zer0pii Enterprise AI Guard

Deploy to your fleet

The extension is the deployment story, not the product: it puts the same masking in front of the AI chat sites your team already uses, and an admin pushes the gateway settings with managed policy so nobody types a key.

What it does

Client-side DLP for enterprise AI: prompts are masked or blocked on-device before leaving the browser.

Identifiers with a fixed shape are masked in the page before the send; names and organisations are handled by the gateway when the extension is signed in or provisioned. The extension writes nothing to disk: its only persistent read is the admin-managed policy store.

Source: apps/extension/manifest.json

Supported sites

The extension runs on these hosts today. Other AI sites are counted as uncovered in the console so you can see where your team goes.

Managed policy

Three keys are read from the managed policy store. GatewayUrl points the extension at your gateway (the hosted one or your own). GatewayKey provisions the gateway key so the user never signs in. EnforcementMode sets the org-wide default; a per-site policy from the console overrides it.

GatewayUrl
The gateway base URL, for example https://api.zer0pii.com/v1
GatewayKey
A gateway key issued in the console (zpii_...). Optional: without it, each user signs in with a magic link.
EnforcementMode
SILENT_REDACT (mask and send) or ACTIVE_BLOCK (hold the send until the text is clean)
policy JSON
{
  "GatewayUrl": "https://api.zer0pii.com/v1",
  "GatewayKey": "zpii_...",
  "EnforcementMode": "SILENT_REDACT"
}

Chrome (managed policy, Windows registry or ADMX)

Chrome reads extension settings from the 3rdparty policy key. On Windows via Group Policy with the Chrome ADMX templates, or directly in the registry; on macOS and Linux via the managed policy file.

Windows (registry / ADMX)
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\<extension-id>\policy]
"GatewayUrl"="https://api.zer0pii.com/v1"
"GatewayKey"="zpii_..."
"EnforcementMode"="SILENT_REDACT"
macOS / Linux (managed policy file)
# macOS: /Library/Managed Preferences/com.google.Chrome.plist
# Linux:  /etc/opt/chrome/policies/managed/zer0pii.json
{
  "3rdparty": {
    "extensions": {
      "<extension-id>": {
        "GatewayUrl": "https://api.zer0pii.com/v1",
        "GatewayKey": "zpii_...",
        "EnforcementMode": "SILENT_REDACT"
      }
    }
  }
}

Microsoft Edge

Same shape as Chrome under the Edge policy key.

Windows (registry / ADMX)
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\<extension-id>\policy]
"GatewayUrl"="https://api.zer0pii.com/v1"
"GatewayKey"="zpii_..."
"EnforcementMode"="SILENT_REDACT"

Firefox (policies.json)

Firefox reads distribution/policies.json. The Firefox build carries the stable extension id shown in the snippet.

policies.json
// distribution/policies.json
{
  "policies": {
    "3rdparty": {
      "Extensions": {
        "extension@zer0pii.ai": {
          "GatewayUrl": "https://api.zer0pii.com/v1",
          "GatewayKey": "zpii_...",
          "EnforcementMode": "SILENT_REDACT"
        }
      }
    }
  }
}

Replace the extension id with the id of the build you deploy; it is fixed per signed package.

Source: apps/extension/src/background.ts, apps/extension/src/content.ts, apps/extension/build.mjs

Signed package from your console

The extension is delivered as a signed ZIP for MDM rollout. Sign in to the console to download the build that matches your gateway.

Open the console