Your SaaS Copilot Is Leaking Data: Build an Exfiltration Kill‑Switch Now

One search box to find everything you know — and one query away from leaking everything you shouldn’t. The recent Atlassian Rovo exfiltration scare was not a weird edge case; it’s the logical outcome of gluing large language models to cross‑SaaS connectors and calling it “productivity.” If you run a startup or a scale‑up, you already have 10–25 AI overlays in play — Copilot this, Q&A that — many enabled by well‑meaning business admins. Your existing DLP and “least privilege” assumptions don’t apply once a vendor indexer vacuums your org and a model answers across silos.

This post gives you a blunt, operational playbook: treat SaaS copilots like unmanaged integrations capable of cross‑boundary data flow. Build a kill‑switch across identity, network, and content layers, and drill it quarterly. If you can’t stop a copilot from reading a sensitive Confluence space in under 15 minutes, you don’t control it — it controls you.

What changed: copilots collapsed your trust boundaries

Traditional controls assumed three separations:

• Application boundaries: Jira isn’t Confluence, Drive isn’t GitHub.
• User scopes: Alice can read Team A’s projects, not Team B’s.
• Data locality: Content stays in the app where it was created.

Cross‑SaaS copilots erase all three:

• Connectors and vendor‑run indexers crawl multiple silos, often with service accounts that see more than any human.
• RAG blends results at answer time, so “one helpful response” might cite an internal post‑mortem Alice was never meant to see.
• Caches, embeddings, and traces persist outside your tenant, often with vague retention and deletion semantics.

That’s why an AI overlay can leak even when your base apps are properly permissioned. The failure mode isn’t a single ACL; it’s ungoverned aggregation.

A simple risk taxonomy for copilots

Classify what you already have before you design controls:

• Tier 1 — In‑App Helpers (Lower Risk): AI features bound to a single product and its permissions (e.g., “summarize this Jira issue”).
• Tier 2 — Cross‑Silo Search (Medium/High): Overlays that index multiple products (Confluence, Drive, Slack, GitHub) and answer across them. This is where RAG + connectors lives.
• Tier 3 — Actioning Agents (High/Critical): Systems that read broadly and also create/modify resources (open tickets, push code, update CRM). These combine exfiltration risk with destructive writes.

Your default posture should be to assume Tier 2/3 copilots are present unless proven otherwise. In 2026, it’s rare to find fewer than 6–12 connectors enabled across a 200–500 person engineering org.

The CTO control model: request plane, data plane, kill‑switch

You need controls in three places:

• Request plane: Who can invoke the copilot, what tokens it holds, and what scopes it can request on the fly.
• Data plane: What the copilot (and its vendor) can actually index, cache, embed, and retrieve; how long data lives, and where.
• Kill‑switch: A time‑boxed, rehearsed method to sever access in minutes via identity revocation, network egress blocks, and vendor shutdown.

Step 1 — Inventory what you really have (2 weeks)

You can’t govern ghosts. Start with telemetry you already own:

• DNS and proxy logs: Pull the last 30–90 days. Expect to see calls to api.openai.com, *.anthropic.com, gemini.googleapis.com, bedrock.*.amazonaws.com, and a long tail of vendor LLM endpoints.
• OAuth grants: Export enterprise app consent logs from your IdP (Okta/Azure AD). Sort by scopes like read:all, files:read, wiki:read, repo:read, audit:read.
• Connector configs: In Jira/Confluence, Slack, Google Workspace, GitHub, and Drive, enumerate marketplace apps with “index,” “assist,” or “search” in their descriptions. Document whether they use a service account or user‑on‑behalf‑of tokens.
• Vendor admin consoles: For copilots you knowingly purchased, capture data residency, retention, and connector scope settings. If you can’t find them, that’s its own finding.

Score each copilot by blast radius: number of connectors × max scope × retention. Anything with service accounts and cross‑silo indexing is red.

Step 2 — Fix identity first: scopes, JIT, and OBO (2–3 weeks)

Identity mistakes are why copilots see more than your admins think.

