Why the Edge decrypts TLS

Almost all web traffic today is encrypted with TLS. While it stays encrypted, the Edge can see the name of the destination and nothing of what is being sent. Lantern DSSE decrypts TLS so that it can check the content.

Keeping sensitive data from leaving (DLP)

Uploads to outside services are inspected before they are sent on. It finds:

• Japanese individual (My Number) and corporate numbers, credit card numbers, API keys, email addresses and phone numbers
• keywords and patterns that each organisation defines
• values registered in advance, such as customer or employee numbers

Office files such as Word and Excel documents, and PDFs, have their text extracted and inspected.

Each policy chooses what happens on a match: record it, warn, block the upload, or require the user to verify their identity.

When one device sets off detections repeatedly in a short time, the policy can also raise that device's risk — for example, two or more kinds of sensitive data sent again and again to the same destination within five minutes. Risk-based access rules decide what happens to a device whose risk has gone up.

Company accounts only (tenant restriction)

For Google Workspace, Microsoft 365, ChatGPT and Claude, sign-in can be limited to the accounts the company allows. The Edge adds the allowed accounts to the request, and the service enforces the restriction. That, too, can only be done on decrypted traffic.

What comes next

More features will be built on decrypted traffic.

• Analysing AI responses. DLP today inspects what is sent out. We intend to analyse what generative AI services send back as well — for example, whether a response contains sensitive data, or carries instructions meant to mislead an AI agent (prompt injection).
• DSPM. We also plan to build in a view of where an organisation's sensitive data is and where it is being sent.

Each of these depends on being able to decrypt the traffic.

Where it is decrypted, and the code that does it, stay with the operator

Decryption turns the content back into plain text. That is why it matters where it happens and which code does it. In Lantern DSSE the Edge that decrypts runs on servers the operator provides (data sovereignty), and the code that decrypts is published under Apache-2.0 for anyone to read.

After decrypting, the Edge opens its own connection to the destination server and checks that server's certificate before forwarding.

The operator decides what is decrypted

Each Internet Access rule chooses whether to decrypt. A new organisation starts with a rule that allows and decrypts. Apps that pin their certificates, and sign-in pages that break when decrypted, can be excluded from decryption.