See what AI is doing on your team's computers, in chat apps and in code. Keep your customers' details out of it.
Someone pastes a customer email thread into Claude to draft a reply. Shield, running on their computer, swaps the email addresses and phone numbers for labels before the message leaves, so Claude still helps and the details never reach it. If the thread also holds an API key or a card number, the message stops in the text box and nothing is sent. Shield keeps no copy of what they typed. It does keep a record of what it caught, and the record shows if anyone changes it later, so you can show it to an auditor. A developer who asks Claude Code to fix a bug gets the same treatment. When someone later asks what the agent did on that machine, there's a record to read instead of a memory to trust.
We help you see what AI is doing, trust what you see, and protect the people in your data.
See it
Which AI apps your staff use, what Shield caught and when, and which tools the AI ran in reply. Chat apps and coding agents, one screen per computer today, with more added as your staff move to them.
Trust it
Every check is sealed. You, an auditor or a client can check a record without taking our word, and the code on the computer is open source.
Protect it
Personal details are replaced on the computer before a message leaves, and Shield keeps no copy of what anyone typed.
We add the AI apps your staff actually use, and we only call an app covered once Shield checks it. Today that's Claude, Claude Code and ChatGPT, plus Gemini and Copilot in Chrome. Other coding agents come after that, and we'll list each one only when Shield reads it. Tell us which apps your staff use and it moves up the list.
Checked when the person presses send, before the chat app's own code runs.
Shield's Chrome extension checks the message and any attached file the moment someone presses Enter, clicks send or picks a file. It works on Claude (Chat and Cowork), ChatGPT, Gemini and Copilot. A chat app can always find another way to send something, so Shield doesn't rely on catching the network request. It checks at the point where the person hands the message to the page, and it also checks the network request as a backstop. In Chrome there is no proxy and no certificate to install.
Stop
An API key, a private key, a database password or a card number stops the send. The text stays in the box, a notice says which rule matched, and no chat is created.
Replace
Email addresses, phone numbers, SSNs, IBANs and wallet addresses become numbered labels such as [EMAIL_1]. The same address gets the same label throughout a message, so the AI can still follow who is who.
Ask
An admin can set any kind of match to warn instead. The person sees a small bar with Send redacted, Send anyway or Cancel. If nobody answers within 60 seconds, the send is cancelled.
What the AI did next
For a ChatGPT reply, Shield records which tools the AI ran on its own servers, such as a web search, and how many sources it read. That record is sealed with the message it answered.
Per app
Each app can be turned on or off, with its own rule for files: allow, warn or block. The extension takes its policy from the Shield on the same computer and checks that it is talking to that Shield.
Nothing leaves the browser
The rules run in the page. The extension sends rule names, lengths, fingerprints and a file's name, and only to Shield on the same computer, which turns the name into a fingerprint and drops the name.
A developer hands a task to an agent. Later, someone asks what it did.
Coding agents read files, run commands and call tools, often with the developer's own access. When a manager, an auditor or a client asks what one did, nobody wants the answer to be "I think it only touched the tests." Shield keeps a record you can read, and shows if anyone changed it afterwards.
Answer the question
See which tools an agent used and in what order. If a step is missing from the record, Shield flags it when the record is checked.
Set a boundary
An admin can choose which tools an agent may call. A call outside the list is stopped, and the agent carries on as if that tool had failed. This is off until you turn it on.
Nothing changes for the developer
They keep using the agent they already use. The same setup also trims oversized tool output, which lowers token costs.
How it works: Shield sits between the agent and the model and writes each tool call and its result into a signed chain that shows any later change. Claude Code is the agent it reads today. It covers tools the model asks for through the Anthropic API, and nothing an agent does outside that path. Recording is off by default and needs one setting to start.
Nobody has to stop using AI, and nobody is being read.
