Sign in Request a demo
Live demo EU-hosted

Your data. In AI. Tracked.

Your team uses generative AI every day, and so does your sensitive data. Tracehold checks every prompt in the browser before it is sent and, depending on your policy, logs it, warns the user, redacts the sensitive part or blocks the send.

Request a demo See how it works

Just for yourself? The free extension protects your own browser. No account needed.

Chrome Web Store · Firefox Add-ons · Edge installs the Chrome version.

chatly.ai

What’s up today?

This panel is an illustrative simulation with sample data for demonstration purposes only. It is not a live customer conversation, and the extension's mode switcher, review popover and today’s stats shown here are demo controls, not connected to a real account.

Want this running on your own data?
No credit card. No spam.
[ In-flight action ]

The right policy for every finding

Not everything gets blocked. Tracehold matches the response to the risk, in real time.

Allow

No sensitive data detected. The prompt goes through untouched.

ana@acme.io allowed

Observe

Content is flagged and logged. The user is not interrupted.

ana@acme.io logged

Redact

Sensitive values are replaced with placeholders before the prompt is sent.

ana@acme.io [email] redacted

Block

The request is stopped. The user sees why.

ana@acme.io blocked
What changes on day one

You decide on every prompt.
Full control.

Every prompt is checked in the browser before it reaches any generative AI tool, and your policy decides what happens to it next.

Prompt
Deploy with my!ps4wr90d
Tracehold · in the browser
Scanning…
AI vendors
Approved AI tool or shadow AI
Platform log
metadata + masked sample
[ From prompt to policy ]

Tracehold understands AI traffic

Every prompt passes through four stages in the browser, before it reaches any AI tool.

See the full pipeline
01

Classify the destination

Approved AI tool or shadow AI.

02

Inspect the content

Prompt and attachments checked against more than 1,600 rules: identity numbers, bank and card details, credentials and API keys.

03

Enforce the policy

Block, redact, warn or log, based on severity and destination.

04

Register and analyse

Each event reaches the console as metadata (data type, severity, destination, action) plus a masked sample. It feeds alerts, reports and your SIEM.

Security console Live demo

Detections & incidents

Last 24h
Critical
3
High
11
Medium
24
Detections / hour
Recent activity
PPS · 4829163UAChatGPT Blocked 2m
AWS key · AKIA4F2X…Claude Redacted 6m
Patient recordGemini Blocked 11m
Source code · repoCopilot Logged 18m
[ The engine ]

A detection engine that runs in the browser

More than 1,600 rules check what people type, paste and upload to AI tools. Patterns, check-digit validation, heuristics and nearby context decide what counts as a finding. Then your policy decides what happens.

Prompt text
Several languages
EN Share our prod AWS key AKIA4F2X with the vendor.
ES Envía el IBAN de Ana, ES91 2100 0418 4502 0005 1332, al proveedor externo.
FR Mon IBAN est FR85 1756 9000 3040 5319 0002 D96.
Tracehold engine
Rules, check digits and context · in the browser
1,600+
Detection rules
IBAN Card numbers API keys & tokens National IDs Health data + more
Matching in the browser
Optional LLM classifierBeta
Detection — your way
Fully configurable per company
What to detect
Identity data (ID numbers, passports, phones)
Bank & card details
Secrets & credentials
Infrastructure & secrets files
Confidentiality markings
Your own keywords

Add any term your company must keep confidential or private.

Project Atlas Employee no. pricing_2026 Client code Add keyword

Check digits and context

Rules validate check digits and read nearby context, so there are fewer false alarms.

Many countries

National ID numbers, bank and card details recognised across countries.

1,600+ built-in rules

Identity numbers, bank and card details, credentials and API keys.

Your own keywords

Add project code names, client codes or internal product names, one by one or from a CSV.

LLM classifierBeta

Optional second layer on top of the rules, switched on per organisation. Governance plan. The text travels in transit and Tracehold does not store it.

[ Capabilities ]

One platform to govern every AI

Explore the product

Shadow AI discovery

Which AI tools are in use, by whom, and whether each one is allowed.

In-flight inspection

Deep analysis of prompts and files before anything is sent.

Severity policies

Block, warn, redact or log, based on team, destination and data type.

Audit & SIEM

Events and reports for your audits, with SIEM export over HTTPS (Splunk HEC or CEF).

Beyond the browser

Windows and Linux endpoint agents extend protection to USB drives, printing, screen captures of protected Office documents and AI coding tools in the terminal, not just the browser.

Correlation & incidents

Chain repeated or patterned detections, like a slow drip of exfiltration attempts, into a single security incident instead of scattered alerts.
[ Live detection ]

See what slips through. Then stop it

Tracehold catches sensitive data and unapproved AI in real time, in the browser.

