Skip to main content
Removing Shadow AI undoes everything the agent set up: the local proxy, the trusted certificate, and the local event data. One command handles it on every platform; manual fallback steps are below in case you need them.

​
One command (all platforms)

This:
  • Removes the PAC proxy from all network services (Wi-Fi, Ethernet, and any others) so traffic stops routing through the local proxy.
  • Removes CA trust — the agent’s certificate is deleted from the system’s trust store (the keychain on macOS, the user certificate store on Windows, the NSS/system stores on Linux), so nothing on the machine continues to trust it.
  • Deletes local config and event data, including the SQLite event log.
Keep the local event log (for example, to hand to security before wiping a device) by passing --keep-data:

​
Manual fallback (macOS)

If the CLI isn’t available — for example the binary was already removed — undo the two system changes by hand:
1

Remove the proxy

System Settings → Network → your active service → Details… → Proxies, and turn off the automatic proxy configuration (PAC) the agent added. Repeat for every network service.
2

Untrust the certificate

Open Keychain Access, search for the PromptGuard CA certificate, and delete it. Confirm no app still trusts it.
3

Delete local data

Remove the agent’s local config and event-log directory. Contact support@promptguard.co if you need the exact path for your build.

​
Windows

Uninstall the app the normal way:
  • Settings → Apps → Installed apps → PromptGuard Shadow → Uninstall (this runs the app’s own uninstaller), or
  • if you installed the .msi, remove it via Add or remove programs or your deployment tooling.
The uninstaller reverses what the agent set up: it clears the proxy auto-configuration from the per-user Internet Settings and removes the inspection certificate from the current user’s certificate store. To double-check by hand: Internet Options → Connections → LAN settings should show no automatic configuration script, and certmgr.msc (Current User → Trusted Root Certification Authorities) should have no mitmproxy / PromptGuard CA entry. Local config and event data live under %USERPROFILE%\.promptguard — delete that folder to remove all local data.

​
Linux

  • AppImage — delete the .AppImage file.
  • .deb — remove the package with your package manager, e.g. sudo apt remove <package> (find the exact name with dpkg -l | grep -i shadow).
Run pgshadow uninstall first (or before deleting the AppImage) so the GNOME proxy setting is reset and the CA is removed from the trust stores. Local config and event data live under ~/.promptguard — delete that directory to remove all local data.

​
Offboarding a fleet device

For managed fleets, you don’t need access to the machine to cut it off. Revoking a device from the dashboard (Fleet → Devices → Revoke) is immediate:
  • The device’s scoped credential is invalidated — its next request to the engine is rejected.
  • The agent stops reporting activity to your dashboard.
  • The rest of the fleet is unaffected — revocation is per device.
Revocation invalidates the credential but does not by itself remove the proxy or certificate from the machine. To fully clean a device, also run pgshadow uninstall (or push it through your MDM). For a device you no longer control, pair revocation with your MDM’s app-removal and certificate-removal profile.

​
Next steps

Fleet enrollment & revocation

How per-device credentials are issued and revoked.

Privacy & data handling

What’s stored locally and what you can export or delete.