Skip to content
Maskflare
Talk to usStart free trial
Menu

For your people · Maskflare Workforce

Let Your Team Use ChatGPT. Keep the Customer Data at Home.

One agent on each laptop, rolled out through Intune, Jamf or Group Policy. AI traffic goes through Maskflare, where names, account numbers and API keys are masked before the prompt reaches the provider. Everything else on the device goes straight to the internet, untouched.
Start a device pilot Talk to us
28-day free trial or 10,000 requests, whichever comes first. No card needed.

What the employee types

Draft a reply to Ada Lovelace about her

refund of CHF 2,400 to card

4532 7781 0021 9047

IBAN CH93 0076 2011 6238 5295 7

Maskflare

What the AI provider receives

Draft a reply to mf_mask_170b about her

refund of mf_mask_9c2e to card

mf_mask_41af

IBAN mf_mask_d7e0

chatgpt.com · finance laptop · 4 values masked · nothing stored

574

Built-in detectors for personal data and secrets

47

Country packs, checksum-validated where the format has one

9

AI providers behind one gateway, plus the desktop agent and proxy

Sound familiar?

Why the usual answers fall short

“We banned ChatGPT.”

Usage didn't stop. It moved to personal accounts and phones, where you can't see it at all.

“Our DLP blocks it.”

Blocking the whole prompt stops the work too. People stop asking IT and find a workaround.

“We sent a policy round.”

Everyone signed it. Nobody remembers it on a busy Monday with a queue of customer emails.

Someone in finance pastes a customer complaint into ChatGPT and asks for a polite reply. The complaint includes the customer's name, IBAN and the last refund amount. In a company of 500 people that happens a hundred times a week, mostly in browsers IT has never looked at.

Banning the tools doesn't stop it; it moves it to personal phones. Classic DLP blocks the whole prompt, so people learn to work around it. What's missing is a control that lets the work happen and takes the sensitive values out.

How Maskflare Workforce works

The Maskflare agent runs as a small service on each company device. It sends traffic for AI hosts through Maskflare, where your rules mask personal data and secrets before the request reaches the provider, and real values are put back where the answer repeats them. Banking, email and every other site go direct and are never seen by Maskflare. The rules are the same ones your developers use through the gateway, managed in one console.

  1. 01

    Create an enrollment token

    In the Maskflare console under Devices. One token can enroll a whole pilot group.

  2. 02

    Push the agent

    An MSI through Intune or Group Policy on Windows, or a signed and notarized PKG with a configuration profile through Jamf or Intune on macOS. The installer reads the token from managed settings and enrolls itself.

  3. 03

    The device turns green

    It shows as Protected in the console and checks in every five minutes with its state and version, never the sites visited.

  4. 04

    Your policy applies

    Employees keep using ChatGPT, Claude, Gemini, DeepSeek and Perplexity. A tray notification tells them when something was masked.

Benefits

Masks, doesn't block

The prompt still goes out and the answer still comes back. OpenAI receives mf_mask_d7e0 where the IBAN was.

Only AI traffic

The agent routes the AI hosts on its list through Maskflare. Everything else on the laptop goes direct and unread.

Fails closed

If the agent can't reach Maskflare, AI sites are refused rather than sent unmasked. You can switch a policy to fail open.

Hard to switch off

If someone turns the proxy setting off, the agent puts it back within ten seconds. Uninstalling needs a one-time code from the console.

Tells people what happened

A tray icon shows Protected or Needs attention, and notifications say "3 items masked in ChatGPT" in plain language.

One console for everything

Devices, rules, approvals and the audit trail sit next to your gateway and MCP settings, with single sign-on and roles.

Capabilities

Operating systems

Windows x64 and ARM64 (MSI service), macOS (signed and notarized PKG, LaunchDaemon), and Linux desktops running GNOME on Ubuntu, Fedora and RHEL.

Deployment

Intune, Jamf and Group Policy. Windows reads its enrollment from the policy registry key; macOS uses managed preferences and a configuration profile that also installs your organization's certificate.

AI tools covered

ChatGPT, Claude, Gemini, DeepSeek and Perplexity on the web, plus desktop apps that call the OpenAI, Anthropic, Gemini, Mistral, xAI, DeepSeek, Groq or Together APIs through the system proxy.

Policy

Signed policies from the console, applied without a restart. The last good policy is cached for offline use.

Updates

Signed automatic updates with rollback if a new version fails to start.

Visibility

Per-device state (protected, unprotected, stale, revoked), agent version, last check-in and masked-value counts per app. Never the values themselves.

Set it up

Windows: silent install through Intune or GPO
msiexec /i MaskflareAgent-x64.msi /qn
# Enrollment token and server come from managed settings:
# HKLM\SOFTWARE\Policies\Maskflare\Agent
Manual enrollment (any OS)
MASKFLARE_ENROLLMENT_TOKEN=mfe_... maskflare-agent enroll -server https://app.maskflare.com

What it does not do

We'd rather you hear it from us.

Explore related capabilities

See how Maskflare applies the same masking rules to related AI and data-protection workflows.

Maskflare Detection EngineMaskflare AI GatewayMaskflare Forward ProxyMaskflare Exact Data MatchMaskflare File SecurityMaskflare AI App Discovery & ControlMaskflare User CoachingMaskflare Browser ProtectionMaskflare Agent & MCP SecurityMaskflare Coding AgentsMaskflare SDKs & APIMaskflare Admin Console

Related guides and explainers

Frequently asked questions

Does the agent see everything employees do online?

No. It only routes the AI hosts on its list through Maskflare. Banking, email and everything else go direct and are never seen by Maskflare.

What do employees notice?

A tray icon and the occasional notification when something is masked or blocked. ChatGPT and the other tools work as normal.

How many devices can we start with?

Most pilots start with a team of 10 to 50 devices and one enrollment token. The free trial covers a pilot group.

What does the console show per device?

Protected, unprotected, stale or revoked, plus agent version, last check-in and how many values were masked per app. Never the values themselves.

Does it work on personal devices?

It's installed by IT on company-managed devices. For people without one, the forward proxy covers managed browsers without an agent.

What happens if Maskflare is unreachable?

By default AI sites are refused rather than sent unmasked (fail closed). A policy can switch to fail open, which sends traffic directly while Maskflare is unreachable.

See it on your own data

Try Maskflare free.
Bring your hardest prompts.

28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.

Start free trial Talk to us