Every prompt your team sends to ChatGPT, Claude, Gemini, or any web-based AI is inspected inside the browser, before it leaves the device. Defaults to observe-only for the first 30 days so you see how data actually moves before blocking anything. Context-aware redaction, not keyword spam. Credentials, PII, SA ID numbers and regulated data are handled per your policy. Full POPIA audit trail.
Inspection happens in-browser, in the same JavaScript context as the AI tool's UI. There is no proxy, no API key, no cloud scanner. The outbound request is modified or blocked locally.
{
"messages": [{
"role": "user",
"content": "debug this config:
DATABASE_URL=postgresql://admin:s3cretP@ss@db:5432/main
STRIPE_KEY=sk_live_4eC39HqLyjWDarjtT1
AWS_SECRET=wJalrXUtnFEMI/K7MDENG"
}]
}{
"messages": [{
"role": "user",
"content": "debug this config:
DATABASE_URL=<REDACTED:CONNECTION_STRING>
STRIPE_KEY=<REDACTED:API_KEY>
AWS_SECRET=<REDACTED:AWS_KEY>"
}]
}No proxy in the request path. No SaaS to break. No firewall changes required. Endon sits inside the browser tab and reports metadata to a tenant-isolated control plane.
Outbound requests go from the browser directly to the AI provider — modified or blocked locally. There is no MITM in the request path.
The control plane sees event hashes, detector classes, decisions, and timestamps. Raw prompt text stays in the browser.
Default residency Azure South Africa North or AWS af-south-1. Enterprise customers may select EU, US, or VPC.
Rules can be disabled, relaxed, or hardened per department. Custom regex and entropy classes can be added on request during pilot.
| Detector | Class | Default severity | Default action |
|---|---|---|---|
| Credit Card (PAN) | Financial | critical | block |
| API Key / Bearer Token | Secret | critical | block |
| AWS Access Key | Secret | critical | block |
| Private Key (PEM) | Secret | critical | block |
| Database Connection String | Secret | critical | block |
| JWT | Secret | high | redact |
| SA ID Number | PII / POPIA | high | redact |
| SARS Tax Reference | PII / POPIA | high | redact |
| SA Passport | PII / POPIA | high | redact |
| SA Bank Account | Financial | high | redact |
| Medical Aid Number | PII / POPIA | high | redact |
| Password / Credential | Secret | critical | block |
| .env File Body | Secret | critical | block |
| IBAN | Financial | high | redact |
| Bulk Email List | PII | medium | log |
| High-Entropy Secret | Heuristic | critical | block |
Every prompt is inspected locally before transmission. 16 detector classes, sub-millisecond latency, zero outbound telemetry from the scanner itself.
SA ID, SARS tax, medical aid, and passport detectors run alongside international PII. DSAR tooling, consent log, cross-border transfer ledger.
Identify shadow AI usage by department. Drill into individual sessions, per-tool risk scores, and sanctioned vs unsanctioned tool inventory.
Author rules in a declarative editor. Approve, block, or redact by data class, destination tool, department, or time window. Versioned, audited, reviewable.
Azure AD, Okta, Google Workspace, OneLogin. SCIM 2.0 for user provisioning. Role-based access with least-privilege defaults.
MV3 extension for Chromium and Firefox. Central admin console. Managed deployment via group policy. No endpoint agent.
Every blocked prompt, every redaction, every cross-border transfer is recorded against a tamper-evident audit chain. Export a regulator pack for any date range.
Sign up, install the browser extension across your team, and start enforcing your DLP policy on every prompt your employees send to ChatGPT, Claude, Gemini, and 8 other AI tools. Block, redact, or just monitor — your call. POPIA-grade audit trail from day one.