This guide is written for the people who deploy and run PromptShields: IT admins, endpoint engineers, and security leads. If you are looking for end-user help, see Troubleshooting, which is written to be forwarded to a user.
The problem it solves
Staff paste customer records, contracts, credentials, and health data into ChatGPT, Claude, Copilot, and Gemini. Existing controls miss it:
The only practical place to inspect a prompt is in the input field, before submit — which is where PromptShields runs.
Three layers
Endpoint clients
A browser extension and two desktop agents watch focused text fields, detect sensitive content locally, and offer a redaction the user can accept or reject.
MDM
Your existing MDM is the delivery mechanism. It force-installs the clients so coverage does not depend on volunteers.
Admin console
Aggregates endpoint telemetry into activity, coaching, policy, and audit views — and forwards to your SIEM.
What runs where
The browser extension covers the majority of real-world AI usage and is the lightest thing to deploy. The desktop agents extend the same protection to native apps — desktop ChatGPT, Slack, Outlook, Word — that a browser extension cannot reach.
Start here
How it works
The detection pipeline, end to end, from keystroke to dashboard.
Data handling
Exactly what is collected, what never leaves the device, and how it is stored.
Deploy the browser extension
The fastest path to coverage. Start here for a pilot.
MDM rollout
Force-install policies for Intune, Jamf Pro, Kandji, and JumpCloud.
Integrations
Entra ID, Intune, Sentinel, Purview, Ardoq, and Slack — and how this fits alongside what you already own.
A realistic rollout
1
Pilot the browser extension
Deploy to a small group — IT plus one friendly department. Manual install is fine at this stage. See Browser extension.
2
Connect identity
Wire up Microsoft Entra ID SSO so activity is attributed to real users rather than anonymous devices. See Identity and access.
3
Observe before enforcing
Every policy starts in Guideline mode: it logs what it would have caught and changes nothing. Let it run. See Policies.
4
Push fleet-wide via MDM
Once the false-positive rate is understood, force-install across the fleet. See MDM rollout.
5
Promote policies to Strict
Turn on live redaction, with an approval gate and an automatic rollback watchdog.
6
Report
Pull a 30-day report for your director, and forward high-severity events to your SIEM. See Monitoring and reporting.