in a chat library (a Claude project, a ChatGPT library) and come back to weeks later: an expired handoff turns that document's stand-ins into codes nobody can swap back.

• Recent handoffs at the bottom of the page lists your live handoffs: age, size, and how long each lives (Expires in 5 days, Kept until 05/10/2027, No time limit). Keep, Let it expire and (where allowed) No limit change it.
• Delete now destroys the handoff's original values immediately, also for files you already saved in a chat library. A value that also appears in another of your live handoffs can still be restored from that one.

Example: you protect a contract for a Claude project with Keep it ticked. Three months later you drop an answer from that project into Restore, and Jon Doe-665gf1 is swapped back to Anna Schmidt. A handoff that only expired when unused would be gone by then.

For admins: time limits, mappings per person, deleting

Shield → Settings → Manage protected handoffs (company admins):

• Time limits: the default days (1 to 30), the maximum for kept handoffs (30 to 1825 days), and whether No limit is allowed (a reason of 10 to 500 characters is required and recorded). A shorter limit applies to existing handoffs at once; a longer one only to new restores and keeps.
• Per person: how many handoffs, values and files each person holds, the oldest one and the next expiry. Numbers and dates only: you can delete handoffs, but nobody except their creator can read or restore them, admins included.
• Delete: one handoff, all of a person's, or everything older than N days. Every change and every delete is in the audit log.
• People who left (deactivated or deleted accounts): their handoffs are deleted 30 days after they left. Hold keeps them up to a year past that date, with a reason (for example an open audit); while it runs, they do not expire either. It never makes them readable to anyone else. They are never transferred.
• Backups: deleting removes the key from the live database at once. Copies in database backups remain until those backups expire (30 days), and are gone for good after that.

New stand-ins for a scope

Every person, and every project used in a handoff, has its own scope: the stand-ins in it are made from a secret of their own. A company admin can give a scope a fresh start, so that new handoffs in it get new stand-ins. Do this when you suspect that stand-ins together with their real values got out, for example when someone left with copies of old chats and their restored answers.

Shield → Settings → Manage protected handoffs → Stand-in keys lists one row per scope: the person's email or the project's name, the generation (how many fresh starts, plus one), the key it uses, when it was last renewed, and two counts: live stand-ins, and older ones that still restore. Secrets, values and stand-ins are never shown.

Example: Max Roe left the company last week, and you are not sure where his chat exports went.

1. Find the row max.roe@acme.example (Generation 1 · key k1, 23 live stand-ins · 0 older ones still restoring).
2. Click New stand-ins. The dialog says what will happen: New handoffs in max.roe@acme.example get new stand-ins. Stand-ins already handed out keep working until they expire. Confirm.
3. The row now shows Generation 2, Last renewed on … and 0 live stand-ins · 23 older ones still restoring. The change is in the audit log.

Be clear about what this does and does not do: old stand-ins keep working until they expire, and a rotation does not recall what was already shared. Anything already in a vendor chat stays there. A fresh start only makes sure that new handoffs no longer use the same stand-ins. To end the old ones sooner, delete the person's handoffs on the same page (Delete all in their row under Per person): their stand-ins can then never be restored again.

A new stand-in never equals one of the same person's older stand-ins that still restore, so a restore can never swap in the wrong value. In the rare case that two of your handoffs are created at the same moment and would share a stand-in, the second one is refused with "try again" and nothing is created.

If a key may have leaked

The stand-ins are made with keys held by the protection service; your operator manages them. If one key's secret may have leaked, all scopes on it need a fresh start, under a different key:

1. Your operator adds a new key, makes it active and deploys the protection service. The Stand-in keys card then shows Active key: k2.
2. You pick the old key under Renew every scope on one key (for example k1), click Rotate every scope on k1 and confirm. Every scope of your company whose current stand-ins use k1 gets a new generation under k2. While k1 is still the active key, this is refused: new stand-ins would land on it again.
3. Wait until the stand-ins already handed out under k1 expire, or delete those handoffs.
4. Your operator retires k1 once npm run check:marked-key-retirement -- --kid k1 says it can be retired (no scope still makes stand-ins with it, and none of its stand-ins is live).

The API for both actions is in Shield Protected Handoff API → Stand-in keys.

Your restore key

This section is for company admins.

