PromptGuard
PromptGuard is an inline LLM firewall that inspects each request before it reaches the model, blocking or redacting prompt injection, jailbreaks and PII leaks. It runs as managed cloud, self-hosted VPC or air-gapped for teams operating AI in production.
What is PromptGuard?
PromptGuard is an LLM firewall: an inline security gateway placed between an application and its model provider. The request is judged first and forwarded second, so a blocked prompt was never sent to the model and a redacted value was never transmitted. Every decision is written down.
The engine holds 15 detectors, 10 always on and 5 optional, arranged in six sequential layers over more than a thousand patterns: adversarial text normalisation, deterministic pattern matching, machine-learning classification, LLM-based content safety, multi-turn intent drift and policy evaluation. The deterministic fast path returns in under 10 milliseconds; requests escalated to the ML ensemble are network-bound.
Four integration methods are offered. SDK auto-instrumentation protects existing provider calls from a single init line. The Guard API scans content directly and returns a structured verdict. An HTTP proxy needs only a base-URL change. A GitHub scanner finds unprotected LLM calls in a repository and opens corrective pull requests. Twelve provider adapters are registered, from OpenAI, Anthropic and Gemini to Azure, Bedrock, Mistral, Cohere, DeepSeek, Groq, HuggingFace, Ollama and vLLM.
The same engine ships in three deployment modes: managed cloud, self-hosted hybrid through Helm or docker-compose, and air-gapped, where licences are validated offline against an Ed25519-signed key.
Detection figures are published with their datasets. The benchmark reports an F1 of 0.887 over 2,369 samples drawn from eight datasets, five of them independently published (TensorTrust ICLR 2024, In-the-Wild Jailbreaks ACM CCS 2024, JailbreakBench NeurIPS 2024, XSTest NAACL 2024, deepset/prompt-injections), with a 95% confidence interval of 0.874 to 0.900, precision of 99.1% (10 false positives on 991 benign inputs) and recall of 80.3% (271 attacks missed out of 1,378). An in-house evasion suite caught 100 obfuscated attacks out of 100, against 80 out of 100 for an ML classifier alone.
Coverage is stated with its gaps: five OWASP LLM Top 10 risks are fully covered and five partially, each partial line naming what is missing. The 37 threat types in the engine each carry a CWE and an OWASP LLM identifier, and 36 of them an OWASP Agentic category as well. A second product on the same platform, Shadow AI, covers the AI employees use directly, through a browser extension and macOS, Windows and Linux desktop agents. An independent evaluation by Artifact Security, an AMTSO board member, is under way; the technical whitepaper is version 3.0, dated March 2026.
What it does
- Block prompt injection and jailbreak attempts before the request reaches the model
- Detect and mask 43 types of personally identifiable information in prompts and responses
- Catch data exfiltration attempts and the theft of secrets and API keys
- Validate agent tool calls and detect privilege escalation
- Scan documents retrieved by a RAG pipeline for indirect injection
- Apply a versioned policy, previewed in shadow mode, and export a signed audit trail of every decision
- Discover and govern employee use of public AI through the Shadow AI browser extension and desktop agent
When to use PromptGuard / When not to
A quick filter to help you decide if PromptGuard is the right fit.
When to use PromptGuard
- Engineering teams putting an LLM application into production who need to show a security reviewer exactly what is filtered and why.
- Regulated organisations whose security review checks named, verifiable controls rather than a compliance badge.
- Companies that cannot let prompts leave their perimeter, and need the same engine self-hosted in their own VPC or fully air-gapped.
- Teams running autonomous tool-calling agents, where tool calls, MCP traffic and unauthorised sub-agents have to be validated.
- Teams operating RAG pipelines exposed to indirect injection through retrieved documents, and wanting protection without a rewrite: one init line or a base-URL change.
When not to use PromptGuard
- Teams whose traffic is mostly non-English: the detection pipeline is optimised for English and its accuracy has not been formally evaluated in other languages.
- Buyers who need a signed SLA or a certification: 99.9% uptime is a stated target, and no SOC 2 or ISO 27001 certification is claimed anywhere on the site.
- Organisations looking for a spend cap or denial-of-wallet defence: this is not covered, rate limits being applied at the load balancer.
