Skip to main content
This page draws one diagram per surface. On every arrow, content means prompt or response text (or text extracted from an attachment). Metadata means decisions, threat types, counts, identifiers and timings, with no prompt text. What a stored security event contains, and how long it is kept, is described in Compliance & Security.

​
What is stored where (Cloud)

​
Proxy

Your application sends its LLM request to PromptGuard in place of the provider. PromptGuard scans it, forwards an allowed request to your provider, and scans the response on the way back.
  • Pattern and heuristic detection runs inside the API. Classifiers with local weights run in-process first and fall back to the Hugging Face router. The LLM judges run on the router (backend/api/shared/security/inference_mode.py).
  • A blocked request never reaches your provider.
  • A project with zero retention on, or an organization with previews off, stores the event without the masked preview.
  • Webhooks and SIEM export send event records to destinations you configure.

​
Guard API and SDK auto-instrumentation

With the Guard API, PromptGuard scans text and returns a verdict. It never calls your provider. The SDKs’ auto-instrumentation (for example the Python SDK’s promptguard.init()) patches your LLM client so that each call asks the Guard API first, then goes to your provider directly, with your own provider key.
  • PromptGuard never sees your provider key on this path.
  • Responses reach PromptGuard only if you turn on response scanning.
  • If the Guard API cannot be reached, the SDK fails open by default and the call goes to your provider unscanned. fail_open=False blocks instead.

​
Shadow desktop agent

The agent inspects prompts to AI tools on the device. It masks what its on-device detectors find before anything leaves, and the engine decides the verdict. The full detail, including every setting, is in Shadow AI privacy & data handling.
  • Masked by default. On PromptGuard’s cloud engine the agent sends the prompt with every on-device finding replaced by a placeholder. On any other engine it defaults to metadata_only, which sends no prompt content at all. Raw prompt text is never sent.
  • Device findings are a category and a count, never a value.
  • With the on-device pre-filter set to escalate or local, prompts it resolves on the device are not sent to the engine at all.
  • The engine is the same as on the other surfaces. A cloud engine can call the Hugging Face router as in the proxy diagram. Air-gapped does not.

​
Self-hosted: Hybrid and Air-gapped

Self-hosted, the engine runs on your servers. These settings decide what leaves them. Defaults are from backend/api/config.py and backend/api/shared/security/inference_mode.py. What each mode sends to us, capability by capability, is in Self-Host vs Cloud.

​
Next steps

Shadow AI privacy

What the agent inspects, logs and sends

Compliance

Certifications, data handling and retention

Self-host vs Cloud

What differs when you run the engine yourself
Last modified on October 31, 2026