Useful tools. Unchecked traffic.
Employees may use AI services directly in their browsers or apps. A policy document alone does not inspect the requests leaving those tools.
SURFACEDIFF / AI GUARD PROPOSED PRODUCT
Forward Proxy / Secure Web Gateway · AI DLP
Keep your AI tools.
Inspect what
you send.
A planned selective AI proxy with AI DLP for existing AI websites and supported apps. Steer only approved AI destinations through it with proxy settings or your internal DNS, inspect requests with authorized TLS inspection, enforce your data policies and forward approved traffic while employees keep their familiar tools.
In market validation. Not available yet. No payment required to register interest.
MANAGED DEVICES & NETWORKAI domains steered by proxy settings or internal DNS
AI GUARD PLANNED
01 Decrypt supported TLS traffic
02 Inspect content & apply policy
03 Re-encrypt & forward approved requests
ALLOWBLOCKREDACTREVIEW
BLOCKED / AWAITING APPROVAL
Request is not forwarded to the provider.
APPROVED REQUESTS ONLY
ChatGPTClaudeGeminiAI APIs
Illustrative destinations. Inspection requires trusted managed devices and routed traffic. Service compatibility and policy actions remain to be validated.
The conversation we want to have
AI is already in the workflow.
Where are the checks?
If your teams already use AI websites and apps, we want to understand how you control what they send through those existing workflows.
A useful prompt can reveal too much.
A client document, a spreadsheet or a pasted credential can contain information that should not reach an external model.
A policy needs more than a document.
When someone asks what was sent, which rule applied or why a request was allowed, a defensible answer matters.
The proposed approach
Put the policy check
in the traffic path.
AI Guard is intended to sit between managed devices and supported AI services: receive the traffic, inspect supported requests, enforce policy and forward approved content. These are planned capabilities, not features available today.
Steer only AI traffic to the proxy
Configure an explicit proxy for selected AI destinations on managed devices, or let your internal DNS answer for approved AI domains with the AI Guard address. Employees keep using the same websites, and traffic to other destinations is not routed to AI Guard. HTTPS inspection requires devices to trust the organization's inspection CA, for example deployed by group policy, and encrypted DNS and QUIC should be controlled by device and network policy.
EXPLICIT PROXY · SELECTIVE DNS STEERING · AUTHORIZED TLS INSPECTIONInspect content before forwarding it
Check supported payloads for secrets, credentials, PII and organization-defined sensitive data. Combine deterministic rules with local embeddings or a local LLM where needed. A separate policy engine would decide the action; service and content-format support still need validation.
SECRETS / PII / LOCAL SEMANTIC DLPEnforce the decision. Keep the evidence.
Forward only permitted requests over a separate, validated TLS connection. Blocked or unapproved requests would not reach the AI provider. The administration portal would manage proxy policies, users and groups, and security audit records. Captured-content access would be a separate permission.
POLICY ENFORCEMENT / ADMINISTRATION / SECURITY AUDITDeployment directions under consideration
Choose where control should live.
SurfaceDiff Cloud
A managed inspection service for configured devices and routed traffic. Decrypted content would be processed in the hosting environment. Data location, routing and trust requirements would be agreed before a pilot.
Inside your infrastructure
Deploy the proxy and DLP inspection inside your network on a future VM appliance. Your internal DNS would point approved AI domains at the appliance, so the rest of your traffic never touches it. Approved requests would be re-encrypted and sent to the AI provider. Hardware and throughput requirements still need validation.
Who we want to learn from
For the people
responsible for AI use.
Managed Service Providers
Supporting clients that need data checks in their existing AI traffic. Tell us about managed-device deployment, certificate trust, repeatable policies and client separation. Multi-customer administration remains a future direction.
Businesses with 30–250 employees
IT and security leaders handling client information or sensitive business documents who want to evaluate controls around the AI websites and apps their teams already use.
Pricing to test, not a price list
Would this justify a budget?
We are testing the following monthly subscription hypotheses for proxy-based protection. Users, devices, traffic scope, onboarding and pilot terms are not finalized. Existing AI subscriptions and any API usage would remain separate provider costs.
Starter SaaS
$149 / month
Hypothesis: hosted proxy policies for a defined set of supported AI traffic.
Discuss a Paid PilotBusiness SaaS
$349 / month
Hypothesis: deeper inspection, policy and audit workflows for supported services.
