Scenario and data are illustrative (fictitious CPF, card, and password). What is real and running in production: a DLP proxy that, when regex misses, calls a local LLM (Ollama) to classify sensitivity and blocks with HTTP 403 any prompt carrying CPF/CNPJ, card numbers, passwords, or keys headed for public AIs — audited, on-premise, LGPD by design.