AILeakShield exists to keep sensitive data out of AI, so we hold ourselves to the same standard. This page explains where AILeakShield runs, how we protect your data, what we store and what we do not, and how we prove it every year.
The AILeakShield platform runs on Microsoft Azure in North America: the application, the database, secret storage and logging. Microsoft maintains independent SOC 1, SOC 2 and SOC 3 reports, ISO/IEC 27001 certification and a HIPAA Business Associate Agreement for the Azure services we use, so the physical data center, hardware and network layers are covered by Microsoft's audited controls.
Every connection to AILeakShield uses HTTPS with TLS 1.2 or newer, and browsers are told to use HTTPS only (HSTS). Connections between the application and its database also require TLS.
Our database storage and backups are encrypted at rest by Azure. Integration credentials that partners connect, such as RMM API secrets, are encrypted again at the application layer.
Application secrets live in Azure Key Vault and are read by the application through a managed identity, not stored in code. Access tokens we issue, such as enrollment and feed tokens, are stored only as one-way hashes.
The database is backed up automatically every day, with point-in-time restore for the last seven days.
Application and platform logs are centralized in Azure Log Analytics, where they are retained, searched and monitored for security events, with alerting and reporting. Credentials and tokens are redacted from request logs.
Rate limiting, request size limits, protection against server-side request forgery, strict security headers and automated tests on every deployment.
The less sensitive data we keep, the less there is to protect. AILeakShield is designed so that the data it is protecting does not end up stored with us.
The AILeakShield extension runs only on the AI sites it protects, such as ChatGPT, Claude, Gemini, Microsoft Copilot and Perplexity, and on AILeakShield's own sites. It does not run on the rest of the web, does not execute remote code, and asks for only the permissions it needs. If it cannot reach AILeakShield, an on-device copy of your block rules keeps blocking high-risk data such as credentials and payment card numbers.
Every year we assess our own controls against the AICPA SOC 2 Trust Services Criteria for security, availability and confidentiality, and track remediation of anything we find.
Customers and partners can request our annual security attestation package under NDA. It includes our latest penetration test results, vulnerability scan results and our security policies.
We sign Business Associate Agreements with covered entities and business associates, and AILeakShield helps you keep protected health information out of AI tools.
We use a small number of providers to run AILeakShield:
| Provider | Purpose |
|---|---|
| Microsoft Azure | Hosting, database, secret storage, logging and transactional email |
| Microsoft Entra ID | Single sign-on |
| Supabase | Email sign-in links (stores the email address used to sign in) |
| OpenAI and Anthropic | AI models for the optional secure AI workspace only. Prompts are inspected and filtered by your policy before they are sent. |
If you believe you have found a security vulnerability in AILeakShield, email security@aileakshield.com. We review every report and will work with you on responsible disclosure.
On Microsoft Azure in North America. The application, database, secret storage and logs all run in Azure.
AILeakShield runs on Microsoft Azure, which is independently audited for SOC 2. We also assess our own controls against the SOC 2 Trust Services Criteria every year and share an annual security attestation, including penetration test and vulnerability scan results, with customers under NDA.
Yes. Data is encrypted in transit with TLS 1.2 or newer and encrypted at rest in Azure, and integration credentials are encrypted again at the application layer.
Blocked prompt content is never stored, and the browser extension does not store prompt text at all. In the optional secure AI workspace, short previews are kept for 24 hours and then deleted automatically.
Yes. We sign Business Associate Agreements with covered entities and business associates.
Contact us to request our annual security attestation package. It includes our latest penetration test results, vulnerability scan results and security policies, shared under NDA.
AILeakShield discovers all the AI in your environment, blocks the AI tools you have not approved, and keeps sensitive data out of the prompts sent to the ones you have.
