> ## Documentation Index
> Fetch the complete documentation index at: https://docs.promptguard.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Uninstall & Offboarding

> Cleanly remove the Shadow AI agent — drop the proxy, untrust the certificate, delete local data — and understand what happens when a device is revoked from the fleet.

Removing Shadow AI undoes everything the agent set up: the local proxy, the
trusted certificate, and the local event data. One command handles it on every
platform; manual fallback steps are below in case you need them.

## One command (all platforms)

```bash theme={"system"}
pgshadow uninstall
```

This:

* **Removes the PAC proxy** from **all** network services (Wi-Fi, Ethernet, and
  any others) so traffic stops routing through the local proxy.
* **Removes CA trust** — the agent's certificate is deleted from the system's
  trust store (the keychain on macOS, the user certificate store on Windows, the
  NSS/system stores on Linux), so nothing on the machine continues to trust it.
* **Deletes local config and event data**, including the SQLite event log.

<Tip>
  Keep the local event log (for example, to hand to security before wiping a
  device) by passing `--keep-data`:

  ```bash theme={"system"}
  pgshadow uninstall --keep-data
  ```
</Tip>

## Manual fallback (macOS)

If the CLI isn't available — for example the binary was already removed — undo
the two system changes by hand:

<Steps>
  <Step title="Remove the proxy">
    **System Settings → Network →** your active service **→ Details… → Proxies**,
    and turn off the automatic proxy configuration (PAC) the agent added. Repeat
    for every network service.
  </Step>

  <Step title="Untrust the certificate">
    Open **Keychain Access**, search for the **PromptGuard** CA certificate, and
    delete it. Confirm no app still trusts it.
  </Step>

  <Step title="Delete local data">
    Remove the agent's local config and event-log directory. Contact
    [support@promptguard.co](mailto:support@promptguard.co) if you need the exact
    path for your build.
  </Step>
</Steps>

## Windows

Uninstall the app the normal way:

* **Settings → Apps → Installed apps → PromptGuard Shadow → Uninstall** (this
  runs the app's own uninstaller), or
* if you installed the `.msi`, remove it via **Add or remove programs** or your
  deployment tooling.

The uninstaller reverses what the agent set up: it clears the proxy
auto-configuration from the per-user Internet Settings and removes the
inspection certificate from the **current user's** certificate store. To
double-check by hand: **Internet Options → Connections → LAN settings** should
show no automatic configuration script, and `certmgr.msc` (Current User →
Trusted Root Certification Authorities) should have no **mitmproxy** /
PromptGuard CA entry.

Local config and event data live under `%USERPROFILE%\.promptguard` — delete
that folder to remove all local data.

## Linux

* **AppImage** — delete the `.AppImage` file.
* **.deb** — remove the package with your package manager, e.g.
  `sudo apt remove <package>` (find the exact name with
  `dpkg -l | grep -i shadow`).

Run `pgshadow uninstall` first (or before deleting the AppImage) so the GNOME
proxy setting is reset and the CA is removed from the trust stores. Local
config and event data live under `~/.promptguard` — delete that directory to
remove all local data.

## Offboarding a fleet device

For managed fleets, you don't need access to the machine to cut it off. Revoking
a device from the dashboard (**Fleet → Devices → Revoke**) is immediate:

* The device's **scoped credential is invalidated** — its next request to the
  engine is rejected.
* The agent **stops reporting** activity to your dashboard.
* The rest of the fleet is unaffected — revocation is per device.

<Warning>
  Revocation invalidates the credential but does **not** by itself remove the
  proxy or certificate from the machine. To fully clean a device, also run
  `pgshadow uninstall` (or push it through your MDM). For a device you no longer
  control, pair revocation with your MDM's app-removal and certificate-removal
  profile.
</Warning>

## Next steps

<CardGroup cols={2}>
  <Card title="Fleet enrollment & revocation" icon="users" href="/shadow-ai/fleet-enrollment">
    How per-device credentials are issued and revoked.
  </Card>

  <Card title="Privacy & data handling" icon="shield-halved" href="/shadow-ai/privacy-data-handling">
    What's stored locally and what you can export or delete.
  </Card>
</CardGroup>