Question 1

What is AI prompt security?

Accepted Answer

AI prompt security means watching what employees send to generative AI tools like ChatGPT, Claude, and Gemini, and stepping in when it matters — catching sensitive data, secrets, and prompt-injection attempts before the prompt reaches the AI, then applying a policy-defined action: allow, redact, block, or warn. PromptSec applies this at the browser, before a prompt ever leaves the employee's device. See below for exactly what it detects today.

Question 2

How is PromptSec different from traditional DLP?

Accepted Answer

Traditional DLP was built for files, email, and network traffic. It wasn't built to read a paragraph of free text typed into a chat window, so it misses prompts entirely. PromptSec is browser-first: it catches prompts at the DOM level, before they reach the AI tool's servers. That means it covers shadow AI that DLP and CASB can't see, and it runs detection on-device so prompts never leave the employee's machine by default.

Question 3

Does PromptSec see my employees' prompts?

Accepted Answer

No. By default, all detection runs on-device in the browser extension. Prompts are analyzed locally and never sent to PromptSec's servers unless you explicitly opt in to cloud escalation for the ambiguous cases. What the control plane receives is metadata — decisions, categories, timestamps — never raw prompt content. Sensitive spans are masked before any telemetry is sent.

Question 4

Is PromptSec built for the Indian market?

Accepted Answer

Yes. PromptSec is being built in India, for Indian enterprises. Aadhaar and PAN detection — checksum-validated, not just pattern-matched — is live today. The compliance framework is being designed to map to Indian regulations: the DPDP Act 2023, CERT-In directions, RBI cybersecurity guidelines, SEBI, and IRDAI. The founding team is based in India.

Question 5

What's included when I onboard?

Accepted Answer

Onboarding gets you the browser extension, the admin dashboard, the Go telemetry backend, and dedicated support from the founding team as you roll out. You'll see your organization's shadow AI traffic, set detection policies, and have a direct hand in shaping what we build next. Enterprise clients who come on board early also lock in preferential pricing.

Question 6

What detection does PromptSec offer today?

Accepted Answer

Regex and heuristic detection is built and tested today: PII patterns (email, phone, credit card, SSN), Aadhaar and PAN (checksum-validated), API keys (AWS), generic high-entropy secrets, prompt-injection patterns (instruction override, DAN jailbreaks, prompt leak), and encoding bypasses (base64, hex, unicode). The on-device ML classifier is implemented and tested too, and is waiting on a model before it goes live.

Question 7

What happens after I submit the sign-up form?

Accepted Answer

We review every submission within 1 business day and reach out by email to schedule a 30-minute discovery call. You'll get a shadow AI discovery report and a deployment plan out of it. There's no commitment — the form just tells us you're interested.

Question 8

Which AI tools does PromptSec cover?

Accepted Answer

Out of the box, the extension registers content scripts for ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, and Open WebUI (the common self-hosted and Ollama front-end). Because it works at the DOM rather than against a catalogue of API endpoints, covering another tool — including an internal or newly-launched one — is a matter of adding a match pattern. What it doesn't cover: a prompt sent through a raw API call, a native desktop app, or a terminal, none of which pass through a browser.

Question 9

Is PromptSec compliant with DPDP Act 2023?

Accepted Answer

Not yet, in the certified sense — we hold no compliance certification today. PromptSec is being designed with DPDP Act 2023 compliance as a core architectural principle: on-device detection (Aadhaar included), data minimization, and a hash-chained audit trail. Consent tracking and audit reporting mapped directly to the 6-hour CERT-In mandate are on the roadmap. Onboarding clients help us prioritize which compliance features ship next.

Question 10

Does PromptSec require IT infrastructure or API keys?

Accepted Answer

No. PromptSec is a browser extension — deploy it through your browser policy management system. No proxy to set up, no API gateway to integrate, no IT infrastructure to reconfigure. Install the extension, set your policies, and detection runs on-device. The admin dashboard for centralized policy management, live monitoring, and audit logs is live today.

Question 11

Does PromptSec detect Aadhaar and PAN numbers pasted into ChatGPT?

