Seven components. One policy. One evidence log.
Deltawall secures the last mile of AI usage: the moment a person types or uploads into an AI tool. Inspection and enforcement happen in the browser; governance and evidence happen in the console.
How the platform is built.
Each component does one job. Together they move a decision from the page to a signed record without moving the content.
Browser extension
Manifest V3 for Chrome, Edge and Firefox. Detects, evaluates policy, then redacts or blocks inside the page.
Detection engine
Twenty-one deterministic detectors and an on-device model. Where a checksum matches, it overrides the model.
Policy engine
A rule language, evaluator and simulator, with four ready-made EU compliance templates.
Evidence log
Hash chain, Merkle seals and Ed25519 signatures, with a standalone offline verifier.
Management console
Multi-tenant web console with role-based access, backed by PostgreSQL, hosted in the EU region you choose.
AI gateway
An OpenAI-compatible endpoint that applies the same policy and redaction to apps, scripts and agents.
From a keystroke to a signed record, in the page.
Nothing in this path decrypts traffic, reroutes the network or runs below the browser sandbox.
- A person types or uploads into a covered AI site
- The extension classifies the content on the device
- The policy engine resolves department, data class and destination to one action
- Redact or Block happens in the page, before the request leaves
- Only the label, a salted hash and metadata are recorded
- The record is chained, sealed and signed in the evidence log
Desktop AI apps, governed through your MDM.
MDM policy bundles
Export an AppLocker policy, a DNS blocklist or a Jamf profile to allow or block ChatGPT Desktop, Claude Desktop, DeepSeek Desktop and Microsoft Copilot.
- Governed, never intercepted
- A Redact rule on the desktop channel returns an error rather than silently downgrading
Supply-chain hygiene
A CycloneDX SBOM for every artifact, a dependency audit gate, container image scanning and a Cyber Resilience Act incident workflow.
- No kernel components anywhere in the product
- User mode and browser sandbox only
The platform, counted.
What Deltawall does not do. Printed on purpose.
A security product that hides its limits hands them to the attacker. Ours are in the contract.
- No OCR.Scanned PDFs and images are flagged as uninspectable, not read. Your policy decides what happens to them.
- Redaction applies to typed prompts.The user presses send again after masking. A file that needs redaction is stopped, not rewritten.
- Desktop apps are governed, not intercepted.MDM policy bundles block or allow them. A Redact rule on the desktop channel returns an error; it never silently downgrades.
- The model runs in Chrome and Edge.Firefox enforces with the deterministic detector layer.
- Coverage is bounded to the listed AI sites.Six today: ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity and DeepSeek. The contract names them.
- It fails open.If the upload guard or the model errors or times out, the AI site keeps working. A broken scanner never breaks the workday.
- SSO is on the roadmap.Sign-in today is email and magic link. OIDC single sign-on is built but not yet offered.
- Shadow-AI discovery is on the roadmap.The ingest API exists; it needs a DNS or metadata feed before it can report anything, so we do not sell it yet.
See it stop real-looking data in a real browser.
A 30-minute technical walkthrough: a prompt redacted, a file stopped, the dashboard, and an evidence pack verified offline in front of you.
No slide deck. Synthetic data only.
