PromptGuard

PromptGuard is a security layer between an application and its LLM provider that inspects requests before they reach the model. It describes 15 detectors across six layers for risks including prompt injection, jailbreaks, personal information exposure, data exfiltration, toxicity, fraud, secrets, malware, and tool injection. The product says it can detect and redact 43 PII types using reversible tokenization. Its SDK can automatically instrument supported LLM calls with one initialization call while leaving existing provider code unchanged. Listed providers include OpenAI, Anthropic, Gemini, Azure, Bedrock, Mistral, Cohere, DeepSeek, Groq, HuggingFace, Ollama, and vLLM. Deployment options are managed cloud, hybrid self-hosting, and air-gapped installations. In zero-retention mode, prompt and response content is not stored; default security events contain a shortened preview and content hash. PromptGuard says customer prompts, completions, and documents are not used to train, fine-tune, or evaluate models. The permanent Free tier includes 20,000 scans a month, one API key, one project, and 24-hour log retention. Paid plans include a 14-day money-back guarantee, not a trial.

PromptGuard provides request inspection, data controls, and several deployment modes for LLM applications. Note that its free tier is permanent rather than a trial, and the listed OWASP LLM Top 10 coverage includes partial areas and gaps.

It suits application teams that want to inspect LLM requests before they reach a provider, including for prompt injection, PII, or data leakage risks. Its self-hosted and air-gapped deployment choices may suit teams that need deployment beyond managed cloud.

Overview

PromptGuard is a security layer for applications that send requests to large language models, built for teams that need to inspect traffic and manage sensitive data. It suits organizations deploying LLM applications across different infrastructure environments. Its breadth is useful, but its OWASP coverage has meaningful gaps and the hosted service runs only in the United States.

Key features

Inspection, testing, and privacy

PromptGuard describes 15 detectors across six layers, covering risks such as prompt injection, jailbreaks, PII, data exfiltration, toxicity, fraud, secrets, malware, and tool injection. It also supports prompt-injection, jailbreak, data-leakage, unsafe-output, and custom tests. That makes it relevant both for screening live requests and checking application behavior; it is not a complete OWASP LLM Top 10 solution, with five risks covered in full, five partially, and gaps including provenance verification and vector-store isolation.

The product says it can detect and redact 43 PII types using reversible tokenization, allowing sensitive values to be masked while preserving the option to restore them. Its SDK can instrument supported LLM calls with one initialization call without changing existing provider code, a practical fit for teams seeking to add inspection without rewriting provider integrations. Supported providers include OpenAI, Anthropic, Gemini, Azure, Bedrock, Mistral, Cohere, DeepSeek, Groq, HuggingFace, Ollama, and vLLM.

Deployment and data handling

Managed cloud, hybrid self-hosting, and air-gapped deployment give organizations options for different infrastructure and isolation needs. Air-gapped licences validate offline with a signed key. In zero-retention mode, prompt and response content is not stored; default security events instead retain a truncated 500-character preview and a content hash. PromptGuard says customer prompts, completions, and documents are never used to train, fine-tune, or evaluate models.

The hosted service runs on Google Cloud Run in us-central1, with no hosted EU region. Organizations that require EU-hosted service should look elsewhere or assess the self-hosted options. GDPR and CCPA are supported; SOC 2 Type II certification has not yet been achieved, and ISO 27001 is planned.

Pricing

PromptGuard has a permanent Free tier, not a time-limited trial. Paid plans include a 14-day money-back guarantee. The plans trade scan volume, retention, and organizational controls, so the right choice depends on both request load and operating requirements.

• Free — free: 20,000 scans a month, one API key, one project, 24-hour log retention, and community support. This is a useful way to try the service or run a small project, but the single-key and short-retention limits constrain team use.
• Team — $19 a month: 15,000 pooled scans per seat, browser extension and macOS/Windows agent, fleet enrollment, MDM, and organization-wide policy, with email support and a 48-hour response time. It is the entry point for teams needing endpoint and fleet controls; its pooled, per-seat allowance can be less suitable for concentrated high-volume usage.
• Pro — $99 a month: 100,000 scans a month, five API keys, five projects, seven-day log retention, and email support with a 48-hour response time. It fits teams running several projects that need more volume and retention than Free, though the five-key and five-project caps remain.
• Scale — custom pricing: 500,000 requests a month, unlimited API keys and projects, 30-day log retention, and priority support with a 24-hour response time. Overage is metered at $0.40 per 1,000 requests up to a spend cap. This suits larger workloads that need room to grow, but the base price is custom.
• Enterprise — custom pricing: Custom volume, fully air-gapped deployment, SCIM, IP allowlist, custom retention, and dedicated support with a four-hour response SLA. It is for organizations with isolation or access-control requirements beyond the other tiers; the custom price calls for a direct quote.

Platforms

PromptGuard supports API, browser extension, Linux, macOS, self-hosted, web, and Windows use. The extension and macOS/Windows agent are included with Team. Its mix of hosted and self-managed deployment is useful for varied environments, while air-gapped operation is specifically offered for tightly isolated deployments.

Who it's for

PromptGuard is best suited to teams building or operating LLM applications that need request inspection, PII controls, testing, and a choice of deployment models. The permanent free allowance offers a low-commitment starting point, while Scale and Enterprise address higher volume and isolation needs. It is a weaker fit for organizations requiring a hosted EU region or complete OWASP LLM Top 10 coverage.

Pros and cons

• Pro: Multiple deployment modes, including offline-validated air-gapped licences, support organizations with strict infrastructure boundaries.
• Pro: Reversible tokenization and zero-retention mode provide practical choices for reducing exposure of sensitive prompt and response content.
• Pro: SDK auto-instrumentation can add supported-call inspection without changing existing provider code.
• Con: OWASP coverage is incomplete, with partial areas and named gaps around provenance verification and vector-store isolation.
• Con: Hosted service is limited to us-central1, which rules it out for buyers requiring an EU hosted region.
• Con: Free logs last only 24 hours, and the plan is limited to one API key and one project.

Alternatives

Promptfoo is worth considering for teams prioritizing red-team probes and broad LLM evaluation features: its Community plan is free with 10k probes a month and local or self-hosted operation. AgentScan is another free-tier option for agent security scanning, with five monthly scans and 185 attack vectors on Free. Giskard may suit teams seeking an open-source library and local deployment, with basic LLM vulnerability scanning and RAG evaluation on its free tier.

OpenSecureAI Scanner is an alternative for buyers considering a $49 a month Pro plan with 50,000 API requests monthly and a hosted LLM gateway. Basilisk offers a free, AGPL-3.0 open-source CLI, desktop, Docker, or source distribution for authorized use. Akto Agentic Red Teaming and Mindgard are paid web alternatives. Augustus is a free Apache 2.0 open-source option for Linux, macOS, Windows, and self-hosted use; API usage may require provider credentials.

For broader comparisons, see AI Security Testing Tools, LLM Security Tools, and AI Guardrail Software.

Verdict

Choose PromptGuard if your team needs a flexible security layer for LLM traffic, especially when PII controls and self-hosted or air-gapped deployment matter. Its main advantage is combining request inspection, testing, and varied deployment choices; its main reasons to look elsewhere are incomplete OWASP coverage and the absence of a hosted EU region.