AI data protection gateway

Reduce accidental data leaks to AI tools.

Teams are already using ChatGPT, Claude, Cursor, CLI tools, and AI SDKs every day. PromptProxy gives security teams a practical way to detect and redact sensitive values before they leave the organization.

run it locally see browser protection
no TLS MITM local detection provider sees surrogates audited vault
live request /openai/v1/chat/completions
redacted
user typed dc11.company.com 10.10.5.30 simon.smith@company.com
provider saw srv1942.northbridge.local 203.0.113.42 user.marlow@northbridge.com
client received dc11.company.com 10.10.5.30 simon.smith@company.com
X-PromptProxy-Redacted: true X-PromptProxy-Findings-Count: 3 X-PromptProxy-Categories: domain, ipv4, email
AI gateway OpenAI · Claude · streaming
browser guard monitor · redact · block
secure vault encrypted originals
simple deploy Go binary + SQLite

why it exists

Most AI leaks are not malicious.

They happen during normal work: an engineer pastes logs into Claude, a developer asks ChatGPT to explain an internal hostname, or someone sends a customer email thread to an AI tool for summarization.

Blocking AI completely usually fails. PromptProxy is designed for the middle ground: let people keep working, but reduce what sensitive data reaches external providers.

how it works

Protect the request before it leaves.

PromptProxy sits between users and AI providers. It authenticates the user, checks policy, scans the request locally, replaces sensitive values with stable surrogates, and verifies the sanitized payload before forwarding it upstream.

01

Send through the gateway

SDKs, CLI tools, browser workflows, and internal apps point to PromptProxy instead of calling providers directly.

02

Detect locally

Text, tool arguments, tool results, and decoded base64 text are scanned locally using deterministic rules.

03

Redact before upload

Internal values are replaced with realistic surrogates. A verifier checks the request again before it leaves.

04

Restore for the user

The provider response is mapped back for the user, while findings and policy events are recorded for review.

browser guard

Protect AI websites without TLS interception.

PromptProxy Guard runs on managed AI sites and follows central policy. It helps security teams cover browser-based usage without trying to intercept all user traffic at the network layer.

  • detects sensitive text typed or pasted into AI sites
  • redacts before submit when policy allows it
  • blocks risky sends in block or strict mode
  • reports extension health, findings, and policy drift
  • avoids storing prompt content in browser storage
PromptProxy Guard browser extension banner on ChatGPT
PromptProxy Guard running on a protected AI site.

policy modes

Start with visibility. Enforce when ready.

Rollout does not need to start with blocking. Most teams begin in monitor mode, learn what users are sending, tune the rules, and then move higher-risk groups into redaction or blocking.

mode 01 · monitor

Observe first

Detect findings and record activity without modifying the prompt. Useful during pilots and rule tuning.

request behavior forward as-is · log findings · alert on high risk
mode 02 · redact

Mask before submit

Sensitive values are replaced locally before the request leaves. Users still get useful responses back.

request behavior detect · replace · verify · forward
mode 03 · block

Stop risky requests

If a request matches a forbidden category, the gateway rejects it before it reaches the provider.

request behavior detect · reject · audit
mode 04 · strict

Fail closed

If the gateway is unavailable or the verifier finds a remnant in the sanitized payload, the request is blocked.

request behavior block on gateway down · block on verifier failure

admin console

Visibility for the security team.

The console gives teams a place to review sessions, findings, alerts, extension health, policies, vault access, and audit activity. It is built for day-to-day operations, not just dashboards.

PromptProxy dashboard with gateway requests, findings, extension installs, alerts, and recent activity
Dashboard with gateway activity, findings, extension state, alerts, and policy drift.
PromptProxy sessions table and session detail drawer
Session trace with user, source IP, provider, model, risk score, and lifecycle events.

coverage

Built for the places AI data leaks actually happen.

Base64 text guard

Base64 UTF-8 content is decoded, scanned, redacted, and re-encoded so encoded text does not bypass policy.

Tool-call inspection

OpenAI function arguments and Anthropic tool use / tool result blocks are walked as text so agent workflows stay covered.

