Let your employees use AI. With NativeAI Guard as the safety net for sensitive data.

We complement Purview. Purview protects the structured channels it was built for: mail, endpoints, SharePoint. It does have shadow-AI DLP, though only in Edge for Business, billed by usage and driven by static rules. The honest case for a second layer is not that Purview is weak, it is that static rules and classification labels do not catch content whose sensitivity lies in its meaning, and that the AI surface reaches well beyond the Microsoft perimeter. A head of IT security at a Swiss bank put the arithmetic plainly: static rules catch the great majority, closing the remainder inside Purview costs six figures in consulting, and buying that layer is cheaper than building it. NativeAI Guard offers digital sovereignty. An option to avoid building yet another dependency on a US company.

Today: Chrome and Edge through the browser extensions, which covers every browser-based AI tool, translation service and webmail your employees might use. A drop-in API proxy for internal systems lets you protect every AI application you have built yourself. In active development: a system-level endpoint agent for desktop applications and command-line tools such as Claude Code. On the roadmap: macOS, Firefox and Safari. The order of that roadmap is not fixed in advance: it follows what the organizations working with us actually need, and more than one item on it is there because a customer asked for it.

Transient processing is our standard mode. The prompt is inspected in volatile memory on our own servers in Switzerland and discarded immediately afterwards, and nothing of its content is written to disk. What persists by default is the audit entry: who sent something, when, to which model, and what NativeAI Guard did about it. Retaining the prompt content itself is an option we provide, because some of our customers need it. Banks in particular carry record-keeping duties where the content of a communication has to remain reproducible, not just the fact that it took place. Where that applies, retention of prompts is switched on deliberately.

No operational data. Prompts, metadata, decisions and usage logs generated through your use of the platform are never used to train, tune or validate machine-learning models, and that is written into the data processing agreement rather than left as a policy statement. Our classification models are pre-trained on synthetic and public corpora. The one exception is explicit and consent-based: if you choose to provide an anonymized calibration dataset during onboarding to tune detection to your own documents, that use is named in the contract and happens only because you asked for it.

Both, and there is a third response that is often the better one: anonymization. Instead of stopping the request, NativeAI Guard can replace the sensitive elements (names, client numbers, patient identifiers, contract references) before the prompt reaches the model. The employee still gets a useful answer and keeps working without interruption, while the loss of sensitive data is prevented. For a large share of everyday cases this is the best solution, because a hard block turns the security team into an obstacle. That is why, wherever the data type allows it, we work with anonymization rather than blocks. Hard blocking stays reserved for the categories where no exception should be accepted. Every block is logged with the policy violation, and these entries are visible in the audit log, which several insurers have explicitly required.

Every domain can have its own rule, and a default rule applies automatically to all domains until you adjust it for a specific one. Each rule runs in its own mode: anonymization, policy enforcement, allow or block, so the same deployment can be strict in one place and light-touch in another. You write new rules in plain language by typing them in, and you adjust existing rules the same way. You create and manage user groups yourself, so rules can be enforced differently per team or department. The AI governance dashboard shows you at any time which rules are active and how they are being applied.

Password-protected files are intercepted at upload: the user is asked for the password so the content can be scanned in the clear before anything is sent. For Purview-classified documents, for example, we block documents marked as confidential from being uploaded, but for documents classified as non-confidential we inspect the content itself, so a file whose confidentiality marking was removed before upload is still scanned and no sensitive data leaves the company. Files encrypted with rights management, Microsoft Purview Information Protection and Azure RMS in particular, are not inspected yet. This is on our roadmap. Until it ships, such files are not quietly waved through: a policy can stop them at upload, so an uninspectable file is a decision you make rather than a gap you find later.