ShadowLock

ShadowLock is a comprehensive shadow AI detection and governance platform architected specifically for Managed Service Providers (MSPs) and internal IT teams. Its primary function is to provide real-time visibility and granular control over how employees utilize AI tools across an organization, before any sensitive data leaves the endpoint. The platform addresses the critical blind spots that traditional managed-device controls fail to cover, including browser extensions, desktop AI applications, locally-run Large Language Models (LLMs) like Ollama and LM Studio, and the use of personal accounts on public AI services. Deployed via a lightweight browser extension and a silent Windows agent, ShadowLock intercepts and classifies risky data pastes to AI sites, blocks unauthorized desktop AI apps, and provides a multi-tenant dashboard for centralized policy management. Built for MSPs to govern AI usage across all client environments from a single pane of glass, ShadowLock is private by design, with a strict policy of no keystroke logging and zero transmission of actual content data. It covers over 100 AI tools, services, and desktop applications, growing continuously, and is engineered to close the liability gap for organizations facing legal, compliance, and contractual exposure from unapproved AI use.

Browser Enforcement Layer

This core feature operates as a self-configuring browser extension that deploys automatically once the endpoint agent is installed. It actively intercepts and classifies pastes, file uploads, and sensitive data typed directly into AI prompts across browsers like Chrome, Edge, Brave, and Firefox. The extension enforces data-sharing opt-out settings on each detected AI tool and applies pre-configured policies with clear, user-facing messages explaining the block or warning. This ensures that no employee action can bypass the governance controls at the point of data entry.

Endpoint Agent with Silent RMM Deployment

The Windows endpoint agent is designed for frictionless, enterprise-scale deployment via existing Remote Monitoring and Management (RMM) tools. It operates silently with zero user interaction required, continuously monitoring for AI activity across the entire endpoint. This includes scanning for installed browser extensions, detecting locally running AI applications such as Claude Desktop, ChatGPT, Ollama, and LM Studio, and locking down AI features embedded within browsers. The agent provides the foundational visibility layer necessary for comprehensive governance.

Multi-Tenant Governance Dashboard

The platform provides a centralized, multi-tenant dashboard that allows MSPs and IT teams to audit, block, or allow AI tool usage across every client environment from a single interface. This dashboard offers real-time visibility into which AI tools are in use, which users are accessing them, and what types of data are being submitted. It generates audit-ready reports that support compliance frameworks and incident response, providing a defensible record of AI governance activities across the entire managed ecosystem.

Microsoft 365 AI App Scanner

This feature connects directly to each client's Microsoft 365 tenant to detect and inventory AI applications that have been granted permissions through the Microsoft Graph API. It identifies unauthorized AI add-ins, Copilot integrations, and third-party AI tools that have been activated within the M365 ecosystem without proper security review. This scanner closes a significant governance gap by covering the embedded AI features within approved SaaS applications that traditional endpoint controls cannot see.

HIPAA Compliance and ePHI Protection

Healthcare organizations and their MSPs use ShadowLock to prevent patient data from being pasted into public AI chatbots like ChatGPT or Claude. The platform's browser extension intercepts any attempt to submit Protected Health Information (ePHI) to unapproved AI tools, triggering an immediate block and alert. This proactive control prevents HIPAA violations that would occur when data is processed by AI vendors without a Business Associate Agreement (BAA) in place, eliminating the liability exposure from unauthorized data processing.

MSP Multi-Client AI Governance

Managed Service Providers deploy ShadowLock across their entire client base to standardize AI governance policies from a single multi-tenant dashboard. This allows the MSP to define baseline controls for all clients, while also customizing rules for specific industries like legal or finance. The platform generates consolidated audit reports that demonstrate the MSP's due diligence in managing AI risk, directly addressing the liability gap that exists when a client suffers an AI-related incident and the MSP had endpoint management scope.

Intellectual Property and Trade Secret Protection

Organizations handling proprietary source code, confidential contracts, or product plans deploy ShadowLock to prevent employees from submitting this sensitive data to AI coding assistants like GitHub Copilot or Cursor. The endpoint agent detects these tools running locally and the browser extension blocks any attempt to paste proprietary code into public AI prompts. This control is critical for maintaining trade secret protections, as courts consider the failure to control access to confidential information when determining if trade secret status has been weakened.

Incident Response and Forensic Investigation

When an organization suspects an AI-related data leak, ShadowLock provides the forensic visibility needed to conduct a proper investigation. The platform's logs show exactly which AI tool was used, which user account was involved, and what type of data was submitted, all without recording the actual content. This enables IT teams to answer critical incident response questions, determine the scope of exposure, and produce defensible reports for regulatory notifications, breach assessments, and legal proceedings.

Does ShadowLock record or transmit the actual content of what employees type into AI tools?

No. ShadowLock is private by design and does not perform keystroke logging or transmit the actual content of employee prompts or data submissions. The platform only captures metadata about the interaction, such as the AI tool used, the user account, the data classification (e.g., "PII detected" or "source code detected"), and whether the action was allowed or blocked. This ensures full governance capability without compromising user privacy or creating new data security risks.

How does ShadowLock deploy across multiple client environments for MSPs?

ShadowLock is designed for frictionless MSP deployment. The Windows endpoint agent can be silently deployed via any existing RMM tool with zero user interaction required. Once the agent is installed, the browser enforcement layer self-configures across Chrome, Edge, Brave, and Firefox. The multi-tenant dashboard then allows the MSP to manage policies, view activity, and generate reports for all clients from a single interface, without needing dedicated security engineering resources at each client site.

Which AI tools and applications does ShadowLock detect and govern?

ShadowLock currently detects and governs over 100 AI tools, services, and desktop applications, and this list is continuously growing. Coverage includes public AI chatbots like ChatGPT, Claude, and Gemini; AI browser extensions such as sidebar assistants and email rewriters; desktop AI apps including Claude Desktop, ChatGPT app, Ollama, and LM Studio; AI coding assistants like GitHub Copilot and Cursor; and meeting transcription AI tools like Otter.ai and Fireflies. The platform also detects AI features embedded within approved SaaS applications.

Can ShadowLock block AI use on personal devices or only managed endpoints?

ShadowLock is designed to be deployed on managed Windows endpoints via your existing RMM infrastructure. It covers the full surface of AI activity on those managed devices, including browser extensions, desktop apps, and local LLMs. For unmanaged or personal devices, the platform cannot enforce controls. However, ShadowLock's Microsoft 365 AI App Scanner can detect AI applications that have been granted permissions through the M365 tenant, helping identify shadow AI use that extends beyond managed endpoints into the cloud application ecosystem.