• Kill service accounts with global read. Replace with user‑on‑behalf‑of (OBO) tokens tied to SCIM‑managed groups. If the vendor can’t do OBO, they don’t get broad scopes.
• Just‑in‑time (JIT) expansion for pilots. Create temporary groups (e.g., “Copilot‑Confluence‑Pilot”) with 7–14 day expiry. Tie vendor access to these groups; revoke by default.
• Proof‑of‑possession or DPoP tokens where supported. Bind tokens to the client to reduce replay.
• Per‑connector consent. No “read everything in Drive” scopes. Use drive.file or per‑folder permissions. For Confluence, bind to spaces; for GitHub, to specific orgs/repos.
• Rotate grants quarterly. Expire consents unless explicitly re‑approved. Automate via IdP policies.

Expect a 10–20% hit on “wow factor” demos when you remove global scopes. That’s an acceptable trade for not leaking your board minutes.

Step 3 — Put the network back in charge (2 weeks)

You won’t decrypt every TLS stream, but you can control where AI traffic goes.

• Egress allowlists for AI destinations. Use Cloudflare Gateway, Zscaler, or your existing secure web gateway to allow only vetted LLM endpoints and known copilot vendor domains. Block wildcard access to new AI endpoints by default.
• SNI and IP pinning for vendor traffic. Where vendors publish IP ranges, restrict accordingly. This won’t stop all SaaS pivots, but it reduces the attack surface.
• Split‑tunnel policy. Force corporate devices through the gateway; detect and block personal account logins to the same copilot domains from corp IPs.
• Rate and size caps. Exfiltration loves bulk. Cap request rates and response sizes for AI endpoints to sane limits; alert on spikes.

Network policy is your fastest kill‑switch: one deny rule beats hunting 12 separate admin consoles.

Step 4 — Content hygiene at the edge (3–4 weeks, in parallel)

If you must index, sanitize first. Don’t trust vendor‑side redactors to understand your data.

• Pre‑connector redaction proxy. Insert a lightweight service between the vendor crawler and your sources using available webhook/fetch hooks. Deterministically redact high‑risk classes: API keys, secrets, SSNs, bank account numbers, customer emails, health terms you know trigger regulatory scope.
• Structured + model redaction. Use simple regex and checksum validators for obvious formats; augment with a small local model to classify sensitive paragraphs (customer names, roadmap features). Force redaction to be deterministic and reproducible; log before/after hashes.
• Tenant‑side blocklists. Maintain a denylist of spaces, drives, repos, and Slack channels that must never be indexed. Default‑deny for anything labeled “legal,” “exec,” “finance,” or “security.”
• TTL on embeddings and caches. Require vendors to honor 7–30 day retention on embeddings and conversation logs. If they can’t configure it, make it a contractual addendum or scope them down.

Yes, redaction degrades answer quality. That’s the point. You want safe answers by default, deep answers by explicit request.

Step 5 — Retrieval audit, honeytokens, and drills (2–3 weeks)

Assume something will slip. You need to detect and stop it fast.

• Retrieval logs. For every answer, log the source URIs (space/page/file/repo) and the calling user. Store 90 days. If a vendor can’t expose this, they’re not enterprise‑ready.
• Honeytokens & canaries. Plant a unique, non‑public secret string in an excluded space/repo. Alert if it ever appears in answers or leaves your network via egress logs.
• Quarterly kill‑switch drills. Simulate a leak: seed a detection, fire the network block, revoke IdP consent, and request vendor crawler pause. Measure MTTR to containment (<15 minutes) and full eradication (<24 hours).

Optional but powerful: wrap vendors in your own broker

If you’re large enough to justify it, insert a broker service in front of third‑party copilots:

• OAuth wrapper. Have vendors authenticate to your broker, which then exchanges short‑lived OBO tokens for each source. Centralize consent, rotation, and revocation.
• Policy as code. Encode which groups can query which connectors, at what time, and from which devices. Deny by default; log all decisions.
• Inline redaction and watermarking. Apply your sanitization centrally and embed invisible watermarks to trace leaks.

This adds a week or two to implementation but pays back in control and auditability.