Accepted Answer

Yes. Aadhaar and PAN detection is checksum-validated, not just pattern-matched — Aadhaar's Verhoeff check digit and PAN's structural format are verified before a match is flagged, which keeps false positives low. It runs on-device against ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, and Open WebUI, and the policy engine can redact, warn, or hard-block on a match.

Question 12

What is the DPDP Act 2023 penalty for an AI-related data leak?

Accepted Answer

The Digital Personal Data Protection Act 2023's Schedule sets penalties of up to ₹250 crore for a personal data breach caused by a failure to take reasonable security safeguards — a ceiling the Data Protection Board of India sets the actual amount within, not a fixed fine. An employee pasting customer data into an AI tool with no control in place is exactly the kind of gap that question turns on. This isn't legal advice; see our deep dive on what triggers the penalty for the mechanics.

Question 13

Does moving to ChatGPT Enterprise make us DPDP compliant?

Accepted Answer

No. ChatGPT Enterprise changes what OpenAI does with a conversation after it's sent — no training on your data by default, admin controls, SSO. It doesn't inspect a prompt before it's sent, so an employee can still paste an Aadhaar number or a customer record into it. That's still processing personal data under the DPDP Act, and it's the gap a browser-level control like PromptSec is built to close, regardless of which AI tool or tier an employee is using.

Question 14

Can PromptSec help meet CERT-In's 6-hour incident reporting rule?

Accepted Answer

It helps with the evidence, not the reporting itself. PromptSec's audit trail records which tool, which category was detected, what action was taken, and when — the record you need to even begin scoping an incident within six hours. Consent tracking and reporting workflows mapped directly to the CERT-In mandate are on the roadmap, not shipped today.

Capability	Starter	Professional	Enterprise
Limits
SeatsProvisioned at plan change; larger fleets are the Custom plan	10	100	1,000
Detection and enforcement
Browser extension (Chrome MV3)ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, Open WebUI	Included	Included	Included
On-device detectionAadhaar and PAN (checksum-validated), cards, SSN, email, phone, AWS keys, high-entropy secrets	Included	Included	Included
Prompt-injection heuristicsInstruction override, jailbreaks, indirect injection, encoding evasion	Included	Included	Included
Policy engineAllow, redact, warn, block — versioned, with rollback	Included	Included	Included
Model response scanning	Included	Included	Included
On-device ML classifierBuilt and tested; switched off until a model backs it	Planned	Planned	Planned
Visibility
Live prompt monitorStreaming decisions, filterable by tool, user and category	Included	Included	Included
Shadow AI discovery	Included	Included	Included
Threat analysisCorrelates violations into incidents and surfaces patterns	Not included	Included	Included
AI security briefing	Not included	Not included	Included
Governance and evidence
Hash-chained audit logEditing or deleting an entry breaks the chain and is detectable	Not included	Included	Included
Event exportCSV and JSON	Not included	Included	Included
SIEM connectorsSplunk, Microsoft Sentinel, Datadog, Elastic. Export is available today; the connectors are not built	Planned	Planned	Planned
Signed policy bundlesCosign/Sigstore verification in the extension	Planned	Planned	Planned
Operations
Team management and invites	Included	Included	Included
AlertingSlack, email, webhook and PagerDuty destinations	Included	Included	Included
Cloud escalationAmazon Nova Pro on Bedrock for ambiguous prompts. Off by default, fails open	Not included	Included	Included
SSO — SAML 2.0 or OIDCWorking today, configured by our team rather than self-serve	Not included	Not included	Included
SCIM 2.0 provisioning	Not included	Not included	Included
MDM-pushable deploymentIntune, Jamf, ManageEngine packaging	Planned	Planned	Planned

Enterprise capability, mid-market budget.

Three plans. One conversation.

Starter

Professional

Enterprise

What each plan actually includes.

Before you buy

Audit retention is not a plan difference

Custom domains are not available on any plan

We hold no compliance certifications

Onboarding is hands-on, not self-serve

Questions, answered.