The AI DLP platform you operate. One console for the browser and the endpoint.
Tracehold is the product your security team buys and runs: a single console that deploys protection to every place your people reach AI, shows what is being caught, maps your AI use to the regulations, and turns it all into reports you can export. The detection engine runs in the browser; the console receives event metadata plus a masked sample of the value.
One platform. Three places it protects. One console to run it.
Tracehold covers the places your people hand data to an AI tool and brings what it finds back to a single screen.
Set once, in the console
You choose what happens when something sensitive is found: Observe, Warn, Redact or Block. The browser extension and the endpoint agents take their policy from the console.
Checked before it is sent
In the browser, the detection engine runs inside the extension and checks the prompt and attached files before they go out. The extension needs no proxy.
One place to operate
Policies, detections, incidents, shadow AI, reports and integrations live in one web console, available in English, Spanish and Dutch.
This page is the product. The mechanism has its own page.
The extension’s detection engine runs in the browser. The console receives event metadata (type of data, severity, destination, action) plus a masked sample of the value. For the step-by-step of what happens between typing and sending, see the dedicated page.
Browser and endpoint, one platform to run them
The platform ships as a browser extension and endpoint agents, both managed and reported from the same console. You decide which to roll out and when.
Browser extension
For Chrome, Edge and Firefox. The detection engine runs in the browser and checks prompts and attachments against more than 1,600 rules, on more than 300 AI tool domains. Tools nobody approved show up as shadow AI. See the plans →
Free edition, no account, for one person: Chrome Web Store · Firefox Add-ons
Windows agent
Takes the checks beyond the browser: USB drives, printing, screen captures of protected Office documents and on-demand file scans. It does not intercept the network. See the agents →
Linux agent
Covers AI tools in the terminal, such as Claude Code and Codex, if your policy turns it on, plus an optional local file scanner. A clean install intercepts nothing until the policy says so. See the agents →
The tool that protects your data is careful with it too
What reaches the console, and what does not.
Keeping the content of a finding is switched off by default. If you turn it on, it is stored encrypted.
Event metadata (type of data, severity, destination, action) plus a masked sample of the value, such as AKIA4F2X********8KDW.
Each customer’s data is isolated with Row-Level Security. Tracehold is built in the EU and EU-hosted.
Available on the Governance plan, in beta, and switched on per organisation. With it, the text travels in transit to the classifier and Tracehold does not store it.
Built in the EU, hosted in the EU.
Tracehold is built in the EU and EU-hosted, and on the Governance plan its compliance mapping covers GDPR, the EU AI Act, DORA, NIS2, ISO 27001 and SOC 2.
The single console you operate
Deploy the surfaces, set policy, watch the detections and pull the reports your team needs, all from one web console. The console is available in English, Spanish and Dutch.
Your starting page: the AI Exposure Score, the activity KPIs (Detections, Blocked, Redacted and sent, Open incidents) and a Needs review panel listing the people who need a look.
Choose what happens by data type, severity, team and destination, and add your own keywords to the library.
Alerts to Slack, Teams or your own webhook URL, SIEM over HTTPS, and sign-in with OIDC or LDAP/AD. See the integrations →
Every finding with its type of data, severity, destination and action. Correlation rules group repeated attempts into one incident, and threat hunting lets analysts follow a user’s activity.
AI tools nobody approved show up in one list. For each one you allow it, leave it under review or block it.
A clear, friendly trail of what was caught, where, and what we did about it.
The console above, for real — illustrative sample data.
Reports you can take to a meeting
Reporting turns the event stream into views you can read and export: detections, blocks and redactions over time, which AI tools people use, and which of them are shadow AI.
Illustrative simulation with sample data. Export the reports as PDF or CSV (JSON through the API), and send the events themselves to your SIEM over HTTPS.
Compliance mapping for your audits
On the Governance plan, Tracehold maps what your team does with AI to 39 controls across GDPR, the EU AI Act, DORA, NIS2, ISO 27001 and SOC 2. You see where you stand, what drives the risk, and you export the evidence for each framework as PDF or CSV.
The mapping supports your audits. It is not legal advice or a certification.
GDPR, the EU AI Act, DORA, NIS2, ISO 27001 and SOC 2, mapped on the Governance plan.
You see where you stand today and what drives the risk.
Export the evidence for each framework as PDF or CSV.
The mapping supports your audits. It is not legal advice or a certification.
Roll it out with the device management you already run
The extension needs no proxy and no network changes. The console generates the managed-policy files (.reg, .ps1, .json) and the installer, and there is a guide for Intune.
01 · Push the extension
The packages and the policy come from the console, and your MDM or GPO deploys them like any other browser extension.
02 · Start by observing
With the Observe action, Tracehold logs what it finds and interrupts nobody, so you see what your team shares with AI.
03 · Turn on enforcement, add agents
Move to Warn, Redact or Block when you are ready, and add the Windows or Linux agents to go beyond the browser.
The questions buyers ask first
Will my team even notice it’s there?
Where exactly does Tracehold protect us?
Do you store our prompts or our data?
How hard is it to set up?
Can it connect to the tools we already run?
What does it cost?
See it run against your own environment
Request a demo and we’ll show you, in your own setup, what would have been caught across the browser and the endpoint agents.