Stop sensitive data before it
reaches any AI.
Seven detection layers run inside the browser — blocking PII, PHI, credentials, and classified data from reaching ChatGPT, Copilot, Gemini, and every other LLM. No prompt content ever leaves the endpoint. Verifiable in DevTools.
- Standalone SSNs are now caught every time — we closed a length-threshold gap that let bare 9-digit SSNs slip through on ChatGPT and Perplexity.
- Interception hardened across ChatGPT, Perplexity, and other modern AI editors — submit-button capture now fires on pointerdown and reads contenteditable fields correctly, so nothing slips past the guard.
How It Works
Seven detection layers, all in the browser
Every paste event runs through a tiered pipeline — fastest methods first, format-agnostic extractors for what patterns miss, local heuristics for edge cases only. No cloud model. No inference API. No prompt content transmitted at any stage.
Regex Fast-Pass
< 1ms · client-side
45+ compiled patterns — SSNs, credit cards (Luhn-verified), routing numbers, classification markings, ITAR/EAR, CJIS case numbers. Catches obfuscation: spacing, partial redaction, homoglyphs, leetspeak.
Format-Agnostic SSN
catches what regex misses
Extracts any 9-digit sequence regardless of separators — spaced, mixed, obfuscated, reversed, or OCR-corrupted — and validates it as a real SSN. The layer that catches what patterns miss.
Format-Agnostic Identifiers
structure-validated
Validates credit cards (Luhn), phone numbers, EINs, routing numbers, MRNs, and account numbers even when formatting is non-standard or stripped of separators.
Regulated Industry IDs
sector-specific
NDC drug codes, CUSIP/ISIN securities, ICD-10 and CPT medical codes, SCADA/NERC CIP asset tags — identifiers unique to healthcare, finance, and energy sectors.
Entropy + Encoding
< 5ms · client-side
Shannon entropy flags high-entropy secrets — API keys, AES/RSA key material, JWT/OAuth tokens — without a recognizable pattern. Decodes Base64, hex, URL-encoding, and ROT-13.
Contextual Lexicon
< 50ms · client-side
A context-aware lexicon across every industry — names, medical conditions, financial IDs, personnel records, legal privilege. Requires corroboration so a name alone doesn’t false-positive.
Semantic + Bypass
edge cases · client-side
A local decision tree scores intent — distinguishing test data from real PII. Detects jailbreaks, exfil channels, delimiter injection, and many-shot priming that pattern matching misses.
"No Prompt Content Leaves the Endpoint" — Technically Proven
Skeptical? Good. Every claim below is independently verifiable using standard browser developer tools — no trust required.
Data Flow Architecture — Every prompt interception step
Air-Gapped / Offline Deployment Available
An offline deployment bundle is available on request — no cloud connectivity required post-install. All detection model weights, policy definitions, and the extension are delivered via GPO/MDM from your internal software distribution server.
Champion vs. Challenger
Watch the 4-layer detection engine race through both prompts in real time — see exactly which layer fires, why it blocked, and what a safe alternative looks like.
Can you help me look up employee John Smith, SSN 523-45-7890, in our HR system?
Can you help me look up employee John Smith in our HR system? I need to verify his benefits eligibility.
This live arena runs the same detection logic as the deployed APEX AI Guardrails extension — fully client-side, zero data transmitted.
What APEX GuardRail Covers
A browser-first AI DLP. Here is exactly what is in scope — and an honest list of what is not — so you can decide if it fits your environment.
| Capability | YOUR PLATFORMAPEX GuardRail |
|---|---|
| Privacy & Data Architecture | |
| No prompt content leaves endpoint (DevTools-verifiable) | |
| Air-gapped / offline deployment | |
| Open source code for IT audit | |
| HMAC-signed tamper-evident audit log | |
| Government-Specific Coverage | |
| CJIS criminal justice data | |
| CUI / FOUO / classified markings | |
| ITAR / EAR export-controlled data | |
| NIST SP 800-53 AC-4 / SI-19 alignment docs | |
| Adversarial / Bypass Detection | |
| Jailbreak & DAN-style attacks | |
| Many-shot priming attacks | |
| Function-call / JSON injection | |
| Exfiltration channel detection (mailto, webhooks) | |
| Obfuscation: Base64 / leetspeak / reversed / URL-encoded | |
| Deployment & Management | |
| Browser extension (Chrome / Edge / Firefox) | |
| Deploy via Intune / GPO / PDQ / Kaseya | |
| Flat-rate pricing (no per-seat) | |
| SIEM log export (CEF / JSON) | |
| ⚠Not Included — Honest Scope | |
| ML/transformer NER for unstructured free-text PII | |
| Data-at-rest classification (SharePoint / OneDrive / DBs) | |
| API-gateway protection for custom GenAI apps | |
| SaaS-stack scanning (Slack / GitHub / Jira) | |
| Insider-risk / behavioral analytics | |
| Mobile & desktop-app coverage | |
The Bottom Line
For organizations that cannot send data to a third-party cloud for classification (CJIS, HIPAA, air-gapped environments), GuardRail is purpose-built for the dimensions that matter most: privacy architecture, government-specific categories, bypass detection, audit defensibility, and flat-rate pricing. It is a browser-first AI DLP — not a full-suite at-rest data classification or insider-risk platform. We position as the zero-exfiltration alternative for AI prompt leakage, complementing (not replacing) any broader DLP stack.
