# FAQ ## What is data loss prevention for AI and how does Barndoor protect sensitive data sent to LLMs? > **Summary:** DLP for AI inspects what goes into and comes out of models and tools. With its runtime enabled, Barndoor's native DLP does this inline, so policies can act on sensitive data before it reaches a model or MCP server. In Barndoor, data loss prevention (DLP) for AI means inspecting what flows to and from models and MCP tools, and acting on sensitive data before it reaches them. Barndoor includes native DLP in the AI gateway. While the runtime is enabled, every prompt, LLM response, and MCP tool call, input and output, passes through Barndoor's inspection layer, so the policies you configure can act on sensitive data before it reaches a model or MCP server. A policy chooses what to detect (built-in profiles such as Sensitive Identifiers, Names & Locations, Secrets, Prompt Injection, or your own custom patterns), where to enforce it, and what to do: Block, Redact, Mask, or Tokenize to enforce, or Alert Only or Bypass, which pass the payload through. Policies can be scoped to groups or roles, and you can test a policy in dry run before enforcing it. Detections are logged in Detection Activity, with the detection type, action taken, runtime stage, timestamp, and confidence score, and every action feeds a full audit trail that can be streamed to your SIEM. --- **Sources:** - [Data Control Center overview](https://docs.barndoor.ai/how-tos/data-control-center/overview) - [Protection Profiles](https://docs.barndoor.ai/how-tos/data-control-center/protection-profiles) - [Barndoor home page](https://barndoor.ai)