Security

Straight answers about where your data goes and what we do with it — including what's not built yet.

Where detection happens

Prompt inspection runs on the endpoint itself — the agent scans a prompt locally before it reaches ChatGPT, Claude, Gemini, or Copilot. Prompts are not sent to a SafePrompt cloud API to be analyzed.

What gets stored, and where

When SafePrompt detects something sensitive, the actual value — the password, API key, or SSN — is redacted before anything is written to disk anywhere. A redacted snippet of the surrounding prompt (with the sensitive span replaced by a placeholder like [REDACTED_API_KEY]) is kept in your dashboard's activity log, along with metadata: category, confidence, action taken, timestamp, device.

For Community and Professional plans, that activity log lives in SafePrompt's own hosted database — encrypted at rest (AES-256) and in transit (TLS 1.3). We don't train models on it. On-prem / self-hosted deployment is available as an Enterprise contract option; it's not yet a self-serve product feature.

Licensing integrity

Every license is cryptographically signed and verified locally by the agent before it enforces device limits or feature access. A license file can't be hand-edited to unlock features — tampering is detected immediately. See licensing for more, or contact us for a security review.

Compliance status

We'll say this plainly rather than imply more than is true:

We'll update this page the day either certification actually completes, not before.

Enterprise managed deployment

GPO-based push deployment is built and tested today. Intune and SCCM have written deployment guides but haven't been field-validated against a real tenant/site — Enterprise customers get a guided rollout with our team rather than a fully self-serve package for those two.

Sub-processors

Full list at Sub-processors. Security research reports: see Acceptable Use Policy for our responsible disclosure process.