Inspect. Block.
Stay SAFE.
One agent on every device checks each prompt sent to an AI service, in any browser, desktop app or terminal, and stops credentials, personal data, source code and prompt injection before they leave.
Clean prompts pass the core. Risky ones stop at the ring.Seven steps from a paste to a leak. SAFE breaks four of them.
A secret reaches an AI provider in a fixed order. SAFE sits on the device, so it acts before the prompt is gone rather than after.
Paste
A key, a customer record or a file goes into a prompt.
UserSend
A browser, desktop app, IDE or script sends the request.
Any programCapture
The agent takes the connection at the network layer. Only AI services are opened.
SAFE agentInspect
Fifteen request formats parsed; 23 categories checked, including screenshots and documents.
SAFE detectionDecide
Findings are scored by category and origin into allow, warn or block.
SAFE policyStop
The request ends on the live connection. The user is told why, and whom to ask.
SAFE enforcementLeak
Without a control, the provider now holds the data for good.
PreventedOne agent, one console, signed policy between them.
Everything that decides runs on the device. The server collects metadata and distributes policy; it is never on a request's path.
Endpoint agent
Runs in the background from boot and covers every browser, app and terminal on the machine.
- Cannot be stopped by a standard user
- QUIC and Encrypted Client Hello closed
- Names the program behind each request
Detection engine
Rules where the format is fixed, models where it is not.
- Vendor keys with real checksums
- Personal data with Presidio and spaCy
- Injection rules plus a classifier
Policy and risk
One action per detector, published from the console and verified on every device.
- Ed25519-signed bundles
- Block applications by program
- Hash allowlists for approved keys
Management console
Activity flow, AI agent inventory, findings and endpoints, with roles and an audit log.
- Endpoint to verdict, at a glance
- Allow or block AI agents
- Works on phones and tablets
Evidence vault
Prompts kept for incident response are sealed on the device before they are stored.
- X25519 with AES-256-GCM
- Only the IR key opens them
- Every view is logged
Governance mapping
Controls mapped to AI-governance frameworks, with event counts as evidence.
- ISO/IEC 42001 and NIST AI RMF
- ISO 27001, GDPR, OWASP, ATLAS
- CSV export for auditors
Why inspect on the endpoint.
Each place you can watch AI use sees a different slice of it. These are the typical properties of each approach, not claims about any one product.
| Browser extension | Network gateway | SAFE endpoint agent | |
|---|---|---|---|
| Sees desktop apps, IDEs and terminals | ✕ No | ◐ If routed through it | ✓ Yes |
| Works off the company network | ✓ Yes | ◐ Needs a tunnel | ✓ Yes |
| Reads tool results an AI agent sends back | ✕ No | ◐ Varies | ✓ Yes |
| Knows which program sent the request | ◐ Browser only | ✕ No | ✓ Yes |
| Decides before the prompt leaves the device | ✓ Yes | ✕ After it leaves | ✓ Yes |
Results on a held-out test split.
1,371 synthetic prompts, written without access to the detector and split once into tuning and test halves. These are the test numbers, including the categories that miss.
Precision and recall per category
| Category | Tier | n | Precision | Recall | Target |
|---|
Vendor keys: 100% on all nine
AWS, GitHub, Google, OpenAI, Anthropic, Slack, Stripe, JWT and database URIs scored 100% precision and recall. Each had fewer than 20 test examples, so the chart leaves them out rather than overstate the evidence.
Where it falls short
- Names: 56% precision. The language model reads code identifiers and non-English words as names.
- Prompt injection: 67% precision, 59% recall, and the next detector to improve.
- Generic secrets and passwords: recall of 68% and 74%.
Every format, the same answer
All seven text request formats returned identical findings on the test set: browser, API and IDE alike.
See every AI conversation your fleet has. Not its content.
The flow from endpoint to application to AI service to verdict, every program seen using AI with its risk, and the findings behind each block. Built from metadata; the console never sees a prompt.
Mapped to ISO/IEC 42001 and five more frameworks.
Each control is marked implemented, partial or a gap, with the evidence behind it, and the console counts the events that evidence it. A mapping, not a certification.
Controls by status
Gaps, stated
- ISO 27001 8.11: SAFE blocks or warns; it does not mask a prompt.
- OWASP LLM05: AI responses are not inspected yet.
- GDPR Art. 35: deploying SAFE monitors employees, so it needs a DPIA and a lawful basis.
A monitoring tool that holds as little as it can.
Only AI traffic is opened
Banking, email and everything else on the device pass through unread.
No prompt text in logs
Events record the decision, the kinds of data found and the program. Nothing else.
Evidence sealed on device
Encrypted to the incident-response team's key before it is stored anywhere.
Signed, verified policy
Devices keep the last verified policy, so they never fall back to allowing everything.
Three scripts on Windows 11.
Run each from the project folder. Protecting a device asks for administrator rights.
Start the console
Creates the admin account and signing key, then serves the console on port 9100.
server-setup.batstart-server.batJoin a device
Installs the agent, trusts its certificate and joins with a token from the console.
client-setup.batRun in the background
Starts SAFE at boot for every user, browser and app on the machine.
service-install.batWhat's next for SAFE.
Where SAFE does not reach yet, and what is being built to close it.
- Response inspectionCheck what models send back, including streamed replies, for leaked secrets and malicious links.
- Stronger injection detectionA larger training set and a better classifier for the weakest detector today.
- Users and models on every eventWho sent each prompt and to which model, for rules like "block this model for this team".
- Gemini and local modelsCoverage for Gemini's web transport, and inspection of prompts sent to Ollama and LM Studio.
- Enterprise rolloutMSI packaging, code signing and deployment through Intune and Group Policy.
- Certificate-pinned appsApps that refuse inspection, such as the ChatGPT desktop app, blocked by policy instead.