Engine and control · Maskflare Detection Engine

Detect and Mask Sensitive Data Before It Reaches an AI Model

The detection and masking engine behind the gateway, SDKs, desktop agent and MCP masking: 574 built-in detectors, a local named-entity layer, your own rules, and Exact Data Match, applied to every prompt, file, tool call and response.

Start free trial Talk to us

28-day free trial or 10,000 requests, whichever comes first. No card needed.

Data stays in your boundary

01
Identify sensitive values
02
Replace with stable tokens
03
Restore only inside your boundary

574

Built-in detectors for personal data and secrets

Country packs, checksum-validated where the format has one

AI providers behind one gateway, plus the desktop agent and proxy

The problem

Data loss prevention historically watched email attachments and file uploads. It didn't anticipate an employee pasting a customer database into a chat window on a public AI tool, a channel most DLP policies were never written to inspect.

Generative AI tools made this worse specifically because pasting text feels lower-stakes than attaching a file, even when the content is identical: a spreadsheet full of customer records copied into a prompt leaves an organization's control just as completely as an email attachment would.

Regulated industries face this from both directions: DLP is often a compliance requirement rather than only a security preference, and auditors increasingly ask what controls exist for AI tool usage specifically, beyond traditional exfiltration channels.

How Maskflare Detection Engine works

The engine inspects every request that passes through Maskflare, whether it comes from the gateway, an SDK, the desktop agent, the forward proxy or an MCP route. It finds personal data, secrets and your own customer records, and applies each rule's action (mask, redact, partially show, hash, encrypt, alert or block) before the request reaches the AI provider. Masked values are restored in the response.

Benefits

Covers apps and people

Applications reach AI providers through the gateway; employees on ChatGPT and other AI tools are covered by the forward proxy, with no code change.

Validated, not keyword-guessed

IBANs, payment cards, and national IDs are checked against their real checksums, so a random number isn't masked as an ID.

Your data, matched exactly

Exact Data Match finds the names, emails, and account numbers in your own records without Maskflare ever holding them in clear text.

Secrets as well as personal data

232 credential formats, from cloud keys to private keys and database URLs, are caught before a prompt carries them out.

Explainable decisions

The console playground shows which rule matched any piece of text, and why a near-miss was rejected.

Monitor first, enforce later

Start a rule in alert mode to measure exposure, then switch it to mask or block when you're confident.

Capabilities

Built-in detectors

574 detectors across 47 country packs, plus credentials, healthcare identifiers, person names, addresses and a local named-entity layer.

Custom rules

Regex rules with context keywords, term dictionaries of up to 100,000 entries, and allowlists for known safe values.

Exact Data Match

Upload hashed values from your own datasets; matching runs on hashes, never on the clear values.

Per-rule actions

Mask, redact, partial, hash, format-preserving encryption, alert, or block, chosen rule by rule.

Files and documents

Optional malware gate, metadata stripping, and text scanning for PDF, Office, HTML, and e-mail attachments.

Explore related capabilities

See how Maskflare applies the same masking rules to related AI and data-protection workflows.

Maskflare AI Gateway Maskflare Forward Proxy Maskflare Exact Data Match Maskflare File Security Maskflare AI App Discovery & Control Maskflare User Coaching Maskflare Workforce Maskflare Browser Protection Maskflare Agent & MCP Security Maskflare Coding Agents Maskflare SDKs & API Maskflare Admin Console

Related guides and explainers

Frequently asked questions

What is data loss prevention (DLP)?

DLP is the practice of detecting and blocking sensitive data, like customer records or credentials, from leaving an organization's control through channels like email, file uploads, web forms, or AI tools.

Does it cover what employees type into ChatGPT?

Yes. Through the Workforce desktop agent or the forward proxy, prompts submitted to ChatGPT, Claude, Gemini, DeepSeek and Perplexity on the web are masked with the same rules as API traffic.

Can it detect data types beyond exact keyword matches?

Yes. It validates structure and checksums, so it catches payment card numbers, IBANs, government IDs, and API keys that a plain keyword list would miss, and ignores look-alike numbers that fail the checksum.

Can we run it in audit-only mode first?

Yes. Set a rule's action to alert. Matches are counted in the traffic log without changing the request, so you can measure exposure before masking or blocking.

Does it require an agent on employee devices?

It works with or without one. Applications use the gateway; on employee devices the Workforce desktop agent routes AI traffic through Maskflare, or the forward proxy does it without an agent.

Can different teams have different rules?

Yes. Rules are configured per environment, and each API key belongs to one environment, so different applications and teams can run different policies.

See it on your own data

Try Maskflare free.
Bring your hardest prompts.

28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.