Detections today
Live demo
1,284
Personal data
612
Secrets & keys
207
Source code
143
Financials
98
Intellectual property
421
Attachments
Shadow AI discovered
38

Unapproved AI tools in use · recognised across more than 300 AI tool domains.

ChatGPT Approved
Claude Approved
Perplexity Review
DeepSeek Shadow AI

This panel is an illustrative live-demo simulation with sample application names, for demonstration purposes only. It is not a real customer's data.

[ The evidence ]

What a single careless paste really costs

You don’t have to take our word for it. Independent research puts hard numbers on what happens when sensitive data reaches AI tools unchecked, and on what prevention is worth.

$4.44M
Average cost of a data breach

The global average across the 600 breached organisations studied in IBM’s 2025 report, before regulatory fines and lost business are fully counted.

IBM Cost of a Data Breach 2025
+$670K
Extra cost when shadow AI is involved

Breaches involving unsanctioned AI tools averaged $4.63M, and 97% of organisations hit by an AI-related incident lacked proper AI access controls.

IBM X-Force analysis
€7.1B
GDPR fines issued since 2018

European regulators issued around €1.2 billion in fines in 2025 alone, and personal-data breach notifications now run at 443 per day across Europe.

DLA Piper GDPR survey 2026
223 / mo
Sensitive pastes per company

Organisations detect an average of 223 monthly attempts to put regulated data, source code or credentials into generative-AI prompts.

Netskope GenAI report 2025

All figures come from independent third-party research. Sources open in a new tab.

[ Why it matters ]

Evidence for your audits

With Governance, findings are mapped to 39 controls across six frameworks, with a report you can export for each one. The mapping is product guidance, not legal advice. These reports support your audits; they are not a certification of Tracehold.

300+
AI tool domains recognised

Tools nobody approved show up as shadow AI.

Optional
Endpoint agents

Push the browser extension with your usual device management. The Windows and Linux agents are optional.

Masked
What the console receives

By default prompt text is not sent to the console: only metadata, a masked sample and, from endpoint agents, a short masked excerpt.

EU
Hosted in the EU

Each organisation’s data is kept apart with PostgreSQL row-level security.

39 controls across six frameworks
EU AI Act 8 controls

Governance maps findings to 8 EU AI Act controls and exports a report for it. The console keeps a register of the AI tools in use.

DORA 6 controls

Governance maps findings to 6 DORA controls and exports a report for it.

NIS2 4 controls

Governance maps findings to 4 NIS2 controls. For an incident you open a NIS2 report on, the console tracks the indicative Article 23 deadlines (24 hours, 72 hours, 30 days). It never notifies an authority on your behalf.

GDPR 10 controls

Governance maps findings to 10 GDPR controls. Special categories (Art. 9), such as religion or political opinion, are flagged only when a personal identifier is nearby.

ISO 27001 6 controls

Governance maps findings to 6 ISO 27001 controls and exports a report for it.

SOC 2 5 controls

Governance maps findings to 5 SOC 2 controls and exports a report for it.

[ FAQ ]

Questions buyers ask first

Will my team notice it?
Only when something sensitive is about to be sent. People keep using AI tools as usual. Tracehold steps in, according to your policy, with a short explanation of what it found and why.
What about AI tools we haven’t approved?
Tracehold recognises more than 300 AI tool domains. Tools in use that nobody approved appear as shadow AI in the console, where you can allow, review or block each one.
Do you store our prompts?
By default, prompt text is not sent to the console: it receives metadata, a masked sample and, from endpoint agents, a short masked excerpt. Text reaches Tracehold only if an optional feature has been switched on for your organisation, all off by default: the LLM classifier (Governance plan, beta; text in transit, not stored), keeping the content of findings, or the file fallbacks.
How is it rolled out?
You push the browser extension with your usual device management. The console generates the managed policy files (.reg, .ps1, .json) for it and offers the Windows agent as an MSI installer. The documentation includes a Microsoft Intune guide. The Windows and Linux agents are optional.
Does it help with GDPR and the EU AI Act?
Governance maps findings to 39 controls across GDPR, the EU AI Act, DORA, NIS2, ISO 27001 and SOC 2, and exports a report for each framework. It supports your audits; it is not legal advice or a certification.
What does it cost?
The free extension costs nothing. Insight and Governance are priced per user and quoted for your team. See the pricing page or ask us for a quote.
[ GET STARTED ]

Take control of AI in your company

Book a demo, or leave your work email and we’ll get back to you.

Request a demo See pricing

Or just leave your email and we'll reach out

No credit card. No spam.

Or try our free browser extension

For one person in one browser. It blocks passwords, API keys and common personal data before they reach ChatGPT, Claude, Gemini or Copilot, up to 3 blocks every 5 hours. No account needed.

Good to know: it has no console, team policies or reports: those come with Insight and Governance.

Chrome Web Store Install Firefox Add-ons Install

Using Edge? Install it from the Chrome Web Store.