Organizations set AI usage policies in SafePrompt by defining custom keyword or pattern lists — like a project codename, an internal domain, or a customer list — and choosing what happens when they're matched: block, warn, or redact.
Built-in policies
Every plan includes default detection for credentials (API keys, passwords, database URLs, SSH keys) and PII (names, emails, phone numbers, SSNs, credit cards). These are on by default — no configuration needed to get baseline protection.
Custom rules (Professional and above)
Admins can add their own keyword lists from the dashboard — for example, a confidential project codename, internal IP ranges, or specific customer names — and pick an action for each:
- Block — the prompt never reaches the AI tool
- Warn — the user sees a warning and can proceed with a justification, which gets logged
- Redact — the sensitive part is masked out and the rest of the prompt goes through
Visibility
Every policy match shows up in the dashboard's Activity Logs — what was caught, which policy triggered it, which device, and when. Slack alerts are available on Professional and above for real-time notification.
How fast does a policy change reach a device?
The Agent applies detection rules the moment it receives a policy update. On Business and Enterprise, where policy is centrally managed, each device checks in with the Control Plane on its own schedule — a change you make in the dashboard doesn't reach every device instantly. The browser extension is a step further removed: it polls the locally-installed Agent for the current site list every 15 minutes, rather than being pushed to. This is deliberate — a lightweight polling design that doesn't require an always-open connection — but it means a newly added AI site can take up to 15 minutes to show up as governed in the browser specifically, even though the Agent itself already has the updated policy.
Editing a policy directly on one device (via its local console) is always immediate for that device — but it's an in-memory change to that one machine, not a fleet-wide update, and on a centrally-managed tenant it will be overwritten the next time that device syncs from the Control Plane.
See Pricing for which plan includes custom rules, or Documentation for setup details.