Stop confidential data from reaching AI tools.
Employees paste customer records, source code, contracts, and credentials into ChatGPT and similar services every day. Once that text is submitted, it is out of your control. PromptGuardian stops it at the browser, before it is ever transmitted.
Policy that reaches every installed browser.
An administrator signs in to the PromptGuardian dashboard and defines what must be protected and where the policy should apply.
Set the policy
Protected keywords are the exact phrases or patterns that must never leave the company. Monitored sites are the domains where the policy is enforced.
Install the extension
Employees install the browser extension and enter their organization’s key. The extension pulls the policy and enforces it locally, inside the browser.
Stay in sync
Changes made in the dashboard reach every installed browser automatically, so teams can adapt policy without touching every machine.
Choose the response that fits the moment.
Use quiet protection for everyday work or pause the send when a person needs to make the final decision.
Replace the protected phrase before send.
The protected phrase is silently replaced with a substitute—for example [REDACTED]—before the request leaves the browser. The employee keeps working without exposing the original text.
Pause the send and show what matched.
The send is paused and a warning appears listing what matched. The employee chooses to proceed or cancel. Either decision is recorded.
Protection at the page and network layers.
Because the network layer inspects the outgoing request body directly, policy still applies when a site uses a custom editor, a send button, or a keyboard shortcut instead of an ordinary form.
Page interactions
Detect sensitive data in forms and chats as employees compose messages, giving them a clear, safe choice before submission.
- Works across ordinary forms and chat editors
- Monitored domains are configurable
- Protected patterns are centrally managed
File uploads
An attachment moves far more data in a single action than a pasted sentence, so uploads are governed by their own policy.
- Allow everything, block everything, permit only an approved list of file types, or block specific ones
- Cap the size of anything leaving the browser
- Text-based files are checked against the same keyword rules that protect typed text
- A file cannot be partly redacted, so block refuses it outright and audit asks the employee to confirm
Inspection happens on the employee’s own device before the upload begins, and file contents are never uploaded to us. Filenames are not recorded unless an administrator chooses to record them, and the feature stays off until it is switched on.
Protect the data without making another copy of it.
Matching happens entirely on the employee’s device.
The text being typed is never uploaded. When a rule matches, the extension reports only which rule fired, the domain, the mode, and the outcome—never the sensitive text itself or the message around it.
This matters for a practical reason as well as an ethical one: a monitoring tool that shipped copies of every prompt to a third party would create a second copy of exactly the data you are trying to protect.
Read the full privacy policy ↗What administrators see
Enough to demonstrate the control is working, without creating a second copy of the data you are trying to protect.
- Every block and audit event: which rule matched, on which site, and what the employee chose
- Which browsers are active, and which extension version each is running
- Ready-made detection patterns for common formats—card numbers, API keys, national identifiers—alongside your own keywords
- The ability to revoke a lost or decommissioned machine
Employees can be shown a notice on monitored sites, so they know monitoring is active before they type. Many jurisdictions require this kind of disclosure for workplace monitoring.
Put the control in place in three steps.
Works in Google Chrome and Microsoft Edge.
Create an organization account.
Start from the PromptGuardian dashboard.
Add keywords and sites.
Define the data and domains you want enforced.
Share your organization key.
Give the people who need the extension a simple setup path.
Keep confidential data inside the company.
Make a safer choice before sensitive information reaches an AI tool or another web form.