Start protecting AI in an afternoon. Built for your environment.
Four deployment paths. Pick one, or run them side by side.
Choose a path and start enforcing today.
- 01
SELECT
Choose PAC file, Browser Shield, API proxy or the self-hosted Connector based on where your AI traffic originates.
- 02
CONFIGURE
Set policies, risk thresholds and detector packs in the console — no code required.
- 03
DEPLOY
Push a file, install an extension or change one base URL. Typically no firewall change window, and you can start agentless with no endpoint deployment — each path is reversible.
- 04
EVIDENCE
Verdicts and decisions flow into the tamper-evident audit chain from day one.
What it does.
PAC file deployment
Generate a proxy auto-config file and push it via Windows GPO or macOS MDM.
Browser Shield extension
Manifest V3 extension for Chrome, Edge, Brave and Arc with local prompt inspection.
OpenAI-compatible API proxy
Change one base URL and every SDK call is governed without model or vendor lock-in.
Self-hosted Connector
Detection, threat heuristics and redaction execute on your own hardware; only policy and metadata sync with the console.
Mixed-mode operation
Run PAC, Browser Shield, API proxy and the Connector side by side for layered coverage.
Generated policy artifacts
.reg and .mobileconfig files are created automatically for managed rollout.
Same-day evidence
Audit-chain entries start accumulating the moment the first prompt is processed.
One line of code.
policy > "Switch the OpenAI SDK base URL to route every completion through XAIGuard"
client: OpenAI(base_url="https://api.xaiguard.com/v1")
model: "gpt-4o"
policy: "block-pii-and-secrets"
prompt_risk: HIGH — PII detected
verdict: "BLOCK_AND_REDACT"
audit_hash: "ed25519:7d1a…e03b"
Deployment is designed to be low-risk and reversible, not a six-month network project.
Four deployment paths. Built for your environment.
PAC file
- Generate a proxy auto-config file from the console.
- Push it with Windows GPO or macOS MDM.
- .reg and .mobileconfig files are generated for you.
- AI traffic routes through XAIGuard enforcement.
Good for: full org coverage without touching the network edge.
Browser Shield
- Install the Manifest V3 extension for Chrome, Edge, Brave or Arc.
- Prompts are inspected locally before submission.
- Six built-in detectors plus your custom patterns.
- Blocks are reported to your tenant and written to the audit chain.
Good for: fast pilots and BYOD.
Chrome Web Store listing is in review. The signed package is available for managed install today.
API proxy
- Use the OpenAI-compatible endpoint.
- Change one base URL in your SDK or agent code.
- Every model call is scored, redacted or blocked.
- Works with any model that speaks the OpenAI chat format.
Good for: your own applications and agents.
XAIGuard Connector (self-hosted)
Runs inside your network. Prompts never leave it.
Install the XAIGuard Connector on your own infrastructure and enforcement happens locally — pattern detection, threat heuristics and redaction all execute on your hardware. Only policy and metadata sync with the console, and you can run it fully offline in metadata-only mode where no prompt content is transmitted at all.
- Deploy with Docker, Docker Compose or as a Windows service.
- Enroll the connector against your tenant with an enrolment key.
- Point your applications, agents or SWG at the local connector endpoint.
- Verdicts and metadata sync to the console and into the audit chain.
- Local enforcement — detection and redaction run on your hardware
- Provider-aware parsing for OpenAI, Anthropic, Google Gemini, AWS Bedrock, Azure OpenAI, Cohere and Mistral
- Streaming response inspection, not just request-time checks
- Local threat heuristics: injection, jailbreak, exfiltration and model-extraction patterns
- Metadata-only and offline modes
- Fail-closed behaviour when policy cannot be reached
- Fleet registry with heartbeat and health in the console
Good for: organisations whose information-security policy forbids sending prompt content to a vendor.
A signed Windows MSI is in progress; today the connector installs via Docker, Docker Compose or a PowerShell-installed Windows service. Coverage depends on your traffic actually reaching the connector — either by repointing applications directly or by routing through it from your secure web gateway.
Pick the fit for your environment.
| Criteria | PAC file | Browser Shield | API proxy | Connector (self-hosted) |
|---|---|---|---|---|
| Coverage | All browser AI traffic | Browser-based assistants | Your apps and agents | Anything you route to it |
| Setup time | Hours | Minutes | Minutes | Hours |
| Network change required | No | No | No | No |
| Works off-network | No | Yes | Yes | Yes |
| Prompt content leaves your network | Yes | Yes | Yes | No |
| Best for | Full org rollout | Fast pilots / BYOD | Custom applications | Strict data-residency policies |
From pilot to evidence in three weeks.
Pilot group
Deploy Browser Shield or API proxy to a small team and run first prompts.
Policy tuning
Tune thresholds, add custom detectors and review false positives.
Org-wide
Roll out PAC file or push extension to all users and agents.
First evidence export
Generate a signed evidence package for auditors or board review.