How Tracehold checks what your team sends to AI
Tracehold reviews what is sent to AI tools and, according to your policy, observes, warns, redacts or blocks it. When it finds nothing, the prompt goes through. The detection engine runs in the browser, and it deploys through the device management you already run.
What happens between "type" and "send"
Follow a message into an AI tool. The extension catches the send in the browser, reads what is being sent, applies your policy and records the result.
Employee types
A prompt with a secret
Browser
About to be sent
Scan in the browser
Content checked against the rules
Decision
Observe · warn · redact · block
AI vendor
Gets what your policy lets through
Three things every buyer wants to be sure of
Coverage, privacy and compliance: the questions a security or legal team asks before anything reaches production.
Coverage
The browser extension and the Windows and Linux agents follow your people from the browser to the desktop and the terminal. AI tools nobody approved show up as shadow AI, and you allow, review or block each one.
Privacy
The extension’s engine runs in the browser. The console receives event metadata plus a masked sample of the value, and keeping the content is off by default. With the optional LLM classifier (Governance plan, beta), the text travels in transit to the classifier and Tracehold does not store it.
Compliance
On the Governance plan, events are mapped to 39 controls across GDPR, the EU AI Act, DORA, NIS2, ISO 27001 and SOC 2. It supports your audits; it is not legal advice or a certification. Built in the EU and EU-hosted.
You decide on every prompt.
Full control.
Every prompt is checked in the browser before it is sent to an AI tool, and you decide exactly what happens to it next.
Deploy it the way you already deploy everything else
The console generates the managed-policy files (.reg, .ps1, .json) and the installer, and there is a guide for Intune.
The packages and the policy come from the console, and your device management deploys the extension like any other browser add-on.
The extension needs no proxy and no gateway: detection runs in the browser, so your network diagram stays as it is.
The Windows and Linux agents install separately, to go beyond the browser. On Linux, a clean install intercepts nothing until your policy turns it on.
It recognises the things that actually leak
1,600+ rules cover identity numbers, bank and card details, credentials, API keys, code and secrets, and your own keywords.
Identity numbers, IBANs and card numbers are also checked against their check digit. Sample values, not real data. See everything Tracehold detects.
The check happens before the request leaves
The extension intercepts the send in the browser, before the request leaves. If your policy warns, the person sees what was found and chooses whether to continue.
A dropped file gets the same check as a typed one
Attaching a config file, a spreadsheet of customers or a contract is one of the easiest ways data slips out. The extension reads the file in the browser, extracts its text (with OCR for images) and checks it before the upload. If your policy blocks what it finds, the upload does not go ahead, and the person sees why.
Policies tuned to what's sensitive for you
Beyond the rules everyone needs, you add your own keywords, such as internal codenames or customer identifiers, and choose what happens to each finding by data type, severity, team and destination.
Block
Stops the send and explains why to the user.
Redact
Swaps the sensitive value for a placeholder before sending.
Warn
The user sees what was found and chooses whether to continue.
Start in observe-only mode: nothing gets blocked
With the Observe action nothing is blocked and nobody is interrupted. You see what would have been caught, then turn on Warn, Redact or Block when you are ready.
These are the sectors Tracehold is built for: strict data rules, real consequences for a leak. We don't put names or logos here we haven't earned the right to show.