- Teams that need provenance verification for models, adapters, datasets or packages, or code scanning beyond Python, JavaScript and TypeScript (Go, Rust and Java are unsupported).
- Buyers expecting self-hosted or air-gapped deployment on a self-service basis: both are Enterprise-only and require coordination with the vendor's team.
How to use PromptGuard
A typical end-to-end flow, from setup to results.
- Register an account: the free tier activates immediately, no credit card is required, and an API key is issued on activation. The vendor times full protection at under two minutes.
- Install the SDK from the standard package managers (npm install promptguard-sdk, pip install promptguard-sdk), or call the REST API from any language.
- Route 1, auto-instrumentation: import promptguard, then call promptguard.init with your pg_live key. Existing OpenAI, Anthropic, Gemini, Azure, Bedrock and Cohere calls are protected without editing a single call site.
- Route 2, Guard API: send the content to be scanned and receive a structured decision (threat type, confidence score, event identifier) while keeping your own call to the model.
- Route 3, HTTP proxy: change the base URL. The shape of the request stays the one your provider expects.
- Route 4, GitHub scanner: install the GitHub App, which flags unprotected LLM calls in a repository and opens corrective pull requests.
- Configure the detectors, the sensitivity level (moderate preset by default with the ML threshold at 0.8, strict at 0.6, permissive at 0.9), redaction patterns, custom rules and rate limits.
- Preview any policy change in shadow mode on a sample of traffic, read the report of verdicts that would move, then apply it: each apply writes a new numbered version, and loosening a rule must be explicitly acknowledged.
- Set the failure behaviour, fail-open to let traffic through or fail-closed to block it, then monitor the real-time dashboard: threats blocked, requests analysed, exportable audit logs, and false-positive or false-negative feedback that recalibrates detection.
- Run the built-in red team suite, 21 vectors across 8 categories, from the Security Testing page of the dashboard or through its API endpoint. For Shadow AI, deploy the desktop agent (signed and notarised .dmg for macOS, .exe or .msi for Windows in early access, AppImage or .deb for Linux) and the browser extension, enrolling the fleet with a revocable identifier.
Pros & Cons
Pros
- Detection figures are published with their dataset, sample size and confidence interval, including the ones that do not flatter the product.
- Gaps are named rather than hidden: five OWASP LLM Top 10 lines are marked partial with the missing piece spelled out, and the About page carries an explicit limitations section.
- One engine in three deployments, including a fully air-gapped mode with no outbound connection at all.
- Integration without a rewrite: a single init line or a base-URL change, and a deterministic fast path under 10 ms, negligible against a model call of 1 to 10 seconds.
- A permanent free tier of 10,000 requests per month with no credit card, and pricing that separates volume only: ML detection, content safety and multi-turn analysis are on every plan.
- Zero-retention mode available on every tier, with metadata-only logs.
- Versioned policy with shadow-mode preview and refusal of unacknowledged loosening, an exportable HMAC-SHA256-signed audit trail, and an independent evaluation by Artifact Security, an AMTSO board member, currently under way.
Cons
- Recall of 80.3% at the default preset, meaning 271 attacks missed out of 1,378 samples, and an F1 that swings widely by dataset: above 0.99 on explicit injections, 0.64 on deepset/prompt-injections.
- Detection is optimised for English, and accuracy in other languages has not been formally evaluated.
- No certification is claimed (SOC 2, ISO 27001), and the 99.9% uptime figure is an objective rather than a signed SLA.
- The 100% evasion score comes from a suite written by the vendor itself, not from an independent benchmark.
- Self-hosted and air-gapped deployments are Enterprise-only and not self-service, requiring coordination with the vendor's team.
- No spend cap or denial-of-wallet defence, no provenance verification for models, adapters, datasets or packages, and code scanning limited to Python, JavaScript and TypeScript.
- No postal address and no full legal entity name are published on the site, and latency is unbounded on escalated requests: the hosted Inference API can cold-start beyond 500 ms.
