Endpoints overview

Why this path exists

The API covers applications where a component you control can call Salus deliberately. Employee AI use is the opposite case: a chat tool in a browser tab, a desktop AI client, a specialist product whose request path contains nothing you can modify. The endpoint deployment closes that gap, including consumer AI interfaces on company laptops.

How it fits the engine

The device component is a client of the same engine described in this documentation. It calls detect/text and detect/file before content leaves the device and recover/text when the answer returns, under an API key issued for the endpoint fleet, in a tenant of its own. Tokens therefore have the same format, contexts behave the same way, custom rules apply the same way, and every detection run lands in the same audit store and security log as API traffic.

What IT and security teams should expect

• Scope. Protection applies to the AI destinations you govern. Other traffic is not touched.
• Attachments. Documents are protected through the file endpoint, in place. Scanned pages and images are read when the OCR service is enabled in your deployment.
• Review before send. The device component can show the person what was detected before the content leaves, so an incorrect detection can be removed and a missed value marked. Typed text is protected automatically.
• Identity and rollout. Attribution and distribution come from your device management and identity tooling.
• Conservative defaults. Content that cannot be protected is held rather than sent unprotected.

Where to read next

The endpoint deployment guide, with packaging, device policy and the review window, is delivered with the endpoint release. The engine side, keys, tenants, contexts and audit, is fully covered in Integrate and Deployment and operations.