How Airentect works

Airentect is a data loss prevention layer for AI chat tools in the browser. It has three parts: a browser extension, a classification gateway, and an admin console. Understanding how they fit together makes every other setup decision easier.

The three parts

The extension runs in Chrome and Edge on each employee's machine. It watches for prompts being sent to AI chat tools in the browser and holds them just long enough to classify what is in them. Fleets install it silently through their existing management tooling, so users do not set anything up themselves.

The gateway at gateway.airentect.com does the classification. It runs in Sydney, Australia, and model inference is also kept within Australia, so prompt analysis stays onshore. The extension sends prompt content to the gateway, the gateway scores it against your detection profile and policies, and the result comes back in real time.

The console at console.airentect.com is where admins work. It manages workspaces, detection profiles, policies, users, endpoints, and reporting. Nothing in the console needs to be installed on endpoints; it is a normal web application you sign into.

What happens when someone sends a prompt

1. A user types a prompt into an AI chat tool and presses send.
2. The extension intercepts the outgoing prompt and sends it to the gateway with the device's API key.
3. The gateway classifies the content against your detection profile: risk categories, data types, and the internal terms you have told it are confidential.
4. The policy assigned to that user decides the outcome. Depending on the action you configured, the prompt is logged, the user sees a warning, sensitive spans are redacted before the prompt leaves, or the prompt is blocked.
5. The event lands in the console. You can see it in the logs and in reporting within about a minute.

Every step is driven by your configuration. The same prompt can be allowed for one group and blocked for another, because policies are assigned per group on top of an organisation-wide default.

Workspaces and identity

An organisation can have one or more workspaces. Detection profiles, policies, deploy tokens, and endpoints live inside a workspace, so you can run different configurations for different operating segments.

Devices authenticate to the gateway with a per-device API key, issued during enrolment and stored server-side as a SHA-256 hash. Each device gets its own key. Users are directory entries in the console; a device maps to a user when the browser knows the signed-in email, and enrols as an anonymous managed device otherwise. The users and provisioning guide covers how that mapping works.

What the network needs

Endpoints need HTTPS access to gateway.airentect.com. If you run a proxy or web filter, allow that host before rollout. Managed devices also fetch extension updates from downloads.airentect.com when you deploy through the Airentect CDN channel.

That is the whole footprint: one extension, one gateway host, one console.