Secure Access to AI Tools
Let Your Team Use ChatGPT Without Leaking Customer Data
Blocking external AI tools outright pushes usage to personal devices and accounts, where there's no visibility at all. The realistic goal isn't to stop usage. It's to keep the sensitive parts of a prompt from leaving.
The Maskflare desktop agent does that on the machine. An account manager pastes a customer email into ChatGPT; the name, email address, and IBAN are masked before the prompt is sent, and the answer shows the real values again where it repeats them.
- 01
AI traffic from devices
- 02
AI hosts inspected and masked
- 03
Other sites tunnelled unread
Why the usual approach falls short
Traditional DLP watches email and file uploads. It can't see text pasted into a chat box, which is exactly where employees now put customer data every day.
The Maskflare approach
Roll out the Maskflare desktop agent with Intune, Jamf, or Group Policy on Windows, macOS, or Linux. It self-enrolls, routes only AI hosts through Maskflare, and sends everything else direct. Browser protection masks text typed into ChatGPT, Claude, Gemini, DeepSeek, and Perplexity before it reaches the provider, blocks credential-shaped values, and restores the real values where the answer repeats them. Apps on the device that call the provider APIs through the system proxy get the same rules as your gateway traffic.
Benefits
Visibility into a previously blind channel
The traffic log shows which rules matched in prompts and how often, without storing the prompts. The tray app tells the user, for example, "3 items masked in ChatGPT".
Policy, not prohibition
Keep the tools your team wants; mask, alert on, or block only the sensitive parts of a prompt.
Real values in the answer
Masked values are restored where the answer repeats them, so a drafted reply still addresses Ada Lovelace by name.
Hard to switch off
Fail-closed by default. A watchdog re-applies the proxy setting within 10 seconds, and uninstalling needs a one-time code from the console.
Same rules everywhere
People on the desktop agent and applications on the gateway share one rule set per environment.
Built on
Understand the underlying risks
Frequently asked questions
Which AI tools does the desktop agent cover?
ChatGPT, Claude, Gemini, DeepSeek, Perplexity, Mistral Le Chat and Microsoft 365 Copilot on the web, native AI desktop apps, and apps that call the OpenAI, Anthropic, Gemini, Mistral, xAI, DeepSeek, Groq, or Together AI APIs.
Does it catch text pasted into the chat box, or only files?
Both. Text typed or pasted into the prompt is masked with your rules. Text files are masked the same way, PDF and Office uploads are scanned, and images can be allowed, blocked, or scanned with OCR.
How do we deploy it?
Create an enrollment token in the console and push the agent with Intune, Jamf, or Group Policy as managed settings. It self-enrolls, and the console shows each device as protected, unprotected, stale, or revoked.
Does the reply show the real values again?
Yes. Values masked on the way out are restored where the answer repeats them, in the browser as well as in applications on the gateway.
Can we start in monitoring mode?
Yes. Set a rule's action to alert: matches are counted in the traffic log without changing the prompt, so you can measure exposure before masking or blocking.
Does the agent see employees' other browsing?
No. Only AI hosts are routed through Maskflare; all other traffic goes direct. The heartbeat every five minutes reports state and version, never URLs or traffic.
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →