What we build, how it is measured, and what we do not claim.

Inline, in front of the model.

The gateway is not a report you read afterwards. A request is judged first and forwarded second, by 15 detectors (10 always-on, 5 opt-in) grouped into 6 sequential layers. There are four ways to put it in the path, and they differ only in how much of your code has to know about it.

Auto-instrumentation

One call patches the LLM SDK in place. No call site changes.

Guard API

Scan content directly and keep your own provider call. Nothing is forwarded.

HTTP proxy

Swap the base URL. The request shape is the provider’s, unchanged.

GitHub scanner

A GitHub App finds unprotected LLM calls in a repository and opens fix PRs.

12 provider adapters are registered in the backend — OpenAI, Anthropic, Gemini, Azure, Bedrock, and Mistral, and more — and the engine behind them is identical whichever integration and whichever deployment you pick. What changes is where it runs, not what it does.

Published with its sources

Datasets are named individually with their venues, not summarised as “peer-reviewed sources”. Three of the eight are ours and the site says which. Read the methodology.

Gaps named, not omitted

The OWASP LLM Top 10 mapping marks five risks covered in full and five partial, and every partial row states what is missing rather than softening the badge. See the mapping.

Our own suites are labelled

Our own suite: 100 mutations, 10 encoding techniques × 10 attack seeds, generated in-house. Not an independent benchmark.

Detectors counted, not remembered

15 detectors (10 always-on, 5 opt-in), counted from the engine’s registrations. The opt-in half is disclosed because a policy run that reports ten would otherwise look like a discrepancy. Read the whitepaper.

Our cloud, your VPC, or nothing leaving the network at all.

The detection engine is the same in all three. What changes is where it runs and what ever crosses your perimeter.

Managed cloud

We run the gateway; you change a base URL. Masked previews by default, or zero retention.

Hybrid self-host

Helm chart or docker-compose inside your infrastructure, reporting to our dashboard. It forwards masked previews by default, or metadata only — no prompt text at all — if you set it to.

Air-gapped

Engine and dashboard inside your network, with egress denied at the network layer. Licences validate offline against an Ed25519-signed key, so an install with no route to the internet still starts.

Zero-retention mode

Prompt and response content is never written to disk. Decisions only.

Metadata-only logs

Decision, reason, timestamp. Never the body of a prompt or a completion. Retention is a window you set.

Exportable audit trail

Every decision is logged with its reason and can be exported as evidence, with HMAC-SHA256 signing and content hashing so a response can be verified as untampered.

Certifications are not claimed anywhere on this site. The list above is what the product does today, which is the sentence a security reviewer can check; a certificate is not. Which options sit on which plan is set out on pricing.

Nothing reaches production without a gate and a way back.

A security product that ships carelessly is a liability wherever it is installed. The pipeline below is the one this repository actually runs, not a description of one.

Staging on every merge

Merging to main deploys to staging automatically. Production is a separate, explicitly tagged release — there is no path from a merge straight to customers.

The gate

Lint and format, strict type-checking on the backend allowlist, unit and integration suites against a real database, frontend tests, authenticated end-to-end runs, an API-spec drift check and a Helm render. A red run blocks the deploy.

A human approves production

The release is cut as a semver tag and then waits on a named reviewer before any traffic moves.

Smoke is three real requests

Not a health check: a normal request, an injection attempt and one carrying PII. All three must return the expected decision or the release is stopped.

Rollback is a traffic shift

Back to the previous revision in about thirty seconds; the runbook targets ten minutes from a bad release to a gone one. Migrations are forward-compatible by policy, so the old revision runs against the new schema.

Your policy changes get the same treatment

Preview a change in shadow mode and see every request whose verdict would move. Applying it writes a new numbered version rather than editing the live one, and a change that would loosen your policy is refused unless you acknowledge the loosening.

What PromptGuard does not claim.

Each of these already sits next to the number it qualifies. They are collected here so nobody has to assemble the list themselves — and because a vendor that makes you find its caveats has told you something about the rest of its numbers.

No single latency figure

<10 ms fast path; escalated requests are network-bound. Full-inspection time is dominated by escalation rate, which is a property of your traffic rather than of the engine, so we publish no aggregate p95 and tell you how to measure your own.

Not all ten OWASP risks

Five of the ten are covered in full and five are partial. The partial rows name the missing piece — provenance verification, training-time poisoning, outbound system-prompt scanning, vector-store isolation, spend caps.

Recall is not 100%

80.3% at the shipped default: 271 of 1,378 attack samples were missed. That is a point on a curve, not a ceiling, and the controls behind the gateway still have to catch what it does not.

Our evasion score is ours

A perfect score on a suite we wrote ourselves is a weaker result than a perfect score on someone else’s, and every surface that prints it says so at the number.

Provenance is out of scope

We inspect the traffic to and from a model. We do not attest where that model, its adapters, its training data or your packages came from.

Uptime is a target

99.9% is what we run to. It is not a signed SLA, and calling it one in machine-readable markup is the version a procurement reviewer quotes back at you.