Engine and control · Maskflare Admin Console
One Console for Every Rule, Device, Key and Audit Trail
- 01
Identify sensitive values
- 02
Replace with stable tokens
- 03
Restore only inside your boundary
574
Built-in detectors for personal data and secrets
47
Country packs, checksum-validated where the format has one
9
AI providers behind one gateway, plus the desktop agent and proxy
The problem
When AI controls live in five places, nobody can say which rule applied to which request. Security asks one team, compliance asks another, and the answers don't match.
Auditors want evidence: which identifiers are covered, who changed a rule and when, and proof that prompts aren't being stored somewhere new.
How Maskflare Admin Console works
The Maskflare console holds everything behind the gateway, SDKs, desktop agent, browser protection and MCP masking. Each organization gets development, staging and production environments with their own rules and keys. Rule changes can require a second approver. The playground shows exactly why a value was or wasn't masked. Compliance profiles turn on a baseline for GDPR, UK GDPR, HIPAA Safe Harbor, PCI DSS or US PII in one click, and the coverage report shows which identifiers each regulation names and which rules cover them.
Benefits
Environments
Development, staging and production, each with its own rules and keys (mf_dev_, mf_stg_, mf_live_).
Four-eyes approval
Rule changes become proposals that a second person approves before they go live.
Explain any decision
Paste text into the playground to see which rule matched, and why a near-miss was rejected.
Compliance profiles
One-click baselines for GDPR, UK GDPR, HIPAA Safe Harbor, PCI DSS and US PII.
Coverage evidence
A coverage report for HIPAA's 18 identifiers and GDPR personal-data categories, exportable as CSV or PDF.
SSO and roles
Single sign-on, with owner, admin, security, developer and auditor roles.
Capabilities
Audit
Every configuration change writes an audit event. Export the audit trail as NDJSON for up to 366 days.
Traffic
Per-request metadata and counts by rule, exportable as NDJSON or CSV. Never prompts or values.
Webhooks
Signed webhooks for blocked requests, configuration changes, new API keys, policy changes and blocked files.
Devices and MCP
Device fleet status, enrollment tokens, registered MCP servers and file sandbox results in the same place.
What it does not do
We'd rather you hear it from us.
- Events go to Splunk, Microsoft Sentinel, Slack, Microsoft Teams and PagerDuty, plus a per-request event stream with metadata only.
Explore related capabilities
See how Maskflare applies the same masking rules to related AI and data-protection workflows.
Related guides and explainers
Frequently asked questions
Which roles are there?
Owner, admin, security, developer and auditor, so auditors can read evidence without changing rules.
Does the console support single sign-on?
Yes. Sign in with your identity provider and manage access by role.
Can we require approval for rule changes?
Yes. With four-eyes approval on, changes become proposals that a second person approves.
What can auditors export?
The audit trail as NDJSON for up to 366 days, traffic metadata as NDJSON or CSV, and the compliance coverage report as CSV or PDF.
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →