Play · Security teams
Govern ChatGPT and Claude at work
Same tab,different account,both on the record.
The force-installed browser extension sees which account a web AI app is signed into, personal or corporate, and labels every send. Content captures are redacted on the device, and a sensitive paste is stopped on either account.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF
- This play uses
- 01Discover
- 03Enforce
- 05Prove
Who
A security team that bought an enterprise ChatGPT or Claude plan and still sees personal logins on the same laptops.
What happened
The Shadow AI report showed personal ChatGPT logins on laptops that also had the corporate workspace, which puts those prompts outside the enterprise agreement's data terms.
What's at stake
Prompts under consumer terms, on accounts the company cannot audit or offboard, running beside the ones it pays to protect.
- 01Discover
Which account is the tab signed into?
The browser extension is force-installed in Chrome, Edge and Firefox by policy; nobody opts in. For every web AI app it records the tool, the account type in use and the device: ChatGPT, Claude, Gemini, Microsoft Copilot and Perplexity built in, and any AI site you add. The Shadow AI report splits sessions by personal and corporate account, so you can see who is working outside the enterprise agreement.
Chrome, Edge, Firefox · personal vs corporate accounts · built-in and added AI sites
endpoints · shadow AI report
- 02Enforce
One DLP rule for every account.
Conversations on both accounts are captured and uploaded by default, with secrets redacted on the device first; an admin can turn Browser capture off globally or for a team, app type or device. Browser DLP checks prompts and uploads on either account and stops a paste that matches a credential, a card number or a pattern you add before it sends. A vendor nobody approved, or every consumer AI service at once, is blocked outright. The account label is on every capture.
browser capture on by default, secrets redacted on the device · off per team, app type or device · browser DLP: warn or block · block by vendor or every consumer AI service · account type on every capture
endpoints · needs attention
- 03Prove
Evidence the enterprise agreement is actually in use.
Every session and every block carries the device, the account type and the policy that applied. Export the Shadow AI report to show leadership the move from personal to corporate accounts, or a signed compliance pack with the governance event log for the auditor.
Shadow AI report · per-device evidence · signed compliance packs
insights · compliance pack
- ChatGPT · corporate account · sessionendpoints · l.brennan-mbp · corporate account · capture onallow
- ChatGPT · personal account · paste 1,600 charsendpoints · l.brennan-mbp · customer PII detected · personal accountblock
- Claude · personal account · sessionendpoints · d.farouk-win · personal account · labeled · no detectors matchedallow
- Claude · corporate account · upload q3-forecast.xlsxendpoints · h.lindqvist-mbp · corporate account · no sensitive-information types matchedallow
Illustrative entries in the shape the product writes them.
Products in this play
The extension sees which account the web app is signed into and reports the account type beside the tool, the device and the owner. Captures and reports can be filtered by it.
Run this play this week.
Free for your first agents and devices, live in about thirty seconds. Or walk through it with someone who has run it before.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF