For your people · Maskflare Browser Protection
Mask What People Type Into ChatGPT, Claude and Gemini
What the employee types
Draft a reply to Ada Lovelace about her
refund of CHF 2,400 to card
4532 7781 0021 9047
IBAN CH93 0076 2011 6238 5295 7
What the AI provider receives
Draft a reply to mf_mask_170b about her
refund of mf_mask_9c2e to card
mf_mask_41af
IBAN mf_mask_d7e0
574
Built-in detectors for personal data and secrets
47
Country packs, checksum-validated where the format has one
9
AI providers behind one gateway, plus the desktop agent and proxy
Sound familiar?
Why the usual answers fall short
“We installed an extension.”
Useful, and Maskflare offers one too. The network path also covers Edge, Arc, Safari and the desktop apps.
“We'll train people.”
Training helps. It doesn't catch the IBAN pasted at 6 pm before a deadline.
“We only allow the Enterprise plan.”
Good, keep it. The data still reaches the provider. Masking keeps it out.
The browser is where most workplace AI use actually happens, and it's the channel traditional DLP sees least. A chat box doesn't look like a file upload, so policies written for attachments never fire.
Browser extensions help, but they cover one browser, can be disabled, and need their own rollout. Many companies would rather enforce it on the network path they already control.
How Maskflare Browser Protection works
Traffic to the covered AI web apps is routed through Maskflare by the desktop agent or the forward proxy. Maskflare reads the prompt and text attachments, masks personal data and customer records with your rules, blocks credential-shaped values, and forwards the rest. Where the answer repeats a masked value, Maskflare puts the real value back before it reaches the browser, so the reply still reads naturally.
Benefits
7 AI apps covered
ChatGPT, Claude, Gemini, DeepSeek, Perplexity, Mistral Le Chat and Microsoft 365 Copilot, including Perplexity's typing suggestions and Copilot attachments.
Credentials blocked
API keys, cloud keys, tokens and private keys pasted into a chat are blocked, not just masked.
File uploads checked
Text files are masked in place; PDF, Word, Excel and PowerPoint uploads are scanned, and images are read with OCR.
Per-app switches
Turn coverage on or off per app for your organization, for example while you pilot.
Any browser
Enforced on the network path, so Chrome, Edge, Firefox, Safari and Arc are covered alike.
Same rules everywhere
The rules your developers use through the gateway apply to people in the browser.
Capabilities
Uploads
Text files are masked in place. PDF, Word, Excel and PowerPoint uploads are scanned and blocked when they contain data your rules block. Encrypted files are refused.
Images
Image policy per organization: allow API images, allow all, block, or scan. Scanning reads English, German, French and Italian text with classic OCR, blacks out matches and refuses handwriting.
Delivery
Through the Workforce desktop agent on managed devices, or the forward proxy for managed browsers without an agent.
What it does not do
We'd rather you hear it from us.
- Files that can't be read, such as encrypted documents, are refused rather than sent unchecked.
- Unmanaged personal devices are out of reach; protect them through your access policies.
Explore related capabilities
See how Maskflare applies the same masking rules to related AI and data-protection workflows.
Related guides and explainers
Frequently asked questions
Is this a browser extension?
It doesn't need one. Protection is applied on the network path by the desktop agent or the forward proxy, so it covers every browser on the device. For teams that don't decrypt TLS, an optional browser extension for Chrome, Edge and Firefox is available.
Will ChatGPT's answer show the real values?
Where the answer repeats a value that was masked, Maskflare restores the real value before the reply reaches the browser. The provider itself only ever receives tokens.
What happens when someone pastes an API key?
Credential-shaped values are blocked and the prompt isn't sent. The employee sees why.
Which AI apps are covered?
ChatGPT, Claude, Gemini, DeepSeek, Perplexity, Mistral Le Chat and Microsoft 365 Copilot on the web, plus native AI desktop apps through the desktop agent.
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →