https://promptsec.in/blog AI prompt security, prompt injection, and DPDP compliance — engineering notes from the PromptSec team. en-IN Fri, 16 Oct 2026 00:51:55 GMT https://promptsec.in/blog/chatgpt-enterprise-vs-free-data-security https://promptsec.in/blog/chatgpt-enterprise-vs-free-data-security Fri, 18 Sep 2026 00:00:00 GMT PromptSec Upgrading employees to ChatGPT Enterprise or Team changes OpenAI's data-handling terms. It doesn't add anything that inspects a prompt before it's sent — here's the distinction that matters. https://promptsec.in/blog/writing-an-ai-usage-policy-employees-follow https://promptsec.in/blog/writing-an-ai-usage-policy-employees-follow Fri, 04 Sep 2026 00:00:00 GMT PromptSec Most AI usage policies are a page nobody reads, enforced by nothing. What changes when the policy is a small set of machine-enforced rules instead of a document. https://promptsec.in/blog/cert-in-reportable-ai-incidents https://promptsec.in/blog/cert-in-reportable-ai-incidents Fri, 21 Aug 2026 00:00:00 GMT PromptSec CERT-In's directions were written before generative AI was a mainstream enterprise tool. Where a prompt-driven data leak fits its incident categories, and why erring toward reporting is the safer read. https://promptsec.in/blog/dpdp-act-250-crore-penalty-explained https://promptsec.in/blog/dpdp-act-250-crore-penalty-explained Fri, 07 Aug 2026 00:00:00 GMT PromptSec The headline number from India's DPDP Act 2023 is a ceiling, not a fine — and it attaches to one specific failure. What the Schedule actually says, and how “reasonable” gets judged. https://promptsec.in/blog/how-aadhaar-and-pan-detection-actually-works https://promptsec.in/blog/how-aadhaar-and-pan-detection-actually-works Fri, 24 Jul 2026 00:00:00 GMT PromptSec Checksum validation catches what pattern-matching alone misses. A practitioner's look at how Aadhaar's Verhoeff digit and PAN's structure let a detector tell a real number from a random one. https://promptsec.in/blog/why-browser-first-not-proxy https://promptsec.in/blog/why-browser-first-not-proxy Fri, 10 Jul 2026 00:00:00 GMT PromptSec Engineering Network proxies, CASBs, and API gateways each solve a real problem. None can see an employee pasting client code into ChatGPT from a home laptop. Here's why. https://promptsec.in/blog/how-indirect-prompt-injection-works https://promptsec.in/blog/how-indirect-prompt-injection-works Fri, 03 Jul 2026 00:00:00 GMT PromptSec Engineering Direct prompt injection is typing "ignore previous instructions." Indirect injection hides the instruction inside pasted content — much harder to defend. https://promptsec.in/blog/on-device-inference-tradeoffs https://promptsec.in/blog/on-device-inference-tradeoffs Wed, 24 Jun 2026 00:00:00 GMT PromptSec Engineering Running detection in the browser instead of a server has real privacy and latency advantages — and real limits on model size and accuracy. Both sides, honestly. https://promptsec.in/blog/dpdp-act-what-it-asks-of-ai-tooling https://promptsec.in/blog/dpdp-act-what-it-asks-of-ai-tooling Wed, 17 Jun 2026 00:00:00 GMT PromptSec India's DPDP Act 2023 doesn't mention AI — that's exactly why it applies. A practical read of which obligations bite when employees paste data into a chatbot. https://promptsec.in/blog/shadow-ai-what-the-first-week-shows https://promptsec.in/blog/shadow-ai-what-the-first-week-shows Fri, 05 Jun 2026 00:00:00 GMT PromptSec Before you can govern AI usage you have to see it. What the first week of visibility data tends to reveal, and how to read it without overreacting.