See what leaves your company for AI. Stop what shouldn't.
GardLayer checks every prompt and upload before it reaches an AI tool. Personal data and secrets are masked or blocked, and every decision is recorded.
No credit card.
Checkpoint
Edit this text or paste your own. The check runs as you type.
What the AI tool receives
Findings and decisions
Sent with masking. Findings: 4
| Type | Excerpt | Decision |
|---|---|---|
| NIK | 3271 •••••••• 0004 | |
| Phone | 0812 •••• 7890 | |
| r•••@contoh.co.id | ||
| Card | 4111 •••••••• 1111 |
Decisions apply per data type, like a policy in GardLayer.
Runs in your browser. Your text is not sent anywhere.
This demo recognises five kinds of data. GardLayer's scanner recognises more.
From keystroke to audit record
A prompt passes four steps before it reaches an AI tool.
Intercept
The browser extension, desktop agent or LLM gateway catches prompts and file uploads before they are sent to an AI tool.
The original prompt
Please reply to this complaint. The customer's NIK is 3271052503900004, email rina.wulandari@contoh.co.id.
Classify
The scanner looks for NIK, card numbers, API keys, credentials and other personal data inside text or files.
Two findings
Please reply to this complaint. The customer's NIK is 3271052503900004, email rina.wulandari@contoh.co.id.
Decide
Your policy picks one decision per finding. The rule with the highest priority wins, and for one message the strictest result applies.
What the AI tool receives
Please reply to this complaint. The customer's NIK is [masked: NIK], email rina.wulandari@contoh.co.id.
- NIKMask
- EmailAllow
Record
Every decision enters the audit log with the data type, tool, rule and time. Extension telemetry does not carry the prompt text.
A log entry
- Event
- prompt_submit
- Tool
- chatgpt
- Data types
- nik, email
- Decision
- Mask
- Text length
- 106 characters
One policy, four decisions
The same finding can end four ways. This table shows what the employee, the AI tool and the audit log receive in the browser extension.
Finding: a NIK inside a prompt
Allow
- Employee
- The message is sent without interruption.
- AI tool
- The original text.
- Audit log
- Recorded as allowed.
Mask
- Employee
- The text in the input box is replaced with a marker, then sent.
- AI tool
- The text with [MASKED:NIK] where the NIK was.
- Audit log
- Recorded as masked, with the data type.
Warn
- Employee
- A warning dialog: cancel, continue, or flag it as a false positive.
- AI tool
- The original text, only if the employee chooses to continue.
- Audit log
- Recorded as warned.
Block
- Employee
- The message is not sent. The notice names company policy as the reason.
- AI tool
- Receives nothing.
- Audit log
- Recorded as blocked.
What it recognises
32 AI tools and 102 domains are recognised from DNS logs and browser traffic. Each tool has a profile: vendor, data residency, retention, and whether its data trains models.
AI tools
- General assistants15 tools
- ChatGPT,
- Claude,
- Gemini,
- Microsoft Copilot,
- DeepSeek,
- Grok,
- Poe,
- Character.AI,
- Hugging Face Chat,
- Mistral Le Chat,
- Cohere Playground,
- Bard,
- Qwen,
- Pi,
- Meta AI
- Code assistants2 tools
- GitHub Copilot,
- Phind
- Research assistants3 tools
- Perplexity AI,
- You.com,
- Bing Copilot
- Image generators3 tools
- Midjourney,
- Stable Diffusion,
- Runway
- Writing assistants4 tools
- Notion AI,
- Grammarly Go,
- Jasper,
- Copy.ai
- Coding agents in the terminal5 tools
- Claude Code,
- Aider,
- GitHub Copilot CLI,
- Cursor CLI,
- Continue
Data it looks for
- Indonesian personal data: NIK, KK, NPWP, BPJS, driver's licence, passport, phone numbers
- Card numbers and financial identifiers
- Medical data
- API keys, tokens and cloud credentials
- Source code and database connection strings
- Prompt-injection and jailbreak attempts
Evidence for auditors
Every decision is recorded. This is how the audit log looks in the console.
| Time | Tool | User (hash) | Data types | Decision | Rule |
|---|---|---|---|---|---|
| 09:41:07 | chatgpt | u_7f3a91c2 | nik | Masked | r-pii-id |
| 09:42:30 | claude | u_2b80d4e1 | aws_secret_key | Blocked | r-secrets |
| 09:44:52 | copilot | u_c91e5a07 | Allowed | r-email-ok | |
| 09:47:03 | gemini | u_7f3a91c2 | nik, phone | Masked | r-pii-id |
| 09:51:18 | perplexity | u_58d2e3b9 | credit_card | Warned | r-card-warn |
Duties this log supports
- UU PDP Article 46
- A personal-data protection failure is notified in writing within 3 x 24 hours. The log shows when the event happened, through which tool, and which data types were involved.
- GDPR Article 33
- A personal-data breach is reported to the authority within 72 hours of becoming aware of it. The log gives you the starting point for that timeline.
- UU PDP Article 57
- Administrative fines can reach up to 2% of annual revenue. A record of controls in operation helps show that protection efforts were made.
GardLayer is not yet SOC 2 certified. The product includes a SOC 2 readiness assessment to help you prepare your own audit.
Plans
Every plan starts with a 30-day trial. Prices are confirmed in a written quote before you pay anything.
| Feature | Starter | Pro | Business | Enterprise | Government |
|---|---|---|---|---|---|
| GardLens shadow-AI discovery | Included | Included | Included | Included | Included |
| Browser extension DLP | Included | Included | Included | Included | Included |
| GardWall LLM gateway | Not included | Included | Included | Included | Included |
| Desktop proxy agent | Not included | Included | Included | Included | Included |
| Custom classifiers | Not included | Not included | Included | Included | Included |
| Data discovery (DSPM) connectors | Not included | Not included | Included | Included | Included |
| Email and Slack/Teams DLP | Not included | Not included | Included | Included | Included |
| User behavior analytics | Not included | Not included | Included | Included | Included |
| GardPosture asset inventory and posture | Not included | Not included | Not included | Included | Included |
| SSO (OIDC/SAML) and SCIM | Not included | Not included | Not included | Included | Included |
| SIEM forwarding | Not included | Not included | Not included | Included | Included |
| MCP gateway | Not included | Not included | Not included | Included | Included |
| Self-hosted deployment | Not included | Not included | Not included | Included | Included |
| Users | Licensed seats | Licensed seats | Licensed seats | By agreement | By agreement |
| Support and SLA | By agreement | By agreement | |||
| Choose a plan | Start the 30-day trial | Contact us | Contact us | Contact us | Contact us |
Book a 30-minute demo
Our team walks you through the same checkpoint with your own data, then answers security and compliance questions.
Or email hello@gardlayer.com.