⚡ New: Protect your data from both sides of AI with our unified perimeter defense.

AIGuard Knowledge Base

Technical documentation covering architecture, compliance mechanisms, and threat mitigation.

How It Works & Understanding Costs

AIGuard unifies inbound crawler protection and outbound PII sanitization. It acts as a security proxy sitting exactly in the middle of your application and the LLM provider.

  1. The Prompt: A user asks your app to summarize a sensitive report.
  2. Local Interception: AIGuard intercepts the request, strips out names and bank accounts locally, and replaces them with tokens. This costs nothing but local server compute.
  3. The Provider Call: AIGuard forwards the sanitized prompt to the external LLM API (e.g., Gemini or OpenAI). You pay the provider's standard token rate.
  4. Local Restoration: The provider sends the draft back to AIGuard. AIGuard looks up the tokens in its secure local memory vault, swaps the real names back in, and delivers readable text to the user.

Why AI Implementation Costs Are High

A common misconception is that the high cost of building AI features comes from middleware or proxy services. In reality, AIGuard's interception service is highly efficient. The bulk of your implementation cost is driven strictly by your downstream LLM usage. You are paying the LLM provider for the heavy artificial intelligence computation (fractions of a cent per 1,000 tokens). AIGuard's transparent pricing reflects the exact cost of securing that pipeline, not the AI processing itself.

Blindfold PII Proxy: Tokenization vs. Regex

Developers often assume standard Regex is sufficient for masking data. However, writing rules for emails and SSNs falls apart in real-world production for several reasons:

1. Context Sensitivity

Regex matches fixed patterns, not meaning or intent. For example, determining if 341-982-1004 is a phone number, order ID, or SKU is impossible for Regex. Regex cannot effectively target names or addresses in dynamic sentences (e.g., "Sarah Jenkins from Boston"). Blindfold uses Context-Aware NLP (Named Entity Recognition) to understand sentence structure.

2. Two-Way Reversible Tokenization

If a developer replaces an email with [REDACTED], the LLM loses context. If it replies "Hi [REDACTED], I'd like to introduce you to [REDACTED]," the output is useless. AIGuard tokenizes the data (e.g., [EMAIL_1]), maps it locally, and re-hydrates (restores) it when the response returns.

3. Detection of Obfuscated Text

Users often try to bypass filters with spacing tricks like j h o n d o e. Detection must happen 100% locally. AIGuard pre-processes and normalizes strings (collapsing spaces, standardizing unicode) before running NLP models that evaluate surrounding semantic triggers. Algorithmic validation (like Luhn checksums) ensures structured data like credit cards are legitimate before masking.

RoboGate Firewall: Active vs. Passive Defense

When an AI crawler visits your site, RoboGate offers two layers of defense.

1. The Legal Boundary (robots.txt)

A robots.txt file works on an honor system (the Robots Exclusion Protocol). Major AI companies explicitly program their crawlers to read this file. In addition to polite bots obeying it, it acts as a formal legal boundary. Under EU law (Article 4 of the Digital Single Market Directive), domain owners must explicitly opt out of AI training using machine-readable means. robots.txt fulfills this requirement, giving you legal grounds for DMCA/TOS takedown notices.

2. The Active Security Layer (Cloudflare WAF)

robots.txt does not physically block anyone. Rogue scrapers or malicious bots can simply ignore the file. To physically stop scrapers, AIGuard generates active enforcement scripts (Cloudflare Workers, Nginx configs, AWS WAF rules). Cloudflare drops the connection instantly at the edge, meaning zero bandwidth is consumed on your server.

Threat Mitigation Metrics

In your AIGuard dashboard, the "threats neutralized" metric combines direct domain scans with a taxonomy multiplier. If you scan 62 domains, the system assumes protection policies against the known AI bot classes (e.g., 62 scans * 9 active threat types). True live blocking numbers require deploying the Cloudflare Worker integration.

Audit & Compliance Tools

AIGuard provides automated tools to ensure strict adherence to international regulations.

Automated Data Retention

AIGuard runs an automated SQL cleanup process. Depending on the plan (e.g., 7 days for Free, 365 days for Enterprise), scheduled background jobs overwrite sensitive PII fields with [REDACTED] or permanently purge logs. Under GDPR's Storage Limitation Principle (Art. 5(1)(e)) and CCPA, keeping user PII indefinitely is illegal. However, redacting PII into anonymized metrics allows for long-term storage (e.g., 1 year under Article 6(1)(f) "Legitimate Interest") for cybersecurity auditing without legal risk. HIPAA mandates retaining audit logs for at least 6 years, and PCI-DSS requires retaining history for at least one year.

Liability Risk Estimation

The dashboard displays "Estimated Regulatory Liability Avoided" (e.g., $117,000). This is a liability risk estimation, similar to cyber-insurance underwriting. It takes the number of PII items masked and multiplies them by estimated regulatory fines per exposed record (e.g., GDPR fines up to €20M, HIPAA fines up to $73,000+). The report assigns a baseline penalty risk per item—typically $300 to $500 for SSNs or financial data.

Content Hashing & Takedowns

When you register content, AIGuard generates a fixed-length cryptographic hash (like SHA-256) and a timestamp. Because a hash cannot be retroactively altered, it provides irrefutable temporal proof of prior existence in copyright disputes. AIGuard can then generate a formal DMCA or EU TDM legal package, pulling together the URL, bot user-agent, and violated terms.

Jurisdiction and Extraterritorial Reach

Privacy and copyright laws are specifically written with extraterritorial reach. A company does not need to be physically located in a country for that country's laws to apply.

  • GDPR (EU): Applies to any business globally if they process personal data belonging to people located inside the EU/EEA.
  • CCPA (California): Applies to companies doing business in California that process personal data of residents.
  • EU Copyright Directive (Article 4): Applies to any commercial AI company that offers services or scrapes content originating from within the EU.
  • HIPAA (US): Applies to US healthcare entities and their data-processing vendors (including software proxies like AIGuard).

If an AI company based in a weak-regulation country sells models to customers in the EU or US, they fall under those jurisdictions and face regulatory action. In countries without explicit AI opt-out laws, robots.txt acts as a Notice of Intent, serving as evidence of Trespass to Chattels or Breach of Terms of Service.