What it is for. If your company ever leaves VeriPrompt, its stand-in mappings (which stand-in belongs to which real value) and the per-scope secrets that make your stand-ins are kept for a while, then sealed into an archive that only your restore key opens. If you come back after that date, you import the archive with the key, and your old documents with stand-ins match new handoffs again. The archive date and the import arrive with a later release; until then the key is not used for anything, but creating it now means it is ready.

Be clear about one thing: VeriPrompt never stores your restore key, and nobody can recover it, VeriPrompt included. We keep only a public half that can seal an archive but not open it, and a check that tells whether you typed the right key. If the key is lost, the archive and every original value in it are lost for good.

The key is only needed in that one case: your company left and comes back after the archive date. While your company uses VeriPrompt, nothing changes: handoffs keep working without it.

Create it

1. Open Shield → Settings → Manage protected handoffs and scroll to Restore key. It says Your company has no restore key yet.
2. Click Create restore key. The dialog tells you the key is shown once; confirm with Create and show once.
3. The key appears, for example vprk1-rk3f9a0c2e-7QKD-M2XA-9WTB-H4RC-PE6N-1YVJ-ZS8F-K3MQ-D7XB-A2WN-T9HC-5RVE-Q4KG (made up; yours is different). rk3f9a0c2e is the key's name: it is not secret and opens nothing.

Store it safely

While the key is on screen, Copy or Download it (the file is restore-key-<keyId>.txt). Then:

• Put it in your company's password manager or vault, where more than one trusted person can reach it. A key that only one person knows is lost when that person leaves.
• Do not keep it in VeriPrompt, in a chat, or in an e-mail.
• Delete the downloaded file once the key is in the vault.

Click I have saved it. The key disappears from the page and cannot be shown again.

Confirm it

The page now asks for the last 8 characters of the key, so you prove it was saved and not just seen. Take them from your vault, not from memory: in the example above that is 5RVE-Q4KG. Dashes, spaces and upper or lower case do not matter. Click Confirm: the section shows Confirmed and the date.

If you leave the page before confirming, the section shows Not confirmed the next time with the same field. After five wrong attempts within 15 minutes, confirming is paused for 15 minutes. If the key was not saved, there is no way to show it again: replace it.

Replace it

Use Replace key when the key was lost, or when someone who should no longer have it had access. The dialog explains the consequence, then the new key is shown once, and you store and confirm it as above. The old key stops being the current one. Anything already sealed with the old key still needs the old key, so if such an archive exists, keep the old key too.

Creating, replacing and confirming are recorded in the audit log, with the key's name only. The API is in Shield Protected Handoff API → Restore key.

Limits

• Files: TXT, MD, PDF, DOCX, CSV, XLSX, JSON. Up to 10 files, 13 MB in total. A larger set goes into a second handoff. The prompt can be up to 200,000 characters.
• PDFs without any text layer (scans) are refused with a hint, never passed on unprotected; a single scanned page inside an otherwise readable PDF is left out and named on the tile.
• .docx and .xlsx keep their format; PDFs travel as Markdown. PowerPoint files are not accepted yet.
• Pictures are removed unless your admin allows thumbnails; then at most 20 per handoff, 512 px each. Image files on their own (.png, .jpg) are not accepted.
• Restoring counts as a Shield request. On the free tier that is 10 per month.
• At most 200,000 live stand-ins per person and company. Beyond that, protecting stops with You hold too many live stand-ins for a new handoff: delete older handoffs or let them expire.

When protecting stops with a key message

Stand-ins stay the same across your handoffs, so a contract you protected last month still matches the answer you get today. To keep that promise, the page refuses to protect rather than hand out stand-ins that would not match your earlier ones. In both cases nothing is created.

Message	What it means	What to do
The protection service's stand-in key has changed, so new stand-ins would not match your earlier ones.	The key the protection service uses is not the one your earlier handoffs were made with.	Ask your administrator. Restoring earlier handoffs keeps working.
The protection service does not have the stand-in key this scope uses.	The protection service is running without the key, for example during an update.	Try again in a few minutes; if it stays, ask your administrator.

The API returns the same cases as SURROGATE_KEY_CHANGED (409) and SURROGATE_KEY_UNAVAILABLE (503); see the Shield Protected Handoff API.

Related docs

• Shield
• PII Sanitization
• Test a Prompt in a Chat: Studio test cases as protected chat files
• Shield Protected Handoff API: protect and restore from your own scripts with a Shield API key