Get real work done with AI. Keep the sensitive document out.

A local checkpoint between the document and the chatbot

AI Airlock is a Mac app from NBJ Media. Version 0.2.2 is free during early release and proprietary source-available: its code is public, but it is not an open-source release.

The app creates a sanitized, verified working copy before you paste anything into ChatGPT, Claude, or another AI tool. The original is never modified.

The scan stays on the Mac

Processing is 100% on-device inside a network-blocked window. The Gemma 3 1B model ships inside the roughly 880 MB download. There is no account and no telemetry.

AI Airlock requires Apple Silicon (M1 or newer) and macOS 13 or newer.

Download, check the file, and drag it in

Download the v0.2.2 DMG from the releases page. Before you open it, confirm you got the real file: the download page lists a SHA-256 checksum, and in Terminal `shasum -a 256 ~/Downloads/AI-Airlock-0.2.2-arm64.dmg` should print the same value. That check is what makes the next step safe. Then open the DMG and drag AI Airlock into Applications.

The checksum is the real security control here — verifying it matters more than the Apple signature, which this early build does not yet carry.

Get past the “can’t be opened” warning

The first time you open AI Airlock, macOS refuses and shows a warning — “Apple could not verify…”, “cannot be opened because the developer cannot be verified,” or on some Macs “damaged and can’t be opened.” All three mean the same thing: the app isn’t notarized yet. Point-and-click path: open the app once and let it get blocked, then go to System Settings → Privacy & Security, scroll down to the AI Airlock message, click Open Anyway, and confirm. (The Open Anyway button only appears after that first blocked attempt, and recent macOS removed the old right-click → Open shortcut, so this is the way.)

If Open Anyway is greyed out, or you got the “damaged” message, use the fallback below instead — it is the reliable fix.

Reliable fallback: clear the download quarantine flag

When the point-and-click path won’t cooperate, run this one line in Terminal. It removes the “downloaded from the internet” quarantine tag that Gatekeeper is reacting to, then the app opens normally. This is safe here specifically because you verified the checksum, the source is public, and AI Airlock never touches the network — so the quarantine flag isn’t protecting you from anything you haven’t already checked yourself.

<prompt>
  <task>
    xattr -dr com.apple.quarantine "/Applications/AI Airlock.app"
  </task>
</prompt>

Only run this against an app whose checksum you verified in the previous step. Once Apple notarization is added in a later build, none of this will be necessary.

Or hand the whole thing to an agent

If you’d rather not touch Terminal yourself, paste this into an agent that can operate your Mac. It makes the checksum a hard stop, installs the app in /Applications, clears the quarantine flag for you, and confirms the app opens before reporting success — the entire install and the signing workaround in one step.

<task>
Install AI Airlock on my Mac (Apple Silicon only).
</task>

<requirements>
1. Download https://github.com/NateBJones-Projects/ai-airlock/releases/download/v0.2.2/AI-Airlock-0.2.2-arm64.dmg
2. Verify the SHA-256 equals 5490105df80ae3e31f9f42fa5bf4c0d0152ee14aff9030df68dcea0dd290a65b. Refuse to continue on mismatch.
3. Mount the DMG, copy "AI Airlock.app" into /Applications, then unmount the DMG.
4. This early build is ad-hoc signed. Clear the quarantine flag so it can launch:
   xattr -dr com.apple.quarantine "/Applications/AI Airlock.app"
5. Launch it once to confirm it opens.
</requirements>

<deliverable>
Report done only after the app launches successfully.
</deliverable>

01 — Add the document

Paste text or drop a TXT, Markdown, or text-only DOCX file into the app. The limit is 25 MB or roughly 300,000 characters. You can also add protected terms — client names, codenames, or any other specific words that should never leave the copy.

02 — Scan for hard secrets and sensitive meaning

Deterministic, validated rules find keys, card numbers, Social Security numbers, emails, and phone numbers. The local model separately flags passages whose meaning may be sensitive: strategy, financials, client material, HR, unreleased work, and legal or security content.

03 — Review every finding

Every finding appears with a reason. Hard secrets are locked to Hide. Judgment calls let you choose Hide or Leave visible, with Hide pre-selected. The semantic layer proposes; you make the decision.

04 — Seal the working copy

AI Airlock replaces hidden material with typed placeholders such as [EMAIL_01], then re-opens and re-verifies its own output. If anything marked for removal still leaks through, the app refuses to save.

A successful seal creates a new file and a removal note containing categories and counts only. It shows the original and cleaned filenames with their SHA-256 hashes, and warns when the destination folder looks cloud-synced. The original file is never changed.

Paste this instruction above the CLEANED copy

The placeholder names carry useful structure without exposing the removed text. This snippet tells the assistant to treat them as protected redactions, not missing context it should try to reconstruct.

<context>
The document below is a CLEANED working copy produced before it was shared with this AI tool.
</context>

<requirements>
- Placeholders such as [EMAIL_01] and [CONFIDENTIAL_PASSAGE_REMOVED_01] are deliberate redactions.
- Preserve every placeholder exactly as written.
- Do not guess, reconstruct, infer, rename, expand, or remove anything represented by a placeholder.
- Keep the placeholders intact in any rewritten, summarized, reformatted, or otherwise transformed output.
</requirements>

<document>
Paste the CLEANED copy here.
</document>

Unsupported content stops the run

Encrypted files, macros, images, and embedded objects are blocked with an explanation. They are never silently skipped. PDFs, image-based documents, and spreadsheets are not supported in v0.2.2.

Sanitized does not mean authorized

Every receipt says authorization NOT_ASSESSED. AI Airlock can create and verify a cleaner copy; it cannot decide whether your company, client, or policy permits the work.

What this release cannot promise

AI Airlock is Mac-only and not a compliance product. The semantic layer proposes findings and a human decides what stays visible, so there is no perfect-catch guarantee. Review the findings and the sealed copy like the decision still belongs to you — because it does.

Want the manual version of the same idea?

The sibling guide shows the DIY route with LM Studio and Gemma 4 E2B. AI Airlock is the packaged, verified version of that same local-first document-cleaning idea.