The enforcement point is the browser.
PromptSec's platform is three parts working together in the browser: an extension that intercepts a prompt at the DOM, an on-device detection engine that scores it, and a policy engine that decides allow, redact, warn, or block — before the prompt ever leaves the device. Every other enforcement point is either too late, too easy to route around, or blind to the tools people actually use.
Three parts, one path
A prompt travels through all three before it reaches the AI tool.
Browser extension
A Chrome extension catches the prompt at the DOM, before the request ever leaves the machine. Deployed through the browser policy management you already run — no proxy, no gateway, no certificates.
Learn moreDetection engine
Layered analysis on-device: normalisation, regex detectors, heuristics, then optional ML. Cheapest checks run first, so most prompts never touch the expensive layers at all.
Learn morePolicy engine
A declarative YAML policy decides what happens next: allow, redact, warn, or block. Versioned and reviewable, like any other code you ship.
Learn moreHow the pieces fit
Three tiers, and — more to the point — what does and doesn't cross the line between them.
- Intercepts the prompt at the DOM, before the network request
- Runs the full detection pipeline locally
- Applies the policy decision in place
- Serves the active policy bundle
- Accepts telemetry events
- Per-tenant isolation enforced in the database
- Hash-chained audit trail
- Admin console reads from here
Prompt text never appears on this diagram above Tier 1. Detection finishes inside the browser, and what travels upward is the decision, the detected categories, the tool and a timestamp — with sensitive spans masked first. The one exception is cloud escalation, which is off by default and sends only the ambiguous prompt when you switch it on.
What happens to a prompt
From keystroke to decision, with nothing leaving the device unless your policy says so.
- 01
Someone types or pastes a prompt into ChatGPT, Claude, Gemini, Copilot, or any other web-based AI tool.
- 02
The extension catches it at the DOM — before the network request is even made.
- 03
The detection pipeline runs locally. Nothing about the prompt is transmitted to do this.
- 04
The active policy maps the detected categories to an action: allow, redact, warn, or block.
- 05
The action gets applied in place. A redaction swaps out the sensitive span; a block stops the send and explains why.
- 06
A telemetry event records the decision, the categories, and a timestamp — never the prompt text.
Five layers, cheapest checks first.
Fast, deterministic detectors run first; probabilistic ones handle what's left over. Every detection carries a confidence score and a reason. Block-severity findings need confidence of 0.8 or higher — anything weaker degrades to warn-and-escalate instead.
Credit cards (Luhn-checked), Aadhaar and PAN (checksum-validated), SSNs, AWS keys, bearer tokens and other high-entropy secrets, emails, phones.
Person names, organizations, and locations — disclosed in ordinary prose, with no fixed shape a regex can match.
DistilBERT/MiniLM ONNX models for injection, jailbreak, toxicity, content category.
Per-customer term lists, custom regex, document fingerprinting (MinHash).
Amazon Nova Pro on Amazon Bedrock for ambiguous cases. Deep analysis, multi-turn context.
Scroll the table sideways to see latency, status, and technologies
Keeping false blocks rare is what makes the tool trustworthy enough to leave on. A security tool that hard-fails on a network blip gets disabled by users; one that quietly degrades to local-only detection does not.
The control plane
What the security team sees, and what it deliberately doesn't.
Security Overview
Last 7 days · all tools
| Event | User | Category | Tool | Risk | Status |
|---|---|---|---|---|---|
| evt_9f2a | r.mehta | pii.aadhaar | ChatGPT | 92 | Blocked |
| evt_9f28 | s.iyer | secrets.aws_key | Claude | 88 | Blocked |
| evt_9f25 | a.khan | code.source | Copilot | 54 | Warned |
| evt_9f21 | d.patel | pii.email | Gemini | 31 | Redacted |
| evt_9f1c | n.rao | pii.credit_card | ChatGPT | 46 | Redacted |
A Go telemetry service backed by Postgres receives one event per decision, with per-tenant isolation enforced by the database itself, not just application code. The console reads from it: a live prompt monitor, policy management, audit logs, and analytics.
What it receives is the decision, the detected categories, the tool, and a timestamp — not the prompt. Sensitive spans are masked before anything is sent, so the control plane couldn’t reconstruct what someone typed even if it tried. That is why the screen above shows categories rather than sentences.
How we handle dataFind out what your team is
already sending to AI.
The first week of telemetry usually answers that better than any policy document. No credit card, no commitment — you reach the founding team directly.
Want to see it on your own team before talking price? Join the Design Partner Program — free for 30 days