Deltawall inspects every prompt and file upload inside the browser, at the point of interaction, and redacts or blocks sensitive data before it reaches ChatGPT, Claude, Gemini, Copilot, Perplexity or DeepSeek. No proxy. No TLS interception. Raw content never leaves the device.
Built against
People paste customer records, contracts, source code and credentials into AI assistants to get work done. The exposure happens inside the browser, in a text box or an upload field, before any file, network or endpoint control sees it.
That is last-mile data movement: file-less, encrypted in transit, and sent to sites your organisation has already approved. Blocking AI outright stops the productivity with it. Allowing it blind leaves the data exposure unmanaged and unprovable.
Six capabilities on one engine. The browser extension is both sensor and enforcer; the console receives labels and salted hashes, never content.
Prompts and files are classified in the browser before they are sent. Checksum, structure and context validators handle identifiers and secrets; an on-device model handles names, addresses and health data.
Five actions, applied at submit: Allow, Log, Warn, Redact and Block. A Warn can require a written business justification before the user proceeds, so a bypass is managed and recorded, not silent.
The file picker, drag-and-drop and paste all pass through one on-device scan with the same engine as prompts. A file that needs redaction is stopped, and the banner names the data classes found.
Rules combine department, data class, destination and channel, and resolve by priority to one of five actions. New rules run in simulation against live traffic before they enforce anything.
Every decision is hash-chained, sealed in Merkle batches and signed with Ed25519. Export a pack for any period; an auditor verifies it offline with a standalone tool, without Deltawall in the room.
The console shows AI interactions, detections, redactions and blocks over time, aggregated to department. No individual leaderboards exist in the product; unmasking a person needs a second approver and is itself logged.
The risk is a paste into a text box, inside an encrypted session, on a sanctioned site. Each layer of a modern stack is right about what it sees, and blind to that moment.
| Approach | What it secures well | What it misses | How Deltawall is different |
|---|---|---|---|
| SASE and SSE | Network access, connectivity and application-level policy | The prompt, the paste and the upload inside an encrypted session to a permitted site | Inspects the interaction in the page itself, before the request is sent |
| Proxy and SWG with TLS inspection | Routed web traffic, URL and category filtering | Requires a root certificate on every device and decrypts everything; still sees a request, not who typed what | No root certificate, no decryption, no rerouting. Enforcement runs inside the browser sandbox |
| CASB | Sanctioned SaaS through APIs: configuration, sharing and posture | Real-time text input into AI tools, and personal accounts that never touch the API | Acts on the prompt at submit, whichever account is signed in to the AI site |
| Endpoint DLP and EDR | Files, processes, devices and removable media | File-less actions: typed prompts and text pasted into a web form | Treats typed and pasted text as a first-class data flow, and scans files on the device before upload |
Deltawall complements these controls; it does not replace your network, identity or endpoint stack.
Twenty-one deterministic detectors, validated by checksum, structure or context, and an on-device model for the four classes no pattern can describe. Where a checksum matches, it overrides the model.
Redact or block regulated data, identifiers and secrets in prompts before they reach an AI provider.
Allow EU-resident AI, block unsanctioned or non-EU providers, per department and destination.
Scan documents on the device and stop sensitive files before the upload completes.
Put apps, scripts and agents behind the same policy through an OpenAI-compatible gateway.
Hand over a signed evidence pack that anyone can verify independently and offline.
Department-level reporting only, with four-eyes unmasking and a consultation pack.
No network rerouting, no certificates, no agents in the kernel. Deltawall installs the way every other managed browser extension does.
Distribute to Chrome, Edge and Firefox through your MDM or browser enterprise policy.
Start from GDPR baseline, Financial, Government or Education, then adjust to your data.
Run new rules against live traffic in simulation. Nothing is enforced until you promote them.
Switch rules to enforce, watch posture by department, and export signed evidence when asked.
A security product that hides its limits hands them to the attacker. Ours are in the contract.
A 30-minute technical walkthrough: a prompt redacted, a file stopped, the dashboard, and an evidence pack verified offline in front of you.
No slide deck. Synthetic data only.