ISOTRX
PromptShield

Do you know how much your organization spends on AI and what it's using it for?

PromptShield governs AI adoption across your organization as effectively and efficiently as possible: who uses it, for what, with which model, at what cost, and what information can leave.

Request a demo

Executive summary

Your people already use artificial intelligence.

With company accounts, with personal accounts, with several providers at once. No one knows how much is being consumed, what information left, or whether it was used for the business. And what people learned in each conversation stays scattered across everyone's computers.

  • Usage against budget Prototype

    A dashboard for your monitoring center (SOC or NOC) showing each area's estimated usage against its budget.

  • The right model for each task Prototype

    PromptShield estimates the complexity of each request and sends it to the right model: one specialized by area, a cloud model for complex work, or the local one for simple tasks.

  • Rules that enforce themselves

    If a request falls outside the line of business or includes information that must not leave, it is rejected, citing the policy behind the decision.

  • Who, when and for what

    Every request is logged for audit.

  • Know-how stays in-house Prototype

    Your people's requests and answers become organizational knowledge, not lost conversations.

  • Sensitive information stays protected

    Identifiable data is replaced before it leaves; the most sensitive work is handled in-house.

How it works

Every request goes through PromptShield before it reaches any AI model.

Path of a request: if it breaks the rules it is rejected; if it can't leave or is simple, the local model handles it; if it leaves, the data is replaced, a cloud model answers, and the real data is restored. Everything is logged. Person or agent Does it follow the rules? Where does it go? Replace data Rejected citing the policy Local model sensitive or simple Cloud model Claude, Gemini, ChatGPT… Answer Restore real data Logs and learns log and knowledge base yes no cloud local replacements only with real data Inside your infrastructure Outside: cloud models Path of a request: if it breaks the rules it is rejected; if it can't leave or is simple, the local model handles it; if it leaves, the data is replaced, a cloud model answers, and the real data is restored. Everything is logged. Person or agent Does it follow the rules? Rejected citing the policy Where does it go? Local model sensitive or simple Replace data Cloud model Claude, Gemini, ChatGPT… Restore real data Logs and learns log and knowledge base Answer no yes local cloud replacements only with real data Inside your infrastructure Outside: cloud models
Everything except the "cloud model" happens inside your infrastructure, including the log.

  1. Checks the purpose and the rules

    Is the request related to the business? Does it include something your policy doesn't allow? If it doesn't pass, it is rejected and the person is told which policy applies.

  2. Checks the information

    It finds personal data, accounts, customers and part numbers, as well as combinations that identify someone without naming them. It isn't a word filter: it understands context.

  3. Chooses the model

    Based on how sensitive the information is: a cloud provider, with identifiable data replaced, or the local model. In prototype: automatic selection by area and by task complexity.

  4. Restores the data

    The answer reaches the person with the real data.

  5. Logs and learns

    The log records who, when, for what and with which model. In prototype: estimated usage and knowledge proposals for the organization's knowledge base.

The right model Prototype

Someone asks to summarize an email. PromptShield recognizes a simple task and handles it with the local model; analyzing a contract does go to the most capable model.

Customer information

A quality engineer writes: "Help me with the 8D for Automotive Customer X's complaint about lot 24-1187." The provider receives: "…for [CUSTOMER_1]'s complaint about lot [LOT_1]." The engineer gets the draft back with the real data.

Rules

Someone asks for help planning a vacation. PromptShield replies: "This request is outside the authorized use of AI (AI Use Policy, section 2)," and logs it.

Know-how Prototype

Three technicians separately solved the same failure on line 4, each in their own conversation. PromptShield spots the pattern and proposes a note for the knowledge base; the maintenance manager approves it, and the next technician finds it right away.

If something fails, the information doesn't leave.

  • A single door. Direct access to AI services is closed; everything goes through PromptShield.
  • Fail closed. If the check doesn't respond, the request doesn't leave.
  • You hold the keys. Provider credentials live only in PromptShield; no one else knows them.
  • Audit without sensitive data. The log records what was protected, not the data itself.
  • Only what left is stored. If a request contains restricted information, it doesn't leave and isn't stored. What does leave is stored exactly as it left: with the replacements, never with the real data.
  • The knowledge base is yours. It lives in your infrastructure, with controlled access and the retention you define. No knowledge goes in without approval from a person on your team.

Regulatory framework

Less information in third-party hands. More evidence for audit.

PromptShield reduces the information that reaches third parties and produces auditable evidence. It doesn't replace your legal team's analysis. The frameworks below are Mexican.

Finance

Banking secrecy
Article 142 of Mexico's Credit Institutions Law. Names, accounts, loans and amounts are replaced before leaving; the most sensitive work is handled in-house.
Personal data protection
Minimization, control over transfers, and a record of each processing activity.
Circular Única de Bancos (CNBV)
Third-party and cloud services: a single control point for all AI use, with an exportable log.
Operational risk (R-28)
Blocked attempts become evidence for the incident register.

Manufacturing and other industries

Confidentiality agreements
Rules per customer: if a contract prohibits using external AI, anything that mentions that customer stays in-house.
Customer audits
Concrete answers for security questionnaires that already ask about AI use.
ISO 27001 and industry certifications
Evidence of control over how AI is used.
Personal data protection
Employee data, such as names, social security numbers and salaries, is protected when using AI.

In any industry: logging AI use and keeping requests for the knowledge base is processing of your employees' data. Disclose it in your internal privacy notice and define its retention.

Rollout plan

We start small, measure and grow.

  1. Assessment

    Who uses AI today, with which providers and for what. Usage policy, budget and the first rules by area.

  2. Pilot

    One or two areas. We measure usage, consumption, rejections, and how well it detects sensitive information in your real documents.

  3. Production

    Direct access to AI services is closed and every area goes through PromptShield.

  4. Continuous improvement

    Regular reports to management, rule adjustments and a growing knowledge base.

No phase moves forward without your team's approval. No system catches 100% of cases; that's why we measure with your documents before going live, and the most sensitive areas can work with the local model only.

Let's look at it with your information.

Request a demo