Built in India, for Indian enterprises.
AI tools arrived faster than the controls around them. The security tooling most organizations already own was built for files, email, and network traffic — not for a paragraph of free text typed into a chatbot.
Why we're building this
Ask a security team which AI tools their staff use, and most can't answer precisely. Not through negligence — the tools are free, they run in a browser tab, and they need no procurement, no install, and no admin approval. Traditional visibility tooling was never built to see any of that.
Meanwhile the DPDP Act 2023 has landed, CERT-In has a six-hour incident-reporting window, and sectoral regulators are asking pointed questions about where data goes. The gap between what organizations are accountable for and what they can actually see is the problem we're working on.
We chose the browser as the enforcement point because it's the one place that sees every web-based AI tool — including the ones nobody's approved and the ones that launched last week. That decision, and the reasoning behind it, is written up in a public architecture decision record, alongside every other significant call we've made.
How we work
We publish what isn't built
Every page here separates what ships today from what's on the roadmap. In security tooling, one inflated claim reasonably makes a buyer distrust everything else you say.
No fake intelligence
The on-device ML classifier is implemented and tested, and it stays switched off until a real model backs it. We'd rather ship nothing than ship something that just returns a plausible-looking constant.
Decisions in the open
Architecture decision records for browser-first deployment, on-device inference, the policy DSL, and the audit chain. You can check our claims against the reasoning, and the code, yourself.
Decisions on record
Every significant, hard-to-reverse call is written up before we build it: the context, what we chose, and what we rejected. Six of the nine are below — the rest are in the repository alongside the code they govern.
Browser-first deployment
Detection runs in the browser extension — the one place that sees every web-based AI tool before it sees native apps or direct API calls.
On-device-first inference
Prompts are scored on the user's device before they leave the page, not sent to a server we control first.
Policy DSL: Rego-inspired YAML
Policy is versioned, rollback-able YAML — not a hard-coded settings UI, and not a general-purpose scripting language.
Audit log: Merkle chain + Sigstore anchor
An edited or deleted audit row breaks a hash chain that auditors can verify independently of us.
Multi-tenancy from day one
Shared infrastructure with tenant isolation enforced in Postgres, not a separate database per customer.
Centrally-managed policy engine
Policy authoring and distribution move out of the customer-facing workspace and into a validated, signed control plane.
Find out what your team is
already sending to AI.
The first week of telemetry usually answers that better than any policy document. No credit card, no commitment — you reach the founding team directly.
Want to see it on your own team before talking price? Join the Design Partner Program — free for 30 days