Pricing & Plans
A permanent free plan is available: 10,000 requests per month at no cost and without a credit card, which the vendor states is not a time-limited trial. The lowest paid entry point is the Pro plan at USD 99.00 per month for 100,000 requests, followed by Scale at USD 199.00 per month for 1,000,000 requests as a soft limit; Enterprise pricing is set by contract. A monthly and annual billing toggle is offered on the pricing page. Payment is accepted by Visa, Mastercard and American Express, with invoicing available on request for Enterprise. A 14-day money-back guarantee applies to any new subscription, cancellation is self-service from the dashboard and the service stays active until the end of the billed period. On overage, requests are blocked on Free and Pro while traffic keeps flowing on Scale and Enterprise.
- 10
- 000 requests
- prompt injection and PII detection
- ML detection
- personal Shadow AI on one device
- basic dashboard
- 1 API key and 1 project
- 24-hour log retention
- 100
- 000 requests
- the full detector set (exfiltration
- toxicity
- fraud
- secrets
- malware)
- custom policies
- 1
- 000
- 000 requests as a soft limit
- advanced analytics
- fleet Shadow AI with MDM
- unlimited keys and projects
- 30-day retention
- priority support within 24 hours.
- OIDC single sign-on
- audit logs
- IP allow-listing
- custom volume and retention
- zero-retention mode
- dedicated support under a 4-hour SLA
- employee Shadow AI DLP across browser and desktop fleets
- and self-hosted
- ML detection
- LLM-based detection
- content safety classification
- multi-turn drift analysis
- confidence scores and zero-retention mode.
Data, GDPR & hosting
A consolidated view of how PromptGuard handles your data.
GDPR overview
The privacy policy, effective March 2026, cites GDPR legal bases (contract performance, legitimate interests, legal obligations, and consent where required) and provides for international transfers under standard contractual clauses. GDPR and CCPA rights are recognised where applicable, subject to identity verification and legal exceptions, and the vendor reserves the right to refuse a request where the law permits or where it would harm system integrity. Data processing agreements and security documentation are supplied for privacy reviews. No Article 27 representative and no data protection officer are named. No certification is claimed: the About page states this explicitly. The whitepaper maps controls to GDPR Article 5(1)(c) and Article 32, and to SOC 2, ISO 27001, HIPAA and PCI-DSS, which is a control mapping and not an attestation. The terms, dated December 2025, apply the law of England and Wales and set a minimum age of 18.
Who owns the data?
Under the terms of service dated December 2025, customers keep ownership of the content they submit. Using the service grants PromptGuard a non-exclusive, worldwide licence to process that content only as far as necessary to deliver the service: a processing right, not a transfer of ownership. Everything on the other side of that line belongs to the vendor. Rights in the service itself, meaning the software, the infrastructure, the documentation and the trademarks, remain with PromptGuard, and customers may not copy, modify, sub-licence, sell or redistribute any part of it. No rights over customer content are granted to third parties by these terms.
Reuse rights
The privacy policy, effective March 2026, lists what is collected: account and registration details, billing data, support exchanges, and the content and prompts submitted to the service. Inside the authenticated application, IP address, device, browser, activity and logs are captured automatically. The stated purposes are operating and improving the service, enforcing the terms, detecting fraud and incidents, billing, analytics and legal obligations; aggregated, de-identified or anonymised data may be reused for any lawful purpose. Against that, the vendor states it never uses customer data to train models. Text scanned through third-party integrations (ChatGPT via the OpenAI Apps SDK, Codex, Cursor, MCP editors) is processed in real time and not kept beyond the request unless logging is explicitly enabled, and code submitted to the SDK detector is analysed in memory, never stored, transmitted or used for training. The marketing site sets no cookies of its own and loads no third-party scripts: page views are counted by in-house software without IP address or fingerprint, records are deleted after 90 days, and Do Not Track and GPC signals are honoured. The interactive analyzer on the home page has sent nothing since 11 August 2026 and replays pre-recorded verdicts.