Shield lets people keep working in the AI apps they already use. The person at the computer sees a notice that says what Shield checks and what it keeps, and that notice stays on unless an admin turns it off. What Shield stores is which rule matched and how long the message was. It never stores the message, so it can't become a record of what someone asked an AI about their day.
From a pasted email thread to a record an auditor can check.
Typed
Someone sends a message to Claude from the desktop app or the browser.
Checked on the computer
Shield checks the message on the machine, in the browser before the page sends it or in the desktop proxy. It looks for API keys and tokens, private keys, card numbers, email addresses, phone numbers, SSN-style numbers, IBANs and wallet addresses.
Replaced or stopped
Personal details become labels such as [EMAIL_1], then the message goes on. A key or a card number stops the message instead. An admin can set either to ask the person first.
Sealed
Shield writes down which app, what it did, which rules matched, the length and a fingerprint of the message, and adds that entry to a chain signed by the computer's own key, so any later change shows.
Checked later
Any entry can be exported as a receipt. Shield checks a receipt in the browser with no account and no request to us.
"That isn't the file I sent" has an answer.
When someone attaches a file to an AI chat, Shield seals its SHA-256 fingerprint, size and type, which rules matched, and the version of the rules that ran. It keeps neither the file nor its name. Later, anyone holding a copy can run one command, byoai shield check-file. It says whether the copy is the same file, whether the same rules give the same result, and whether the seal still verifies.
Read on the computer
Text files up to 5 MB, such as .csv, .json, .env, .pem, logs and source code, are checked by the same rules as messages. A file holding a key is stopped before it uploads.
Fingerprinted and marked unread
PDFs, images, Office files and anything larger are fingerprinted and marked as not read. Shield doesn't claim to know what is inside them.
Your rule per app
Allow, warn or block files for each app. In the browser, warn asks first, and in a multi-file upload only the flagged files are taken out.
The same rules for the internal AI tools you build.
If your team runs its own chat tool or assistant, it can use the same check. Point the app's OpenAI or Anthropic calls at Shield's local gateway, or add the middleware to a FastAPI or Express server. Each request is checked against the same rules and policy, and the result is sealed like everything else. The gateway can record only, or enforce. It is open source, in the same package as Shield.
Private by default, and hard to make less private by accident.
A tool that polices personal data can't keep a pile of it. These are Shield's defaults, and they apply the moment it's installed.
Kept
The app, the time, what Shield did, which rules matched, the message length, and a fingerprint only that computer can recompute.
Never kept
The message itself, the reply, and the personal details that were replaced.
How long
30 days of history by default. An admin can choose 7, 90 or 365.
Loosening a setting
Switching to record-only, or keeping redacted previews, needs a confirmation that says what it gives up. Shield then flags the computer as less private than the default until someone restores it.
Leaves the computer
Nothing. Sending a computer's record to a Coriqo account is in development. When it ships, only a signed summary goes: the root fingerprint, the entry count and the signed checkpoint. No messages and no rule matches.
Other websites
Shield's settings and records answer only its own page on the same computer. Another site open in the browser can't change them.
Shield for the AI your staff use. Coriqo for the AI and agents you run.
Shield works without a Coriqo account. Coriqo records what your own models and agents did, who approved it and what changed, as evidence an examiner can check. We're building the link so each computer's record sits next to that evidence, and one place answers both questions: what did our AI do, and what did our people send to everyone else's. Until it ships, the two run side by side. See how Coriqo records agents.
Banks
Staff pasting customer details into a chat app is a customer-data question before it is a model-risk one. Shield catches card numbers, SSNs, IBANs, emails and phone numbers on the way out. It doesn't recognise US account numbers yet. Coriqo for banking covers the models you run yourself.
Healthcare
Shield catches the identifiers on its list. It does not recognise names or clinical free text yet, so it doesn't replace a PHI policy. Coriqo for healthcare covers the AI you deploy.
Privacy teams
Shield is the step before the data leaves. Coriqo for ADMT and Art. 22 covers the decisions your own AI makes about people.
Put it on your clients' computers. Move the regulated ones up to Coriqo.
Most of your clients have the same problem and no budget for a data-loss platform. Shield gives each computer a local check and a record, and the clients who get audited, such as a community bank or a clinic, can move up to Coriqo for the AI they run. The link that brings each computer's record into their Coriqo account is in development. Today every computer is set up and configured on its own. A console for managing clients' computers from one place isn't built yet; early-access MSPs help decide what it does.
The limits, before you find them.
Platforms
macOS and Chrome today. Windows is planned, and there is no Linux build yet. The Chrome extension isn't in the Chrome Web Store yet, so during early access it is installed by hand.
How it sits in the traffic
Shield is in beta, and this part is still changing. In Chrome, the extension does the checking, with no proxy and no certificate. Desktop apps and Claude Code go through a local proxy that needs a certificate installed on the computer. If that proxy stops, the computer's web traffic stops with it until it restarts. Next we are moving desktop apps to each system's own network filtering: Apple's network extension on macOS and native network filtering on Windows. That work is in development, not shipped.
Which apps
Claude, Claude Code and ChatGPT today. Gemini and Copilot in Chrome only, since their desktop apps aren't read yet. Other coding agents aren't read yet either. In the browser, voice input and text an app sends without the person (drafts, retries) aren't checked when the person sends; the network check catches what it can of those.
What it recognises
Fixed formats, such as emails, card numbers, IBANs and keys, plus text files up to 5 MB. It doesn't recognise names, addresses or free-text health details, and it doesn't read inside PDFs, images or Office files.
Many computers
Central policy and an MSP console are in early access: set policy once and see every client's computers. There are no installers or MDM profiles yet, so each computer is enrolled by hand.
Price
Free to run yourself for one organisation. For MSPs, priced per computer and quoted on a call. See pricing.
Before you install it.
Does Shield read our messages?
It checks each message on the computer, the moment it's sent, and keeps only the result: which rules matched and how long the message was. The message isn't stored, and it isn't sent to Coriqo.
Does the AI still work if details are replaced?
Usually, yes. Claude sees [EMAIL_1] where the address was, and [EMAIL_2] for the next one, so it can still tell people apart, draft the reply or summarise the thread. The person fills the real details back in.
Why check what people type as well as what the page sends?
A chat app's own code can always find another way to send a message, and in testing some did: through a hidden frame, or by retrying in a different format. Checking only the network would be a race we'd sometimes lose. So the extension checks the message and files when the person hands them to the page, before the app's code sees them, and checks the network request as a backstop.
What happens if Shield stops?
Closing the Shield screen changes nothing: checking carries on. In Chrome, the extension keeps applying the last policy it received. If the desktop proxy stops while the computer still sends its traffic through it, the computer's web traffic stops until the proxy is back. Nothing goes out unchecked in the meantime, but people notice, so it runs under a supervisor that restarts it.
Does Shield detect prompt injection?
No. Injection arrives through the documents and tools the AI reads on the provider's servers, after the message has left the computer, where a check on the computer can't see it. Shield records which tools the AI ran in reply, but it doesn't control them; that is a setting of the ChatGPT or Claude workspace.
Can an employee turn it off?
Anyone with admin rights on the computer can stop it, the same as any local tool. Loosening its settings from its own screen needs a confirmation, and Shield flags the computer until the defaults are restored.
How is this different from Coriqo?
Coriqo is the record for AI your organisation builds and runs: who approved a model, what an agent did, what an examiner can check. Shield covers the AI apps your staff use. Shield runs on its own today. The link that puts both in one place is in development.
Try it on a few computers first.
Early access is for teams whose computers use Claude, Claude Code, ChatGPT, Gemini or Copilot at work, and for MSPs who want to offer it to clients. Tell us which you are.
See what AI is doing. Keep customer details out of it.
Early access for teams and MSPs, on macOS and Chrome first with Windows to follow. Already a Coriqo customer? Ask us about Shield for your staff.