Kerios inspects every prompt your team sends to Claude, Copilot, Codex and Cursor. AWS keys, API tokens, customer data — blocked or redacted at the source, before they reach the model. Self-hosted. Tamper-evident audit log.
What's broken
Every developer installs them. Every config drifts. Nobody can answer the auditor's question: "show me what the AI was allowed to do on May 14th."
For the CISO
For the VP Engineering
Allow · warn · block · redact — decided on the laptop, before the model sees a byte. The verdict lands in a tamper-evident audit log; the prompt itself never has to be stored.
Three steps
One command on each dev laptop. The agent registers with your self-hosted brain over mutual TLS and starts intercepting traffic to AI provider hosts. Fleet inventory populates in under a minute.
curl -sf kerios.sh | shEvery outgoing prompt is scanned for AWS keys, API tokens, vendor credentials, and env-style secrets. Composable rules let you match by host, model, body size, or content — and decide: allow, warn, block, or redact.
action: allow | warn | block | redactEvery detection, every decision, every config change — written to a SHA-256 hash-chained audit log. The prompt itself never gets stored, only the verdict and the rule that fired. Hand it to your auditor on demand.
kerios audit export > soc2.jsonIn the box
AWS access keys, Anthropic and OpenAI tokens, env-style assignments. Four built-in patterns out of the box, more on Security tier.
Per-rule action: drop the request, alert the dev, or rewrite the body so AKIA... becomes [REDACTED:aws_access_key] before forwarding.
Match by host, model, body size, message count, secret presence. Combine with all / any. First rule wins.
SHA-256 hash chain — break it, the verifier shouts. Stores verdict + rule, never the prompt itself. Optional HMAC signing on the Security tier.
Fleet inventory, audit explorer, policy editor, live reload. Read-only mode for auditors.
One command emits PDF + JSON covering data-loss controls (CC6.7) and change logging (CC7.2). Hand it to your auditor as-is.
Where Kerios sits
Most AI security tools sit between your devs and the model — in their SaaS. Kerios sits on the dev's machine. The secret never has to leave to be inspected.
| Kerios | Prompt Security · Lakera | DTEX · Incydr | Git + shell scripts | |
|---|---|---|---|---|
| Where inspection happens | On the dev's laptop | Vendor SaaS or proxy | Endpoint telemetry | Nowhere |
| Secret leaves the laptop on detection | No | Yes — to their SaaS | Yes — to their cloud | Yes — to the model |
| AI-vendor aware | Yes (4 vendors, parsed bodies) | Yes | No | No |
| Block, warn, or redact | All four — per rule | Block / warn | Warn only | None |
| Tamper-evident audit | Yes — SHA-256 chain | Vendor's choice | Vendor's choice | None |
| Deployment | Self-hosted, mTLS | SaaS | Endpoint agent | N/A |
| Stores the prompt content | No (only verdict + rule) | Often yes | No | N/A |
| SOC 2 evidence export | One command | Varies | Varies | You write it |
How it's built
Nothing leaves your VM unless you route it there yourself.
Agents authenticate with mTLS using certificates you issue. Tokens never leak — there are none.
SHA-256 chain. Every entry references the previous hash — deletions and edits are detectable. HMAC signing on Security tier.
Brain server in your VPC. No Kerios cloud, no telemetry endpoint, no phone-home. Signed binaries you pull on your schedule.
The SOC 2 evidence pack maps to CC6 (logical access) and CC7 (change management). One command emits a dated PDF report + the underlying JSON. Hand it to your auditor without further translation.
Simple, per developer
Engineering-led buys. Stop secret leaks into AI prompts before procurement gets involved.
CISO-led buys. Everything Team has, plus the integrations, custom rules, and signing your SecOps team will ask for.
500+ developers, regulated industries, or custom detection rule engineering.
Indicative pricing — final terms agreed at contract signing. Annual contracts available.
Common questions
Where it happens. They inspect prompts in their cloud — meaning the secret has already left the laptop by the time it's caught. Kerios runs on the dev's machine; the bytes are inspected before they hit the wire. If a rule fires, the request is blocked or the secret is redacted in-place. Kerios is also self-hosted, so the prompt content never leaves your perimeter, not even to us.
Kerios inspects prompt content for one specific purpose: catching secrets, credentials, and confidential data before they leave the laptop. That analysis happens locally and ephemerally — the prompt itself is never stored. Only the verdict (clean / flagged / blocked) and a content fingerprint reach the audit log. No keystroke logging, no completions captured, no screenshots, no source-code scanning. The agent is open about what it inspects; kerios status shows every detection rule active. When a prompt is blocked, the developer sees a brief notification with the rule that fired. Engineers aren't being watched — they're being kept from pasting AWS_SECRET_ACCESS_KEY into Cursor at 11pm.
Outbound HTTPS to AI provider hosts only — api.anthropic.com, api.openai.com, GitHub Copilot, Cursor. A local trust certificate lets the agent terminate that TLS, scan the body, decide, and forward. Nothing else is watched: no filesystem scan, no process list, no DNS spying, no general-purpose packet capture. Hosts you opt out of route around the agent untouched.
Your VM. Brain server, audit database, admin UI — all self-hosted. We don't operate a cloud. We don't have a telemetry endpoint. Updates ship as a signed binary you pull on your schedule.
Agents keep enforcing the last policy they fetched. New changes can't be pushed until the brain is back, but existing configs don't drift and developers don't notice. The audit log buffers locally and reconciles on reconnect.
A 50-developer rollout typically lands in under a week: day one for the brain server in your VPC, two days for git baseline definition, two days for staged agent rollout. Most teams are in production by Friday of week one.
Twenty-minute demo. Self-hosted trial in your VPC if it's a fit. No procurement gauntlet.