Discuss a Paid PilotPrivate Appliance
from $499 / month
Starting-price hypothesis: a privately deployed inspection proxy, with scope and infrastructure costs to be defined.
Discuss a Paid PilotNot available for purchase. No checkout, payment or automatic subscription.
Early-access research program
Help define what
is worth building.
Tell us how your organization uses AI and what needs to change. Request updates on early access, or discuss the conditions under which you would consider a paid pilot.
- 01 Share your challenge.
- 02 Explore fit in a discovery conversation.
- 03 If there is a fit, define a conditional pilot.
No product access or response time is guaranteed. No commitment is created by this form.
Clear expectations
Questions before the conversation.
Can we use AI Guard today?
No. AI Guard is a proposed product in market validation. We are speaking with potential customers before deciding what to build. Early-access requests do not create an account, guarantee access or promise a launch date.
What does a paid-pilot discussion involve?
A conversation about your workflow, success criteria, deployment preference and an indicative budget. Any future pilot would require an agreed scope, conditions, price and written terms. This form does not charge you or create a subscription.
Would employees need to switch to a new AI workspace?
The main goal is to inspect supported traffic to the AI services employees already use. A replacement chat portal is not required by this concept. Compatibility with each website, client and request format still needs validation.
How would AI traffic reach AI Guard?
Two proposed options. With an explicit proxy, managed browsers or devices are configured (for example by PAC file or group policy) to send selected AI destinations through AI Guard. With selective DNS steering, your internal DNS answers for approved AI domains with the AI Guard address, so employees keep using the same websites without changing anything. Neither option removes the certificate-trust requirement for HTTPS inspection.
Does AI Guard see all of our web traffic?
Not in the selective modes. Only the AI destinations you choose to steer would reach AI Guard; banking, email and other traffic would not be routed to it. Shared CDN or sign-in endpoints may need explicit mapping, and AI features built into other products, such as office suites or collaboration tools, are not covered by AI-domain steering.
Can employees bypass it?
Steering chooses the route; it does not guarantee that every request is inspected. Browser or app-level encrypted DNS, QUIC/HTTP3, other resolvers, VPNs, personal hotspots and devices outside the company network can bypass it unless they are restricted by device and network policy. Remote laptops would need an always-on VPN. We would document what is and is not covered for each pilot.
How would HTTPS traffic be inspected?
Authorized TLS inspection requires managed devices to trust the organization's inspection certificate authority. The proxy would terminate the client TLS connection, inspect supported content and establish a separate, validated TLS connection to the provider. It does not break TLS encryption without that trust arrangement.
Would personal AI accounts be covered?
A personal or company account could be in scope when its supported traffic passes through the managed proxy and organizational policy permits inspection. Traffic that bypasses the proxy is outside its coverage. Account ownership alone does not establish coverage.
Would every AI website, app and upload work?
No universal compatibility is promised. Certificate pinning, additional application-layer encryption, request formats and protocols such as QUIC/HTTP3 can affect inspection. Supported services and actions must be tested individually; unsupported traffic would need an explicit bypass or blocking policy.
What would the web portal be for?
The planned portal is for administrators: configure proxy access, users and groups, destination policies, DLP rules, audit and retention. A separate chat interface could be considered later; employees would not need to move into a new chat portal for the proxy concept.
Does local DLP mean no data ever leaves our network?
No. In a planned private deployment, inspection could run locally. If you choose an external AI provider, content allowed by policy would still be sent to that provider. Local inspection does not make external API use local.
Could it guarantee that confidential data never leaks?
No. Detection can miss sensitive material or flag harmless text. The proposed approach combines detection signals with explicit policies; its effectiveness would need independent testing. No accuracy, compliance certification or prevention guarantee is claimed.
Where would inspection happen?
In a private deployment, TLS inspection and DLP could run in your infrastructure. In a hosted deployment, decrypted content would be processed in the hosting environment. Deployment options and MSP administration are being evaluated, not offered as available editions.
Do we need SurfaceDiff EASM?
No. AI Guard is intended to be independently licensed. Existing SurfaceDiff EASM monitoring is a separate product.
SURFACEDIFF AI GUARD / MARKET VALIDATIONWhere should your AI traffic
Where should your AI traffic
meet your data policies?
Tell us which services and workflows need protection.