What It Blocks
Twelve categories. One interceptor.
Coverage spans every sensitive-information classification across all industries — PII, healthcare, financial, credentials, legal, government, infrastructure, and the attacks designed to evade detection. Each is a category of AI data leak GuardRail stops before it reaches ChatGPT, Copilot, Gemini, Claude, or Perplexity.
Personal Identifiers
- SSNs
- Passport & visa numbers
- Driver’s license
- Date of birth + name
Healthcare (HIPAA)
- PHI / medical records
- MRN & patient IDs
- Mental health & substance abuse
- ICD-10, NDC, CPT codes
Financial (PCI / GLBA)
- PAN / credit cards
- ACH routing & account
- IBAN / SWIFT / BIC
- EINs & TINs
Credentials & Secrets
- API keys & JWT/OAuth tokens
- AES-256 / RSA private keys
- AWS / GitHub / Slack tokens
- Database connection strings
Corporate Confidential
- Trade secrets & IP
- M&A and board material
- Source code & schemas
- Customer & pricing lists
Legal & Compliance
- Attorney-client privilege
- Grand jury / case material
- Export-controlled (ITAR/EAR)
- CUI / classified markings
Government & Public Sector
- CJIS records & case numbers
- FBI/ORI/NCIC identifiers
- IRS 1075 Federal Tax Info
- FERPA student records
Infrastructure
- Internal IP / IPv6 / CIDR
- VPN & firewall configs
- SCADA / NERC CIP assets
- MAC addresses
Personnel & HR
- Salary & compensation
- Termination & PIP records
- Employee badge / CAC / PIV
- EEO complaints
Attack & Bypass
- Jailbreaks (DAN, crescendo)
- Delimiter & XML injection
- Many-shot priming
- Exfil webhooks & mailto
Exfiltration Channels
- External webhook URLs
- mailto: data smuggling
- Data URI payloads
- Encoded redirect links
Obfuscation
- Reversed / spaced strings
- Base64 / hex / URL-encoded
- Unicode homoglyphs
- Leetspeak variants
The real detection engine runs the same code your staff’s browsers will.
Why teams choose GuardRail
Built for teams that can't send data to the cloud
Zero exfiltration, by architecture
No prompt content ever leaves the endpoint — verifiable in DevTools. Air-gapped offline mode available for classified environments.
Deploys in an afternoon
A browser extension pushed via Intune, GPO, or PowerShell. No agents, no proxies, no network changes — zero-touch to Chrome, Edge, and Firefox.
Flat-rate, organization-wide
No per-seat pricing, no data-volume tiers. One subscription covers every browser in your organization.
- Works across all major LLM interfaces — ChatGPT, Copilot, Gemini, Claude, Grok, Perplexity, and more
- Tamper-evident audit log — SHA-256 hashed metadata only, no raw content stored
- SIEM-compatible log export (CEF / JSON)
- NIST SP 800-53 AC-4, SI-12 & SI-19 alignment documentation
- Prompt injection & jailbreak detection (DAN, crescendo, role-play)
- Obfuscation decoding — Base64, hex, URL-encoded, homoglyphs, leetspeak
- Configurable allow-list for approved AI systems (zero-trust mode)
- Shadow AI discovery — ingest MDM/Intune exports to risk-rank every AI tool in use
Ready to Stop Sensitive Data
Leakage to Public LLMs?
AI GuardRail is included with every APEX AI Guardrails subscription — no separate add-on fee. Organization-wide coverage, no per-seat pricing.