Catch sensitive data before AI does.
PromptSec is an on-device AI DLP browser extension — it catches Aadhaar numbers, PAN, secrets, and prompt-injection attempts before they ever reach ChatGPT, Claude, or Gemini, and the prompt never has to leave the device.
No credit card, no commitment. Or see how it works first.
KYC check failed for Aadhaar 3782 9461 5530 — I'm debugging with key AKIA3ORV7PLQ2XNDBWZE, customer is r.mehta@northbank.in. What's wrong?
pii.aadhaarVerhoeff validblocksecrets.aws_keyAccess key IDblockpii.emailContact detailredact
Nothing was sent. The prompt never left the browser — the control plane recorded the decision and the categories, not the text.
Covers prompts sent to
Your employees already use AI at work. Your security stack cannot see it.
The tools are free, they open in a browser tab, and they need no procurement and no admin approval. Nothing in a traditional stack was built to watch a paragraph of free text typed into a chat window — so most of that traffic is simply invisible.
of enterprise AI use is unsanctioned shadow AI your DLP cannot see
Cyberhaven, 2024
maximum penalty under India's DPDP Act 2023 for a data protection failure
DPDP Act 2023, Schedule
to report a cyber incident to CERT-In — you need the audit trail ready before it happens
CERT-In Directions, 2022
Run PromptSec free for 30 days. See exactly what your team sends to AI.
We’re onboarding a handful of Indian teams at no cost, in exchange for honest feedback. You get real numbers from your own team at the end — not a sales deck.
- Full product, free for 30 days, up to 50 seats — no card, no auto-conversion to paid
- A direct line to the founding team, not a support queue
- A documented count of every leak and shadow-AI tool it caught
- A DPDP-mapped usage record you can keep, whatever you decide
From keystroke to audit trail, without leaving the browser.
Every prompt takes the same four steps. Target latency end to end is under 50ms, which is the whole point — a control people notice is a control people route around.
- 01
Intercept
The extension catches every send — a button click or hitting Enter — on the AI tools it covers, and holds the prompt before it reaches them.
Content script · DOM level
- 02
Detect
The on-device pipeline runs regex and heuristic detectors. Personal data, secrets, injection attempts, source code — each finding gets a confidence score and a reason.
Local · no network call
- 03
Decide
The policy engine checks those findings against your organization's versioned policy. Every matching rule is considered and the most severe outcome applies.
allow · redact · warn · block
- 04
Act and record
Redacted prompts are rewritten in place; blocked ones stop with a reason. Every decision lands in a hash-chained audit trail — the decision and categories, never the prompt text.
Hash-chained audit trail
Every detector on this page is a file you can open.
The detection core is an Apache-2.0 licensed package in our monorepo. Everything below is implemented, tested, and running in the extension right now — and checkable against the source rather than taken on trust.
Personal data
- Aadhaar
Verhoeff checksum-validated
- PAN
Validated against real holder-type codes
- Credit cards
Luhn-checked, so a random 16-digit string won't trip it
- Email, phone, SSN
Context-gated to hold false positives down
Secrets and credentials
- AWS access keys
Key IDs and STS session tokens
- High-entropy secrets
Bearer tokens, API keys, PEM private key blocks
Prompt attacks
- Direct injection
Instruction override and jailbreak phrasing
- Indirect injection
Instructions smuggled inside pasted or retrieved content
- Encoding evasion
Base64, hex, and zero-width character tricks
- Prompt-leak attempts
Requests aimed at extracting a system prompt
Content and code
- Source code
Recognises code pasted into a prompt
- Model responses
Scans what comes back, not just what goes out
Not shipped yet
- On-device ML classifier
Implemented and tested. Switched off until a real model backs it — we would rather ship nothing than a classifier that returns a plausible constant.
- Named entity recognition
For the personal data regex fundamentally cannot catch: names, addresses, free-text identifiers.
- Non-US phone formats
Phone detection is US-format today. Indian and EU formats are next.
If you’re evaluating us against something on this list, it isn’t met today — full stop.
The browser is where the prompt gets typed.
