Check sensitive text before your app sends it to AI.
Building a support assistant, internal chatbot or another AI-powered app? Prompt Guard checks outgoing text for supported private information, such as email addresses and API keys. It can replace detected values or block the request before it reaches OpenAI, Anthropic or Gemini.
You need a developer to connect it to your software. It does not automatically protect conversations on the ChatGPT website or other AI websites.
Free browser demo · 100 free hosted requests · Paid plan: $19 USD/monthA customer email goes in. A placeholder comes out.
Suppose your app asks AI to summarize a support message. With the replace option selected, a detected email address is removed before the text is forwarded.
Before the check
“Please contact alex@example.com about the delayed order.”
After the check
“Please contact [email removed] about the delayed order.”
Illustrative placeholder. The interactive example below shows the scanner's actual output. Detection is pattern-based: it will not catch every kind of private information.
Try it free
Browser scanner: no account needed. Paste sample text and see what would be replaced or blocked. This demo stays in your browser and does not contact an AI provider.
Connected app: 100 free hosted requests. Create an account, save a policy and connect your app to test the hosted service.
Use it in your app: $19/month
Includes 10,000 hosted text requests per UTC month, saved rules, employee keys with provider permissions, and 30 days of activity metadata.
Your AI provider bills separately. No overage charges: requests stop when the allowance is used up. Plus applicable tax. Cancel anytime. This subscription covers Prompt Guard only.
What setup involves
- Choose the rules. Sign in with Google or email, choose replacement or blocking, and add any exact private terms you want detected.
- Create a Prompt Guard key. This lets your app use your saved rules.
- Have your developer connect the app. They route supported text requests through Prompt Guard using your own AI provider key. Test sample inputs before using real data.
Only requests sent through this connection are checked. You still need an account with OpenAI, Anthropic or Gemini.
Try it: see what gets removed
The sample is made up. Click “Inspect text locally” to see the result. Your sample text and private terms are not sent to our server or an AI provider.
How does an LLM PII redaction proxy work?
Your application sends text to Prompt Guard before calling the model provider. The saved policy checks supported patterns and your exact private terms. In redaction mode, detected values are replaced before forwarding. In block mode, a detected value stops the request. Only traffic routed through the gateway is checked.
What can it detect?
The scanner recognizes supported API-key formats, PEM private keys, database URLs, email addresses, formatted US Social Security numbers and phone numbers, and Luhn-valid card numbers. Names, addresses, proprietary code, encoded secrets and medical information are not comprehensively detected. Check the synthetic detector results and known misses before choosing a policy.
How can you test it safely?
Use made-up examples in the free local scanner. Check that expected values are detected and useful surrounding text survives redaction. Try block mode and confirm the sample is stopped. The demo runs locally: it does not prove your application's provider connection works. After connecting your app, separately verify its saved policy, authentication and quota handling with synthetic text.
Hosted gateway or your own network?
The hosted gateway accepts supported text requests for OpenAI, Anthropic and Gemini. It rejects files, images, tools, embeddings and streaming, with a combined text limit of 16 KiB. Review the API connection requirements. Teams that need a customer-hosted gateway can review deployment and administration requirements. Neither option automatically protects unrelated browser chats or establishes compliance certification.
For your developer: coverage, connection details and self-hosting
Explicit coverage
Read the synthetic detector evaluation and known misses
Recognizes supported API-key formats, PEM private keys, database URLs, email addresses, formatted US SSNs and phone numbers, Luhn-valid card numbers, and your literal terms.
Coverage is pattern-based. Names, addresses, proprietary code, encoded values and medical information are not comprehensively detected.
A narrow, enforceable endpoint
Text messages only, up to 16 KiB combined. Unsupported tools, files, images, embeddings and streaming are rejected. Quota exhaustion blocks requests instead of forwarding unfiltered traffic.
Your model provider charges separately. The hosted proxy receives raw prompts transiently to inspect them; it stores policy counts, never prompts or responses.
Connect an existing API client
Base URL: https://workflow-inspector.com/api/tools/ai-proxy/v1
Authorization: Bearer YOUR_PROMPT_GUARD_KEY
X-Upstream-API-Key: YOUR_OPENAI_KEY
Idempotency-Key: a-unique-request-id
POST /chat/completions
{"model":"gpt-4.1-mini","messages":[{"role":"user","content":"Your text"}],"max_completion_tokens":512}
Upstream keys are supplied per request and are not stored. Use environment variables in your server; never put keys in a public browser bundle.
30-day metadata history. Rotate or revoke the proxy key from your account. This covers traffic routed through the endpoint, not employee use of unrelated browser chat tools.
Run the scanner in your own environment
Deploy the managed gateway: mutual TLS, central policy, signed audits and workload routing controls
Download the dependency-free Node server and scanner together. The local server binds to loopback and requires your own bearer token and upstream key in environment variables.