File and media policy

Images, documents, audio, and files are counted and audited. Admins can block them when text-only workflows are required.

Separate gateway keys

Users authenticate with PromptProxy keys. Provider keys stay server-side and can be managed centrally.

Streaming responses

SSE responses are restored safely as they stream back, including surrogate values that span chunk boundaries.

Audited vault reveal

Original values stay encrypted. Reveal requires permission, a reason, and an audit event.

bypass guards

Handle the easy ways people bypass simple filters.

Sensitive data does not always arrive as plain text. Users paste encoded values, logs, screenshots, and tool outputs. PromptProxy handles the text paths directly and makes non-text content visible to policy.

guard · base64

Base64 text does not get a free pass

PromptProxy looks for base64 text runs, decodes them to UTF-8, scans the decoded content, substitutes surrogates, and re-encodes the result before forwarding. 

# original request body
{ "prompt": "ZGMxMS5jb21wYW55LmNvbSAxMC4xMC41LjMw" }

# decoded inside PromptProxy
"dc11.company.com 10.10.5.30"
   ↑ 2 findings · domain, ipv4

# request actually forwarded
{ "prompt": "c3J2MTk0Mi5ub3J0aGJyaWRnZS5sb2NhbCAyMDMuMC4xMTMuNDI=" }
"srv1942.northbridge.local 203.0.113.42"
guard · files

Opaque content is not silently ignored

Images, documents, files, and audio are not treated as invisible. Requests report what they carried, and admins can block binary content when policy requires it.

  • X-PromptProxy-Inspected-Texts number of text blocks scanned
  • X-PromptProxy-Uninspected-Blocks for example image=2,document=1,tool_use=1
  • multimodal_content_received audit row for every non-text request
  • block_binary_content runtime toggle that can reject uploads with an alert

API key handling

Users do not need direct provider keys.

PromptProxy separates the key a user holds from the key used to call OpenAI or Anthropic. Users authenticate to the gateway with a pp_ key. The gateway resolves the correct upstream provider key server-side.

Layer 1 · gateway key

  1. User holds a pp_ key. Issued from the admin console and scoped to a user, role, and tenant.
  2. SDK points at PromptProxy. OPENAI_BASE_URL or ANTHROPIC_BASE_URL points to the gateway.
  3. Gateway validates access. Auth, rate limits, role, and policy are checked before parsing the request.
  4. Request is tied to a session. Findings and surrogate mappings are scoped for audit and troubleshooting.

Layer 2 · provider key

  1. Per-user key resolution. If a user has a stored OpenAI or Anthropic key, the gateway decrypts it per call.
  2. Environment fallback. If no user key is set, the gateway can fall back to a server-side provider key.
  3. Provider call happens server-side. The provider sees the resolved upstream key, never the user's pp_ key.
  4. Revoke access centrally. Disabling a user invalidates their gateway key without touching provider accounts. 
curl -i https://promptproxy.company.local/openai/v1/chat/completions \
  -H "Authorization: Bearer pp_your_gateway_key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o-mini",
    "messages": [
      { "role": "user", "content": "check dc11.company.com 10.10.5.30" }
    ]
  }'
from openai import OpenAI

client = OpenAI(
    base_url="https://promptproxy.company.local/openai/v1",
    api_key="pp_your_gateway_key",
)

resp = client.chat.completions.create(
    model="gpt-4o-mini",
    messages=[{"role": "user", "content": "analyze dc11.company.com"}],
)

print(resp.choices[0].message.content)
import Anthropic from "@anthropic-ai/sdk";

const anthropic = new Anthropic({
  baseURL: "https://promptproxy.company.local/anthropic",
  apiKey: "pp_your_gateway_key",
});

const msg = await anthropic.messages.create({
  model: "claude-3-5-sonnet-latest",
  max_tokens: 256,
  messages: [{ role: "user", content: "check dc11.company.com" }],
});
export ANTHROPIC_BASE_URL="https://promptproxy.company.local/anthropic"
export ANTHROPIC_API_KEY="pp_your_gateway_key"

claude

SDK + CLI integrations

Point existing tools at the gateway.

