See what leaves with your team's prompts — and what doesn't.
NexGuardian Gateway sits in front of the AI your team already uses. The redaction engine detects and masks the identifiers it is configured for — emails, phone numbers, SSNs and EINs, and dates of birth — before the prompt leaves for the model. Those four are the ones the local engine reliably identifies; names, tax-return IDs, street addresses, card and bank account numbers, and amounts need the server-side engine. Detection is best-effort over a defined scope; it reduces exposure and does not catch everything. The audit record and the approval hold that give you proof are in build.
Designed to sit in front of the AI you already use — the proxy is in build. No credit card.
Gateway traceStatic frame · synthetic data
- Spanclient name · grouped by class
- Why heldlow-confidence · not proven public
- Nextwaits for an approver you name
Audit strip · 3 recorded · 1 open
Illustrative. The audit ledger and approval hold are in build.
Prompt → Redact · Record & Approve (in build)
One step runs today. Two more are in build.
Nothing clever or hidden. Redaction runs on the way out today; the record and the approval hold are being built.
Prompt
Your team asks an AI to act — a refund, a draft, a lookup. When the request is routed through the gateway, the redaction engine works on it before it reaches the model.
Redact
Emails, phone numbers, SSNs and EINs, dates of birth — the gateway recognizes and masks the identifier classes it is configured for before the prompt reaches the model. Those four are the ones the local engine reliably identifies; names, tax-return IDs, street addresses, card and bank account numbers, and amounts need the server-side engine. Best-effort by design: it does not catch everything.
Approve
Approve — in build. When it is deployed, a request that touches a sensitive action will hold for an approver you name on your own team before anything moves.
What runs today, and what's next
One thing runs today. Two more are in build.
The redaction engine runs today — nothing is deployed for any customer yet. The audit record and the approval hold are in build — we won't tell you they're shipped when they aren't.
Your clients' identifiers stop being the thing you paste.
Emails, phone numbers, SSNs and EINs, dates of birth — the gateway recognizes and masks the identifier classes it is configured for before the prompt reaches the model. Those four are the ones the local engine reliably identifies; names, tax-return IDs, street addresses, card and bank account numbers, and amounts need the server-side engine. It is a detection engine, not a guarantee: best-effort by design, and it does not catch everything. It will not catch unlabelled name-like text or names whose surrounding wording isn't in its label vocabulary.
Redaction · three outcomes on one document
A pass over one document: blacked out where the engine redacted, underlined in amber where it held a span for you, and left intact where it read a form citation instead of personal data.
Audit view · one document
Holds on one document in one list: the spans the engine flagged, the state each one is in, and the person inside the firm each one is attributed to. Every row in this view is still waiting on a decision.
Illustrative. The audit ledger is in build — not available today.
The record is the whole point.
A firm can't answer a client, an insurer, or an examiner with "I think." When the AI path is written down — what was requested, by whom, when, and what was masked — the monitoring file stops being a policy sentence and becomes something you can hand over. The audit trail is the part we're building now; you get it early, and you get a say in what it records.
Approval queue · waiting on your approver
Illustrative. The recording runs the queue to zero in one sitting: four grouped decisions settled one after another, the counter at 0, and the document still held until someone accepts responsibility for it.
A person on your team still says yes.
Some requests shouldn't just be masked and sent. Those will go to a hold row and wait for an approver you name inside your own firm. NexGuardian never names that approver for you, and neither does your IT provider unless you tell them to. It's in build alongside the audit trail.
Fifteen minutes. A synthetic document.
We run a synthetic document through the redaction engine while you watch. It's a fabricated vendor agreement, so you don't bring a client file and nothing real is on the screen. You watch the mask and the tokens on that one input, then the queue: held spans grouped by class, each settled the way your designated approver would settle it, until the count reads zero, and we say out loud which parts of that loop are prototype and which are still in build instead of letting a demo imply the rest. No security team, no platform migration, no slide deck: fifteen minutes on a call, and if it doesn't hold up in front of you, you've lost fifteen minutes.
No credit card. No sales gauntlet. Bring nothing real.
Prefer your own mail app? Write to [email protected].