Security
See which AI tools employees use without reading their prompts. Visibility comes from usage metadata, checks run on the device, and chat text is never stored.
VAHTOR governs workplace AI from metadata, not content. The browser extension checks for credentials, secrets and file attachments on the employee's device, and prompt and chat text is never sent to VAHTOR. What reaches your workspace is the AI tool name, the time, a detection type and risk level, and your policy and training records. Reporting is aggregated by default; individual names appear only if the workspace owner turns identifiers on. There is no network proxy, no root certificate and no HTTPS interception.
Capture
VAHTOR never stores what people type into ChatGPT, Copilot, Claude, or other AI tools. The workspace sees the tool, a detection type, and a risk level — not the message.
Chats stored
Zero
Prompt text
Not collected
ChatGPT14:02Device
Credentials, secrets, and whole-file attaches are evaluated on the laptop. A Files rule can cancel a PDF or Excel send before it leaves the tab. No root certificate. No SSL interception.
On-device checks
No MITM
Privacy
Owners set aggregated reporting, individual identifiers, department rollups, and retention. Member reports follow those controls. Enrollment and detection can be paused from the workspace.
Privacy controls
Audit
Published policies, acceptances, tool blocks, and settings changes are logged for the company. Admins can show that a rule was live — without a copy of anyone’s chat.
Company audit
No chat text
Workspace
Each organization is its own workspace. Owner, Admin, and Team roles. People join with an organization code. Your inventory, policy, and reports stay in that company.
Company workspace
Isolated
Data
Designed around data minimization. Owners choose how long metadata is kept.
Chat text / prompts
Typical tools: Often stored or searchable
Never collected
Screenshots of AI tabs
Typical tools: Common in session tools
Not taken
File contents sent to AI
Typical tools: Copied after upload
Stay on the device
Tool name and time
Typical tools: Usually yes
Yes — metadata
Detection type / risk
Typical tools: Varies
Yes — type, not the text
People’s names
Typical tools: On by default
Only if you enable them
HTTPS inspection
Typical tools: Proxy + root cert
None
Chat text / prompts
Often stored or searchable
Never collected
Screenshots of AI tabs
Common in session tools
Not taken
File contents sent to AI
Copied after upload
Stay on the device
Tool name and time
Usually yes
Yes — metadata
Detection type / risk
Varies
Yes — type, not the text
People’s names
On by default
Only if you enable them
HTTPS inspection
Proxy + root cert
None
How VAHTOR handles data, devices, and company reports.
No. The extension uses standard browser APIs. There is no man-in-the-middle proxy and no SSL interception.
No. Prompt bodies are not recorded. Admins can see which tools were used and whether a rule fired — not the message.
Not through VAHTOR. Prompt and chat text is never sent to VAHTOR, so admins see which AI tools were used and whether a rule fired, not the message. The workspace gets the AI tool name, the time, a detection type and risk level. Reporting is aggregated by default; individual names appear only if the workspace owner turns identifiers on.
Tool names, timestamps, detection categories, risk levels, policy versions, and acceptance records. Retention is set by the workspace owner.
Yes. Privacy controls let owners keep aggregated reporting and turn individual identifiers off. Department rollups are optional.
On the device. If a Files rule is on, the attach is cancelled in the browser, a banner is shown, and an alert is logged without the file contents.
Create a workspace. Invite the team. Connect the extension.
Get started
