Prompts slide past every control
A firewall rule, a private key or a customer list travels as ordinary text. No DLP, CASB or proxy sees it leave through a browser tab.
DAILYOPS PRODUCT · AI SECURITY GATEWAY
Use AI freely. Protect your data automatically.
OpsGate is a browser extension and local proxy that intercept prompts and file uploads before they reach ChatGPT, Claude, Gemini or any public AI service. Secrets, customer data and infrastructure configs are detected on the spot, and rewritten safely instead of blocking your teams.
Scanning is 100% local. In organization mode, only metadata is logged, never prompt content.
OpsGate · prompt interceptedRisk 78 / High
AWS access key · AKIA…Q7F2Secret
Fortinet config · “password ****”Infra
IBAN FR76 3000 4… (mod-97 ok)PII
Simulation: 3 items would leakLocal
secure rewrite →AKIA → AWS_KEY_1 · FW-01 · IBAN_1
prompt: why does our FW drop the traffic after the change? config: set admin password **** …opsgate ▸ secure rewrite applied · risk 78 → 660+AI sites covered
100%Local scanning
0Prompts sent to servers
30 minTo run a pilot
THE OPERATING PROBLEM
AI use moves faster than control.
Your teams already use public AI tools. The question is no longer whether, it is what they paste into them: firewall configs, API keys, client exports, .env files.
Files leak even faster
PDFs, DOCX, XLSX exports and screenshots with visible secrets are dropped into chat windows several times a day, invisible to governance.
Nobody can say what left
After the fact, no one can answer the three questions an auditor asks: what left, where did it go, and why.
WHAT OPSGATE MAKES POSSIBLE
A boundary that keeps work moving.
OpsGate is not an AI blocker. It is a decision layer: it shows the risk, proposes a safer version, and keeps a trace.
Secure Rewrite
Sensitive fragments are rewritten or masked with one click, with a side-by-side preview and risk scores before and after. The AI still gets a useful prompt, your secret never travels.
Risk score and simulation
Every prompt gets an explicit 0-100 score with the factors behind it. From 40 and up, a simulation lists exactly what would leak before anything is sent.
Shadow AI discovery
See which AI tools your teams actually use, authorized or not, with per-user behavioral risk scores and trends in one console.
Files and OCR, scanned locally
PDF, DOCX, PPTX, XLSX, code, SQL, database files and screenshots pass through quarantine. OCR reads images on device. Masked versions are reinjected with the format preserved.
Built for infrastructure teams
Detection tuned for the Monday-morning paste: Fortinet, Cisco, Juniper, Huawei, MikroTik, Palo Alto, pfSense, WireGuard configs, plus AWS, Azure, GCP, Stripe, JWT and .env secrets.
Signed rule packs, hot updates
Detection rules ship as ed25519-signed packs, versioned and updated without rebuilding or redeploying. The engine explains its detections, it is not a black box.
IN OPERATION
From paste to protected, in seconds.
The interception happens at the moment of sending. Nothing changes the way your teams work.
Deploy the boundary
Load the extension on Chrome or Edge, or distribute the MSI-packaged local proxy for network-level coverage. Enroll devices to your organization with a code.
The prompt is intercepted
When Enter is pressed or a file is dropped, OpsGate scans locally before the request leaves the browser. Sixty-plus AI domains are covered by default, with per-tenant host policies.
Decide with evidence
A banner lists detections by type and severity, the risk score, and the recommended action: Secure Rewrite, mask and send, send as is, or cancel. Policy can enforce any of these.
Keep the trace
Decisions are logged with metadata only, rule ids, hostname, decision, timestamp. Risk and Shadow AI views turn the stream into governance evidence.
WHY IT IS DIFFERENT
Enable AI. Secure data.
Most DLP tools treat AI as a threat to shut down. OpsGate treats it as a boundary to operate: explicit, explainable and evidence-ready.
A filet, not a wall
OpsGate does not block sites and does not spy on your teams. It scans at the instant of sending, recommends the safe path, and leaves the final decision visible.
- Detection at send time only, no keylogging
- Banner in an isolated shadow DOM, immune to site styles
- Observe or enforce modes, per tenant policy
Defense in depth
The extension covers the DOM. The optional MITM proxy covers the network with the same detection engine, one single source of truth for what is sensitive.
- Shared engine across extension, proxy and console
- HTTP/2 MITM with deep multipart scanning
- Windows MSI with portable Node, deployable by GPO or MDM
Evidence for the audit
When an auditor asks what left and why, the answer is a query, not an investigation.
- Write-once (WORM) audit trail, SHA-256 chained
- SIEM export: syslog, CEF, OTel
- Prometheus metrics endpoint and GDPR soft-delete
GOVERNANCE
The control plane behind the boundary.
OpsGate is multi-tenant by design, with row-level security in PostgreSQL, ready for MSPs managing several client organizations.
SSO OIDC / SAMLMFA TOTPPasskeys WebAuthnWORM auditSIEM / PrometheusGDPR soft-deleteRLS multi-tenantMSP portfolio
Identity done properly
SSO with OIDC (Entra, Okta) and SAML 2.0 fail-closed, MFA including TOTP and passkeys with Windows Hello, and session challenge on concurrent logins.
Policies people can read
Default policy plus departmental profiles, rule packs assignable by group, and console messages your teams actually see when a prompt is handled.
Honest retention
Events keep metadata only, with 90-day minimum retention, scheduled exports, a security report in PDF, and a documented GDPR soft-delete path.
SYSTEM STATE
Where OpsGate stands today.
We state maturity explicitly, like every DailyOps system. OpsGate is functional and demonstrable end to end, and distributed as an early access pilot.
Extension (prompts, files, OCR, Secure Rewrite, risk score), local proxy, control plane API with PostgreSQL, admin console, SSO/MFA/passkeys, WORM audit, SIEM and metrics exports.
Store listings (Chrome Web Store, Firefox, Edge) are packaged and in submission. Pricing and GA follow the first production pilots.
AI agent protection beyond the browser, additional language packs for OCR, HA multi-region deployment, and continued detection pack expansion.
QUESTIONS
Straight answers.
Does OpsGate block my teams from using AI?
No. By default it warns, masks and rewrites. A policy can enforce masking or blocking per tenant, but the product is built for adoption, not prohibition.
Do you read our prompts?
The scan runs locally in the browser. In organization mode the server receives metadata only: rule ids, decision, hostname, timestamp. Prompt content never leaves the device by default.
Which services are covered?
More than sixty AI hosts out of the box: ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, Mistral, NotebookLM and more, with tenant-configurable host lists.
Is it a CASB or an endpoint DLP?
Neither. OpsGate specializes in AI interactions in the browser. Email, USB and printing stay the job of your existing DLP. We integrate with it through SIEM export.
How do we try it?
A pilot runs in about thirty minutes: docker compose for the control plane, load the extension, enroll with your org code, paste a test secret into ChatGPT and watch the event land in the console.
Put a defensible boundary around enterprise AI use.
Run a pilot with your own teams and your own AI tools this week. We onboard early access organizations personally.
Request early access Read the repository Early access pilots include deployment support from DailyOps.