What to demand from vendors

Don’t accept “trust us, we don’t train on your data” as a security posture. Your RFP/renewal checklist should include:

• OBO support and per‑connector scoping. No global service accounts.
• Configurable data residency and retention (7–30 day max) for embeddings, caches, and logs.
• Complete retrieval traces per answer (URIs, timestamps, user identity, model version).
• Pause/resume indexing via API and hard delete guarantees with evidence.
• SOC 2 Type II with scope explicitly covering the AI indexing and retrieval pipeline, not just the web app.
• Prompt injection hardening on crawlers and retrieval filters; disclosure of mitigations.
• Incident SLA that treats unauthorized retrieval as a security incident with notification obligations.

The 30‑60‑90 day exfiltration kill‑switch plan

Days 0–30: Freeze, find, and scope down

• Issue a temporary freeze on new copilot/connector installs. Socialize why.
• Complete the inventory: DNS/proxy egress, IdP grants, marketplace apps. Classify into Tiers 1–3.
• Rip out service accounts with global read. Convert to OBO or cut scope to pilot groups with 14‑day expiry.
• Turn on network allowlisting for AI endpoints. Start with block‑all, allow the 3–5 destinations you explicitly trust.
• Establish a denylist of spaces/repos/drives that must never be indexed.
• Document the vendor configuration baseline: residency, retention, audit, pause controls.

Days 31–60: Put controls in the path

• Deploy or harden your secure web gateway (Cloudflare Gateway, Zscaler, etc.) with SNI/IP pinning for AI and copilot domains. Implement rate/size caps.
• Stand up a redaction proxy in front of your highest‑risk sources (Confluence/Drive/Slack). Start with deterministic secrets/PII redaction; add a small classifier for sensitive paragraphs.
• Integrate retrieval logging where vendors support it; pipe to your SIEM. If not supported, require it in contract before renewal.
• Seed honeytokens and canaries; verify you can detect them at egress.
• Negotiate contract addenda for retention limits, retrieval traces, and incident SLAs.

Days 61–90: Drill and automate

• Run a full kill‑switch drill: trigger detection, block egress, revoke consents, pause vendor crawlers. Capture MTTR and gaps.
• Automate policy as code in your IdP and gateway: groups, expiries, allowlists, deny rules, and drift detection.
• Publish a Copilot Security Standard internally: tiers, approved vendors, required configs, review cadence, and emergency playbook.
• Set up a quarterly review of retrieval logs to catch scope creep and shadow installs.

Trade‑offs you should stare at

• Answer quality vs. safety. Redaction and scoped connectors will make answers less magical. Your goal is predictable, not magical.
• Friction vs. shadow IT. If you clamp too hard, teams will route via personal accounts. Combine controls with an on‑ramp for approved pilots.
• Vendor lock‑in vs. control. Wrapping copilots through your broker yields control but makes migration harder. Keep your policy and redaction logic portable.
• Cost vs. visibility. Logging retrievals and running a gateway isn’t free. Budget it like cyber insurance; you’ll be grateful the first time a canary trips.

Why now, not after the next headline

In 2026, AI overlays are the fastest path from “internal” to “public.” Most organizations discover they’ve got a dozen such paths only after a leak. The infrastructure you need — identity scopes, egress allowlists, pre‑index redaction, retrieval logging — is boring, proven tech. You can stand up the core kill‑switch in 4–6 weeks with a small, senior team. We’ve seen that a 3–5 engineer nearshore pod can do it 20–30% cheaper than scrambling post‑incident with consultants and PR breathing down your neck.

Don’t wait for the next Rovo‑style story to play out inside your tenant. Inventory, contain, and be able to pull the plug — on your terms.

Key Takeaways

• Cross‑SaaS copilots collapse app and permission boundaries; treat them as high‑risk integrations by default.
• Build controls in three layers: request plane (OBO tokens, JIT scopes), data plane (pre‑index redaction, deny lists, retention limits), and network (egress allowlists).
• Demand retrieval traces, OBO support, and retention configurability from vendors; make them contractual.
• Stand up a deterministic redaction proxy for sensitive sources; accept slightly worse answers for far better safety.
• Instrument retrieval logs, plant honeytokens, and drill a 15‑minute kill‑switch quarterly.
• A small senior team can ship this in 4–6 weeks; it’s cheaper than cleaning up a leak.