Data retention & training
Hosting summary
The managed cloud service runs on Google Cloud Platform, using Cloud Run for auto-scaling serverless containers and Cloud SQL for managed PostgreSQL, with Cloud Armor DDoS protection, managed SSL and TLS 1.3 enforced under HSTS headers. No hosting country and no region are stated anywhere on the site. The two other modes change the picture entirely. In self-hosted hybrid mode the gateway runs inside the customer's own infrastructure through Helm or docker-compose, prompts never leave that network, and only the dashboard communicates with the vendor. In air-gapped mode there is no outbound connection at all, licences being validated offline against an Ed25519-signed key. ML inference is executed through a hosted Inference API, which can be redirected to a customer-owned endpoint through the DETECTION_ML_BASE_URL setting. The design is pass-through for credentials: PromptGuard never stores the LLM provider keys it forwards.
Things to keep in mind
Risks and trade-offs to weigh before adopting PromptGuard.
- Recall of 80.3% at the default preset means roughly one attack in five gets through: downstream controls remain necessary, and the tool should not be treated as the only line of defence.
- No postal address and no full company name are published on the site. The whitepaper is signed 'PromptGuard, Inc.' while the terms apply the law of England and Wales and cap liability in pounds sterling, a discrepancy left unresolved.
- A very young vendor: the domain was registered on 12/09/2025 and the first Wayback capture dates from 06/12/2025, with no track record to corroborate production claims.
- The registrant is masked by an Icelandic privacy service, so the beneficial owner is unknown.
- The 99.9% uptime figure is displayed as an objective without a signed SLA. The site itself notes that presenting it as an SLA in machine-readable markup is exactly what a buyer would later quote back.
- No subprocessor list is published: the policy names categories of providers plus Auth0, GitHub and Google for authentication, and flags Hugging Face and Groq as former demo subprocessors. Hosting country is not stated either, Google Cloud Platform being named without a region while the resolved IP points to an Amazon anycast network, which suggests a CDN front distinct from the application infrastructure.
- The traffic figures on the home page are explicitly illustrative ('Not live production traffic'), and the Artifact Security evaluation is announced as under way, not as a published result.
Setup & Integrations
Technical difficulty
Low on the managed cloud path: the free account is immediate, an API key is issued on activation, and protection takes one init line or a base-URL change, timed by the vendor at under two minutes. Python and Node.js/TypeScript SDKs install through pip and npm, and the REST API works from any language; default presets make fine configuration optional. Self-hosting raises the bar, since Helm or docker-compose implies Kubernetes or container skills. Self-hosted and air-gapped modes are not self-service and require coordination with the vendor's engineering team under an Enterprise plan, with custom onboarding within one to two business days.
Deployment
Integrations
Supported languages
Behind PromptGuard
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement PromptGuard.
Frequently asked questions
Where does PromptGuard sit in an LLM application?
Do I have to change my code to use it?
Which model providers are supported?
How much latency does PromptGuard add?
How effective is the detection?
Is PromptGuard certified, and what OWASP coverage does it claim?
What happens if the service becomes unavailable?
Is customer data used to train models?
Can PromptGuard be self-hosted or run air-gapped?
Is the free plan a trial, and can I get a refund?
Should you pick PromptGuard?
PromptGuard is a specialised product rather than one module of a broader suite: the detection engine is the product. Its claimed difference lies in traceability and in placement, since every number is published with the dataset that produced it, and the same engine runs in managed cloud, inside a customer's own infrastructure, or fully air-gapped with no outbound connection.
The central trade-off is stated openly. At the default preset, recall sits at 80.3%, so roughly one attack in five gets through, and that is deliberate: a false positive is a real user request blocked in production, which is why precision is held at 99.1%. The threshold moves, strict at 0.6 and permissive at 0.9, and the arbitration belongs to the team deploying it.
That makes the fit easy to judge. Teams that must demonstrate to a security reviewer exactly what is filtered, in what order and with which known gaps, will find more substance here than in a badge. Teams that need a certificate, a signed SLA, non-English coverage or a spend cap will not: none of the four is offered, and the site says so rather than obscuring it.
The entry point carries little friction, with a permanent free tier of 10,000 requests per month, no credit card, setup timed by the vendor at under two minutes and a 14-day money-back guarantee on paid plans. Weigh that against the vendor's youth: the domain dates from September 2025, no postal address or full legal entity is published, and the independent evaluation by Artifact Security is announced as under way rather than complete. Piloting it costs nothing; routing production traffic through it deserves the usual due diligence.
- Choosing a selection results in a full page refresh.
- Opens in a new window.