Every other place you could catch an AI prompt is either too late, too easy to route around, or blind to the tools people actually use. So that is where we sit — on the page, before the network request is ever made.
| Approach | What it misses |
|---|---|
| Network proxy | Anything off the corporate network. Certificate pinning breaks it, and a laptop at home walks straight past. |
| CASB | Only the SaaS apps already in its catalogue. New AI tools appear weekly; a catalogue is always a step behind. |
| API gateway | Only prompts routed through your own applications. Someone typing into chatgpt.com directly is invisible to it. |
| Endpoint DLP | Built for files and clipboard events. A free-text prompt is neither one. |
| PromptSec | Runs wherever the browser runs — office, home, or a café — and works on the page itself, so a tool it has never heard of is still covered. It does not cover native desktop apps or terminals; a prompt sent from those never passes through a browser extension. |
No vaporware. Here is the honest list.
In security tooling, one inflated claim reasonably makes a buyer distrust everything else you say. So both halves get published, at the same size, on the same page.
Shipped today
- Browser extension (Chrome MV3): content scripts + background worker
- Regex detectors: Aadhaar, PAN, credit card, SSN, email, phone, AWS keys, generic secrets
- Prompt-injection heuristics: instruction override, DAN jailbreaks, prompt leak
- Encoding bypass detection (base64, hex, unicode)
- Policy DSL: allow / redact / warn / block, versioned and rollback-able
- Go telemetry backend with per-tenant isolation enforced in Postgres
- Hash-chained audit trail — an edited or deleted row breaks the chain
- Admin dashboard: live prompt monitor, policy manager, audit logs
- Optional cloud escalation to Amazon Nova Pro on Bedrock (off by default, fails open)
- SSO (SAML 2.0 / OIDC) and SCIM 2.0 provisioning, set up by us
- Event export (CSV / JSON), and alerts to Slack, email, webhook, PagerDuty
Not shipped
- On-device ML model provisioning (the classifier itself is built and tested)
- Named entity recognition for unstructured personal data
- Signed policy bundles, and public anchoring of the audit chain
- SIEM connectors — the export exists, the connectors don't
- Self-serve signup, trials, and in-product billing
- Automated enforcement of audit-retention windows
- Any compliance certification — SOC 2, ISO 27001, DPDP
Every significant architecture decision — browser-first deployment, on-device inference, the policy DSL, the audit chain — is written up in a public decision record you can check the reasoning against.
For teams who can’t ban AI and can’t ignore it either.
Blocking the tools outright just pushes people onto personal devices, where you have no visibility at all. The realistic goal is making the safe path the easy one.
Banking & financial services
Loan officers and compliance staff paste customer data into ChatGPT for a quick answer. Card numbers, Aadhaar, and PAN are caught and can be hard-blocked, with every decision recorded.
IT services & product engineering
Client code under NDA, pasted into an AI tool to debug it — often the single largest source of accidental disclosure. Source-code and secret detection run on every prompt.
Healthcare
Patient identifiers in a prompt asking for a summary. Contact details and structured IDs are caught today; health-specific entity recognition needs the NER layer, which isn't shipped.
Public sector & regulated bodies
Citizen data, and low tolerance for it leaving the organization. On-device detection means prompt content need not leave the machine at all.
Bring PromptSec to your organization.
We’re onboarding Indian enterprise security teams now. Deploy the extension, watch your shadow AI traffic appear in the dashboard, and get the founding team through rollout.
- Hands-on onboarding, not a support ticket queue
- Deployed across your org in days, through the browser policy you already run
- Preferential pricing for enterprise clients who come on board early
- Direct say in which detectors and compliance frameworks we build next
Talk to the founding team
Takes about 30 seconds. We reply within 1 business day.
Questions, answered.
AI prompt security means watching what employees send to generative AI tools like ChatGPT, Claude, and Gemini, and stepping in when it matters — catching sensitive data, secrets, and prompt-injection attempts before the prompt reaches the AI, then applying a policy-defined action: allow, redact, block, or warn. PromptSec applies this at the browser, before a prompt ever leaves the employee's device. See below for exactly what it detects today.
Find out what your team is
already sending to AI.
The first week of telemetry usually answers that better than any policy document. No credit card, no commitment — you reach the founding team directly.
Want to see it on your own team before talking price? Join the Design Partner Program — free for 30 days