For your people · Maskflare AI App Discovery & Control
See Every AI App Your Team Uses. Decide Which Ones Stay.
- 01
AI traffic from devices
- 02
AI hosts inspected and masked
- 03
Other sites tunnelled unread
574
Built-in detectors for personal data and secrets
47
Country packs, checksum-validated where the format has one
9
AI providers behind one gateway, plus the desktop agent and proxy
Sound familiar?
Why the usual answers fall short
“We have a list of approved AI tools.”
Good. Discovery shows you what's in use outside that list, and how much.
“Our firewall blocks the big ones.”
There are hundreds of AI apps, and new ones every week. A static blocklist is always behind.
“We'll ask employees in a survey.”
Surveys miss the tools people don't think of as AI, like the assistant inside a PDF editor.
Ask a security team which AI tools their company uses and they'll name three. Look at the traffic and there are thirty: chat assistants, meeting note-takers, writing tools, image generators, coding agents, and AI features inside apps people already had. Most were never reviewed, and some send data to vendors in jurisdictions nobody approved.
Blocking everything doesn't work either. People move to their phones and personal accounts, and you lose sight of the usage completely. What you need first is an honest inventory, then a decision per app that people can actually follow.
How Maskflare AI App Discovery & Control works
The desktop agent recognizes connections to a catalogue of AI apps and records which app was used, by which device and user, when, and how much was uploaded. It does this without decrypting the traffic and without recording addresses or content. The console turns that into an inventory: every AI app in use, its category, users, devices, first and last seen, upload volume and a risk score. For each app you choose a status: approved apps work normally under your masking rules, tolerated apps work with a reminder to keep company data out, and blocked apps are refused with a message that points people to the approved alternative.
- 01
Roll out the desktop agent
Push it with Intune, Jamf or Group Policy. Discovery starts with the first heartbeat, in monitor mode.
- 02
Review the inventory
After a week you see every AI app in use, sorted by users, upload volume and risk.
- 03
Decide per app
Mark apps approved, tolerated or blocked, and name the approved alternative for each category.
- 04
Guide people
Blocked and tolerated apps show a short message with your AI policy link, so people know what to use instead.
Benefits
A real inventory
Every AI app used on managed devices, with users, devices, first seen, last seen and upload volume.
Risk score per app
Vendor jurisdiction, whether it trains on your data, its security posture and whether an enterprise plan exists, each with its source.
Approved, tolerated or blocked
One decision per app, applied on every managed device within one policy sync.
Personal vs company accounts
Allow your ChatGPT, Claude or Gemini workspace and block personal accounts, or mask more strictly on them.
Approved alternatives
Blocked apps point people to the tool you want them to use, instead of just saying no.
Privacy for employees
No prompts, URLs or browsing history are recorded, and you can show departments instead of names.
Capabilities
AI app catalogue
Chat assistants, coding agents, meeting and writing tools, image and video generators, AI search and AI features built into SaaS apps, each with vendor facts and sources.
Usage dashboard
Adoption over time, top apps, share of traffic going to approved apps, and sensitive data found per app.
Account detection
Tells corporate workspaces from personal accounts in ChatGPT, Claude and Gemini, so policy can differ.
Policy and approvals
Blocking is immediate; loosening a block goes through four-eyes approval, and every change is in the audit log.
Alerts
New AI apps and blocked attempts can go to Slack, Microsoft Teams or your SIEM.
What it does not do
We'd rather you hear it from us.
- Discovery covers managed devices with the desktop agent; personal phones and unmanaged laptops are out of reach.
- It records which AI app was used, not what was typed. Masking and coaching handle the content.
Explore related capabilities
See how Maskflare applies the same masking rules to related AI and data-protection workflows.
Related guides and explainers
Frequently asked questions
What does AI app discovery record?
The app, the device and signed-in user, the time and the amount uploaded. It never records prompts, page addresses or general browsing.
Does discovery need TLS inspection?
No. Apps are recognized from the connection itself, so discovery works without decrypting traffic. Masking content in the covered AI apps uses TLS inspection on AI traffic only.
How is the risk score calculated?
From four factors: where the vendor is based, whether it trains on customer data, its published security posture, and whether it offers an enterprise plan. The highest factor sets the score, and each factor links to its source.
Can we block personal ChatGPT accounts but allow our Enterprise workspace?
Yes. Maskflare tells company workspaces from personal accounts in ChatGPT, Claude and Gemini, and you choose to allow, block or mask more strictly on personal accounts.
What do employees see when an app is blocked?
A short notification naming the app, your message and your AI policy link, plus the approved alternative you chose.
Can we hide employee names?
Yes. An organization setting shows departments and devices instead of names in the inventory and dashboard.
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →