From the prompt to the evidence

An extension that checks prompts and files in the browser. A console your team hosts.

A review before the prompt is sent

A matched draft stops in the browser. The employee decides what happens next.

The shim dialog Edit or mask your prompt, checked on this device. Your draft reads: Here is our config. AWS key AKIAIOSFODNN7EXAMPLE, and ask ali@bank.example before Friday. Beside it, After masking shows the same text with the key replaced by [REDACTED_1] and the email address by [REDACTED_2]. Below are Back, Send edited prompt and Mask and send.

Every edit and mask, against current rules: Rechecked
Approval ends with that action: One send
Optional Send once explanation: 500 characters
Under Require masking and Enforce block: No override

What employees see

A policy for every team

Name a policy, assign it to a team or to one browser, and keep every version it ever had.

The Policies page in the shim console. Standard, the default at version 4, covers devices without a team policy and lets employees choose on credentials, email addresses, cards, IBANs and national IDs while blocking deal codenames. Deal teams, version 2, applies to Risk & compliance, requires masking for email addresses and blocks credentials, cards, IBANs, national IDs and three codenames. Each policy shows how many of its browsers run the current version.

The Deal teams policy in the shim console. Email addresses are set to Require masking; Credentials and secrets, Payment card numbers, IBANs, National ID numbers and Confidential terms to Enforce block, the terms being Project Halyard, Project Tern and Project Kestrel. A side panel shows version 2 with its note, the browsers on it, the Risk & compliance team it applies to, and Try this policy, where a sample sentence about Project Kestrel is Blocked by your organization.

Or per browser, with a default for the rest: Per team
Who published it, why and what changed: Every version
Browser policy sync: 1 minute
Cached policy valid offline: 24 hours

Evidence for every matched request

Each match, with its application, device, result and time.

The Requests page in the shim console with a search field, a Filter button and an active Date: Last 7 days filter. Today’s group lists five requests by detection, device, result and time: Masked, Allowed with Send once, Cancelled, Edited, and Blocked with Enforced block. Yesterday’s group follows.

Per captured prompt version: 90 days
Can open prompt text: Admins only
In lists, search and filters: Metadata only
Step between requests: J and K

Requests and evidence

Installed by IT, enrolled one browser at a time

Managed Chrome and Edge. In alpha: managed installation is still being validated.

Package for Chrome and Edge
Force-install
Set apiUrl
Enroll into a team with a one-time code
Watch device status

The Devices page in the shim console. Teams on the left: Client support, Risk & compliance, Trading & treasury and No team. The list shows each browser with its team, its policy and whether it is up to date or updating, its status (Active, Inactive or Revoked) and when it was last active, with Online now for browsers reporting in the last five minutes.

Each code, used once: 10 minutes
Codes can enroll straight into one: Teams
Without a report marks a browser inactive: 7 days
The one managed setting: apiUrl

Install the extension

See it run in your own browsers.