Shadow AI discovery & prompt protection
Combine Google Workspace, Microsoft 365, Dropbox, and Okta discovery with Elba’s managed browser extension across Chrome, Edge, Firefox, and Safari. Distinguish personal and corporate AI logins locally in the browser, and automatically mask or block sensitive prompts in ChatGPT, Claude, Gemini, and Copilot.
Trusted by 190+ organizations
Core capabilities
Blocking every AI domain pushes employees onto personal devices and personal accounts. Elba gives lean IT and security teams visibility and surgical inline guardrails.
Spot AI tools authorized via Sign in with Google, Microsoft 365, Dropbox, or Okta alongside live browser sessions on Chrome, Edge, Firefox 128+, and Safari 26+ (macOS 26+), plus paid seats via OpenAI and Anthropic Admin APIs.
Classify whether an employee is using ChatGPT, Claude, Gemini, or Copilot with a work login, a personal account, or signed out directly inside the browser without exporting personal email addresses.
Replace PII, PHI, credentials, financial figures, and confidential terms in-draft with realistic fictional replacements (18s fail-closed), block risky prompts or text/code uploads (up to 5 files / 16,000 chars), or block unapproved AI domains.
Architectural comparison
Compare how common approaches handle real employee AI usage across corporate and personal accounts.
| Governance requirement | Written policy / DNS block | AI-only browser point tool | Elba unified platform |
|---|---|---|---|
| Discovering Shadow AI tools | Blind to browser tabs and Sign in with Google/Microsoft OAuth grants | Sees browser visits only; misses historical OAuth tokens and API seats | Unifies Google/M365/Dropbox OAuth, Okta, OpenAI/Anthropic APIs, and 4 managed browsers |
| Personal vs work ChatGPT/Claude logins | Cannot tell if an approved domain is used with a personal account | Often logs full personal email identifiers on US cloud servers | Classifies work, personal, and signed-out state locally without storing personal emails |
| Protecting sensitive prompt inputs | All-or-nothing domain block that pushes staff to personal phones | Hard-blocks prompts or triggers noisy admin alert queues | Masks sensitive entities with coherent fictional values inline (18s fail-closed) or blocks by Playbook |
| Text & code file uploads to AI | Zero inspection of pasted or uploaded source code and CSVs | Varies by browser; rarely linked to employee coaching | Inspects text and code attachments up to 5 files / 16,000 characters + triggers Sam micro-lessons |
| Privacy, GDPR & AI inference residency | Unmonitored data leaves the EU to consumer LLM training pipelines | Frequently stores raw employee prompts on US hyperscalers | Stores classifications and SHA-256 hashes (no raw prompts); inference in Gravelines, France (OVHcloud) |
Rollout workflow
Deploy silently through your existing MDM and enforce clear, employee-friendly AI rules without a network proxy.
Link Google Workspace, Microsoft 365, or Okta in clicks, and roll out Elba silently to Chrome, Edge, Firefox 128+, and Safari 26+ via Intune, GPO, Google Admin, macOS MDM, or Apple DDM.
Review your live inventory of AI web apps, OAuth grants, and personal-account sessions. Block high-risk unapproved AI domains while keeping approved assistants open.
Enable fictional-value prompt masking or blocking for ChatGPT, Claude, Gemini, and Copilot, and send concise follow-up coaching via Sam in Slack, Teams, Google Chat, or email (capped at 1 lesson per 7 days).
Connected workflows & documentation
A closer look
Elba enforces inline prompt monitoring, automated fictional-value masking, prompt blocking, and text/code attachment DLP across ChatGPT, Claude, Google Gemini, and Microsoft Copilot on Google Chrome, Microsoft Edge, Mozilla Firefox 128+, and Apple Safari 26+ (on macOS 26+).
When an employee submits a draft containing PII, PHI, credentials, financial figures, or confidential entities, Elba replaces those values in-draft with realistic fictional equivalents before the prompt leaves the browser. If replacement cannot complete within the 18-second fail-closed window, submission is blocked.
No. Account state (work, personal, signed out, or unknown) is classified locally in the browser without exporting personal email addresses, and DLP findings retain only sensitivity classifications, SHA-256 hashes, and metadata rather than raw prompt text or raw file contents.
Yes. Alongside browser-based Shadow AI and prompt controls, Elba includes native Admin API connectors for OpenAI and Anthropic to inventory active users, run periodic user access reviews, and revoke stale seats.
Related solutions
Enforce inline AI prompt masking, text/code upload DLP, domain blocking, Chrome/Edge extension risk scoring, and bulk-download alerts.
Fix SharePoint, OneDrive, and Teams oversharing with owners via Sam and mask or block sensitive Copilot prompts without an M365 E5 tax.
Audit OAuth scopes across Google Workspace, Microsoft 365, and Dropbox, score vendor reputation 0-10, and run CVE & vendor breach Playbooks.
Request a 30-minute live demo of Elba’s Shadow AI governance, or run a free Google Workspace or Microsoft 365 exposure check.