PromtWall AI Security · AI protection
PromtWall sits between your applications and models: it detects prompt injections, replaces passport numbers, SNILS (social insurance number) and INN (taxpayer ID) with tokens before they reach the model, and keeps AI agents within the user’s permissions. The application changes only its endpoint and key. It runs inside your perimeter, air-gapped included.
Interface
Gateway dashboard: what needs attention right now, how many requests were blocked and masked, what agents and MCP tools are doing.
Demo data.
Why now
Your bots and RAG pipelines read content that can hide a command, applications send personal data to external models, and agents get access to databases and repositories. Banning AI won’t work — you need control on the path of every request.
Hidden instructions in processed content made the assistant disclose data from the user’s context. A model can’t tell data from commands — so the check has to happen before the model.
The Hacker News, June 2025It held records on more than 1,200 executives. An agent with production access needs permission boundaries and human approval for dangerous commands.
Fortune, July 202513% of organisations had AI incidents. A gateway is exactly that control: a key per application, policies and a log of every request. And under 152-FZ (Russian personal data law), the operator is responsible for personal data — that is, you.
IBM Cost of a Data Breach 2025How it works
The application gets a virtual key and points its model endpoint at PromtWall. The API is OpenAI-compatible — no code rewrite.
Input controls look for injections, hidden instructions and secrets; PII Vault replaces personal data with tokens. For RAG, the retrieved context is checked too.
The request goes to the chosen provider or to your own model inside the perimeter. Limits and budgets are set per application key; if a provider fails, a fallback takes over.
Output DLP checks the response before it is returned: the stream is buffered and never goes out unchecked (fail-closed). Tokens are swapped back, and the decision goes to the log and SIEM.
Capabilities
A virtual key per application with rotation and revocation, RPM/TPM limits, budgets and per-request cost tracking. Fallback providers, an emergency kill switch, exact and semantic caching, streaming and WebSocket.
PII Vault replaces Russian passport numbers, SNILS, INN, card numbers, IBANs, phone numbers and email addresses with tokens before they reach the model, and restores them in the response. INN is validated by checksum, cards by the Luhn algorithm. Every access to personal data is logged.
Input, output, PII Vault, ML, RAG, agents and MCP. Each control gets an action (block, mask, warn, log or disable) and a threshold from 0 to 1. Starter profiles: OWASP Baseline, Maximum, Minimal, PII Strict, Agent Safe, RAG Safe.
The AgentGateway → MCP Guardrails → MCP Prism → MCP server chain checks each call in 6 stages: tokens, personal data, injections, harmful content, tool attacks and your own rules. OBO tokens keep the agent within the user’s rights, tool descriptions are pinned against tampering, and dangerous actions wait for human approval.
Colang rules with versioning and rollback, a library of ready-made rules and a sandbox to test a rule before it goes live.
6 runtime RAG controls: injections in retrieved documents, personal data in context, context relevance to the question, answers not grounded in sources, toxicity. RAG application quality is evaluated separately, with Giskard.
Red teaming with NVIDIA garak, including multi-turn Crescendo, TAP and PAIR attacks. Every breach found becomes a regression test and a CI/CD gate — so a fix can’t silently roll back.
Deduplicated findings with statuses, mapped to OWASP LLM Top 10 (2025) and MITRE ATLAS. A finding can only be closed with a comment. The inventory of your AI applications comes as an AI-BOM in CycloneDX 1.6.
Agent sessions are recorded with a hash chain and can be replayed for investigation; operator actions go to an append-only log. SIEM export via syslog, webhook, Splunk HEC and Elastic in CEF, ECS or JSON; notifications by email, Slack and Teams.
Who benefits
Personal data reaches models as tokens, findings come in OWASP and MITRE ATLAS terms, plus an immutable log and SIEM export. For audit — a personal data access log, agent session recordings and an AI-BOM.
An OpenAI-compatible API with no code rewrite, red teaming with garak, breaches turned into regression tests and a CI/CD gate, a sandbox for Guardrails rules.
A key per application, limits and budgets, cost tracking, caching, fallback providers and an emergency kill switch. Any model — external or your own inside the perimeter.
Deployment
promtwall installer: doctor, install, status, up, down, logs, migrate, backup, restore. A clean install takes up to 30 minutes.spack packages, offline licence30-day pilot
We agree on success criteria before we start. From you — a server inside your perimeter and the applications or agents we will switch to the gateway.
We pick applications and agents for the pilot together with your security and IT teams.
We deploy PromtWall inside your perimeter with the installer — in a day.
Traffic flows through the gateway on your data. Monitoring comes first — no blocking.
A report on which personal data, secrets and attacks passed through the gateway and what the agents did — and a decision on turning on blocking.
For air-gapped environments, we deliver the distribution as an archive and the licence as a file.
Questions
No. PromtWall is compatible with the OpenAI API: the application changes its endpoint and key, and streaming and WebSocket work through the gateway. Supported providers: OpenAI, Anthropic, Google, Mistral, DeepSeek, OpenRouter, Qwen, Ollama and any OpenAI-compatible endpoint, including your own model inside the perimeter. GigaChat and YandexGPT work only through your own OpenAI-compatible endpoint: there are no built-in connectors for them.
Yes. For air-gapped environments, the distribution ships as an archive, ML models are already inside the images, rules are updated with .spack packages, and the licence works offline. ML scanners run on CPU: the core needs 8 GB of memory or more, and no graphics card is required.
No. PromtWall controls only the traffic that goes through the gateway and does not hunt for shadow AI on the network. Bypasses are closed with network rules, while employees get a convenient corporate alternative — for example, ENCLAVE.
Accuracy depends on your applications and traffic, so we don’t promise it in words, and we don’t promise protection “against all threats”. The pilot starts in monitoring mode: findings are only logged, and thresholds from 0 to 1 are tuned for each control. Before blocking is turned on, red teaming with garak tests your applications with Crescendo, TAP and PAIR attacks.
No, FSTEC certification is planned. For audit, there is already an immutable log of operator actions, hash-chained agent session recordings, a personal data access log, OWASP LLM Top 10 and MITRE ATLAS mapping of findings, and an AI-BOM in CycloneDX 1.6.
Not yet. PromtWall runs on a single node with built-in backup: target RPO of 24 h and RTO of 60 min for the core, with recovery via the promtwall restore command. Kubernetes is on the roadmap.
We measure latency on your traffic during the pilot rather than promise a number. Exact and semantic caching reduce calls to the model.
PromtWall sits on the path to the model: it checks the request, the retrieved RAG context, the response and the agent’s tool calls, replaces personal data with tokens and puts the values back in the response.
PromtWall pilot
Leave a request — we’ll pick applications for the pilot and agree on a protection profile and success criteria.
We’ll contact you at the email you provided to arrange your PromtWall pilot.
Other OpenZTA platforms