Most clients only need a base URL and an API key change. Provider keys can stay on the server, while users continue working from their normal tools.

  • OpenAI-compatible chat and responses APIs
  • Anthropic messages and streaming SSE
  • Claude Code through ANTHROPIC_BASE_URL
  • Cursor, Codex CLI, and custom base-URL tools
  • per-user upstream provider keys
  • diagnostic headers for curl testing

security model

Explicit by design.

PromptProxy is intentionally narrow. It is not a general HTTP proxy and it does not try to secretly intercept browser traffic. The goal is to protect known AI workflows in a way security teams can test and explain.

No TLS interception

Browser coverage comes from a managed extension and egress controls, not from transparent system-level MITM.

No detector LLM required

The core detector is local and deterministic. Rules can be reviewed, tested, and tuned without depending on another model.

Encrypted local state

Vault originals and upstream provider keys are encrypted. Original lookup uses keyed indexes instead of plaintext search.

SQLite-first deployment

The MVP runs as a single Go service with SQLite WAL, an embedded admin UI, and a simple background job queue.

deployment

Roll it out without breaking everyone’s workflow.

Start small, learn from real usage, then enforce where the risk is clear. The same policy modes used by the gateway also give you a safe rollout path.

phase 01 · pilot

Run in monitor

Deploy the gateway for a small group. Nothing is redacted yet. Use the findings to tune rules and understand real usage.

  • Stand up gateway + SQLite
  • Issue pilot pp_ keys
  • Review finding categories
  • Tune false positives
phase 02 · expand

Move to redact

Enable redaction for the pilot group, then expand to engineering, security, and ops teams once workflows are stable.

  • Enable per-user provider keys
  • Test Claude Code, Cursor, and CLI tools
  • Validate streaming responses
  • Confirm users still get useful answers
phase 03 · enforce

Add browser coverage

Force-install the managed extension and start blocking categories that should never leave the organization.

  • Deploy extension by policy
  • Block high-risk categories
  • Enable file-content policy
  • Send alerts to the SIEM
phase 04 · lock down

Use strict mode

Move high-risk teams to strict mode and restrict direct provider egress so the gateway becomes the approved path.

  • Deny direct AI provider egress
  • Fail closed on verifier issues
  • Document vault reveal process
  • Prepare break-glass procedure

quickstart

Run the gateway and create your first pp_ key.

export PROMPTPROXY_MASTER_KEY="$(openssl rand -base64 32)"
export PROMPTPROXY_OPENAI_API_KEY="sk-..."
export PROMPTPROXY_ANTHROPIC_API_KEY="sk-ant-..."

go run ./cmd/promptproxy
  1. Save the bootstrap admin password printed on first start.
  2. Open the admin console.
  3. Create users or profiles.
  4. Create a gateway API key for each user.
  5. Point SDKs, CLI tools, or the browser extension at the gateway.

faq

Clear boundaries. No magic promises.

Does PromptProxy send original sensitive values to OpenAI or Claude?

Not for supported text routes in redact mode. The request is parsed locally, sensitive values are replaced with surrogates, and the sanitized payload is verified before it is forwarded.

Does it inspect PDFs, images, audio, or files inline?

No. Non-text content is counted and audited. Admins can block it at runtime when policy requires text-only workflows. Deeper document inspection can be added as a separate ingestion workflow.

Why use deterministic rules instead of an LLM detector?

Security teams need behavior they can explain and test. The core detector is local, deterministic, and auditable. A model-based detector can be added later as an additional signal, but it should not be the only control.

Can users disable the browser extension?

In managed deployments, Chrome Enterprise or Edge for Business policy can force-install the extension and lock settings. Network egress controls are still needed to reduce bypass from unmanaged browsers or personal devices.

How are streaming responses restored?

SSE chunks are processed as they arrive. PromptProxy keeps enough trailing data to handle surrogate values that may span chunk boundaries before sending restored output to the client.

What is intentionally not included?

No transparent MITM proxy, no general-purpose HTTP forwarding, no hidden LLM classifier, no PostgreSQL or Redis requirement for the MVP, and no silent inspection of arbitrary binary files. The focus is AI data protection for known AI workflows.