PROMPT_GUARD_TOKEN=your-long-random-token OPENAI_API_KEY=your-provider-key node local-proxy.mjs
No HIPAA or regulatory certification is implied. Evaluate the detectors against your own data before relying on them.
Provider and team controls
The hosted gateway supports OpenAI, Anthropic and Gemini text chat through one redaction policy. Create expiring employee keys with individual provider permissions in your account. Managed employee browser or network enforcement requires your own administrative deployment.
Is Prompt Guard right for you?
Does it protect my team when they use ChatGPT in a browser?
No. The hosted service checks supported requests from software connected to it. Browser-wide or company-wide enforcement requires your own administrative deployment. See the deployment guide.
Will it remove every secret or personal detail?
No. It recognizes supported patterns and exact terms you configure. Names, addresses, medical information and proprietary source code are not comprehensively detected. Read the coverage evaluation and known misses.
Can I send files, images or streaming responses through it?
The hosted service supports text chat requests only: files, images, tools, embeddings and streaming are rejected. The separate customer-hosted package can inspect bounded local text, document, image and English-audio attachments, then forwards extracted or redacted text instead of the original attachment. Review its format and size limits before deployment.
What happens to the text?
The free scanner works in your browser. The hosted service temporarily receives raw text to check it, then forwards allowed text to your selected AI provider. It records activity metadata, not prompt or response contents. Provider keys are supplied with each request and are not stored.
Is this a compliance certification?
No. Prompt Guard is a text-checking tool, not a compliance certification or a guarantee that sensitive information has been removed. It does not include a HIPAA business associate agreement.
LLM PII redaction proxy
Prompt Guard is an LLM PII redaction proxy for supported OpenAI, Anthropic and Gemini text requests. Use it as an OpenAI data masking gateway or automated data redaction middleware for LLMs by routing your API client through the protected endpoint.
How to prevent data leaks in ChatGPT prompts
To prevent data leaks in ChatGPT prompts sent through your API application, route supported text through the proxy, configure private terms and choose redaction or blocking. This does not intercept the separate ChatGPT website or unmanaged employee devices.
A practical guide: how to sanitize user input before LLM ingestion
Use inline prompt data scrubbing middleware before the provider call. The scanner uses regex pattern matching for API keys and database strings alongside supported identifier checks and literal private terms. Review the published detector evaluation and test representative synthetic inputs before rollout.
Enterprise AI data loss prevention tool: deployment scope
Teams evaluating an Enterprise AI data loss prevention tool can use the hosted text gateway for employee keys, provider permissions and central policy. The customer-hosted package adds company sign-in, SCIM provisioning, central administration, signed audit records and bounded local document, image and English-audio inspection. Independent compliance attestations are not included. How to stop employees from pasting source code into AI still requires routed workloads and a code-aware policy: Prompt Guard does not automatically intercept unrelated browser chats or comprehensively identify proprietary code.
Self-hosted proxy for masking sensitive API logs
The customer-hosted gateway inspects routed content and records policy metadata. Keep raw prompts out of your own application and infrastructure logs too: Prompt Guard does not retroactively sanitize existing logs. Review the deployment guide before operating it.
Choosing a stateless reverse proxy for LLM endpoints
Prompt contents are inspected transiently rather than stored as prompt history. Hosted authentication, quotas and metadata audits still use persistent state, so the complete hosted service is not stateless. An asynchronous prompt validation pipeline must finish validation before forwarding: asynchronous I/O must never let unchecked prompts reach the provider.
Can it strip PII before embedding ingestion?
The hosted endpoint does not support embeddings. Do not route embedding requests through it expecting protection: it rejects unsupported request types. The downloadable scanner can be evaluated separately, but it is not a complete embedding ingestion integration.
Evaluating an open source AI compliance gateway data scrub
For an open source AI compliance gateway data scrub, verify the license and deployment terms of each component before reuse. Downloadable source alone does not establish open-source licensing, certification or complete detection. Prompt Guard provides downloadable scanner and gateway files with explicit coverage limits.
HIPAA compliant AI chatbot proxy architecture
A HIPAA compliant text sanitization architecture requires an independently assessed system, appropriate agreements and controls beyond text patterns. Prompt Guard does not claim to provide a HIPAA compliant AI chatbot proxy architecture, a BAA or comprehensive PHI detection. Do not treat a clean scan as proof that health information has been removed.
Read the deployment guide · Explore Ledger Check
How this was created: AI-assisted explanations checked against the published product scope and implementation documentation. No customer outcomes or compliance certifications are implied.
We record limited first-party landing-page and campaign information as described in our Privacy Policy. This does not include text, private terms or scanner results. No third-party advertising tags are added by this page.