Rules per team
Define policies for teams, employees, or entire organization
Every AI prompt is checked before it leaves the device.
Alesia sits between people and the AI tools they use. On the device, it allows, warns, redacts or blocks each prompt by the rules set in the Alesia Dashboard. Only metadata ever leaves.
Example: the Alesia Dashboard sets the policy, and Alesia on the device checks every prompt before it reaches an AI tool. A meeting summary from the browser and a coding prompt from the IDE are allowed, a card number typed in the browser is redacted before it reaches Claude, notes on a customer from a desktop app get a warning and the person decides what happens, and a request from the terminal to DeepSeek, an unsanctioned tool, is blocked by Alesia and never leaves the device. Only metadata leaves the device.
Alesia Dashboard
Set the rules once. See where AI is used.
Admins define policy, deploy detection models, and see shadow AI usage and analytics across the organization from one dashboard. It can run in our cloud or self-hosted inside yours.
Detection models
Deploy and update detection models without touching devices
Every AI tool in view
See every AI tool in use, and how, across the organization
Cloud or self-hosted
Self-hostable for organizations that need it in their own environment
Alesia
A lightweight daemon that watches the network layer, not each app.
Alesia runs on the device and works at the network layer, so it covers 100+ AI tools out of the box: browser, IDE, terminal and desktop apps. It enforces your policy before anything is sent.
Browser AI chat
The surface where careless pasting overwhelmingly happens. ChatGPT, Claude and Gemini in the browser, checked before every send.
IDEs
Coding assistants that auto-attach large amounts of company code as context, without the employee actively choosing to share it.
Command Line
Piped output and agent prompts in terminal workflows.
Native Apps
Desktop AI clients, covered the same way, at the network layer.
Extensions
Optional extensions for a better warning, right where the work happens.
Alesia alone is enough to detect and enforce. Extensions, like a browser extension, are optional add-ons that surface a warning directly on the page instead of a separate popup, so the employee sees it exactly where they were about to paste.
Available on
macOSComing soon
Windows
Linux
Download nowmacOSComing soonWindowsLinuxDetection
How on-device content protection works.
Four checks run on every message, on the device, before it is sent. Together they catch what a simple keyword match would miss.
Layer 01
Layer 01
Known-shape secrets
Credentials, API keys, card numbers and anything with a recognizable, near-certain form. These are the cases that warrant a hard block rather than a warning.
Layer 02
Layer 02
Company-specific terms
Project codenames, customer names, unreleased product names. The organization seeds these in advance, and Alesia matches them on the device.
Layer 03
Layer 03
Resemblance to confidential docs
Catches paraphrased or reworded versions of material the company marked confidential. A plain keyword match would miss this entirely.
Layer 04
Layer 04
A judgment layer for the rest
Genuinely ambiguous cases get a contextual pass. Several small hints together can matter more than any single signal alone.
Human in the loop
When it's a judgment call, a human makes it.
Not every prompt is clearly fine or clearly forbidden. For the grey areas, Alesia warns instead of blocking. The person at the keyboard sees why and chooses what happens next. That choice is recorded as metadata, so you see how warnings play out without reading a single prompt.
Proceed anyway
Send it as it is when the context makes it fine.
Redact and send
Flagged values are replaced with placeholders before anything is sent.
Edit the message
Change the prompt before it goes anywhere.
You decide which rules warn and which block
Reporting
Only the event crosses the boundary. Never the message.
Once a message is checked, only metadata about that event, its category, severity, and the employee's decision, is sent to the dashboard. What the employee actually asked never leaves the device.
On the deviceNever Transmitted
- The message the employee wrote
- The detection verdict
- The company's policy and seeded terms
- Any matching confidential documents
To the organizationMetadata Only
- Category that was flagged
- Severity of the signal
- When the event happened
- Whether the user proceeded
For organizations in the EU, especially Germany, this on-device boundary is what clears data protection and works council review, without a separate fight over employee monitoring.
See the works council use caseFAQs
Alesia works on the network layer, so all surfaces are covered, like browser, IDEs, CLI, and native apps. Mobile apps are coming soon.
Yes. Alesia inspects context attached for you, not just what you paste, which is where much of the real leakage now happens.
Detection runs on the device, so it works without sending content to the cloud. Online access is only needed for metadata reporting and policy sync.
The boundary is structural: the architecture has no path that transmits content. That makes it auditable in a way a policy promise alone isn't.
Only metadata: the category flagged, its severity, when it happened, and whether the employee proceeded. Never the message or the document.
No. Content is never transmitted to Alesia either. There is nothing to train on because nothing arrives.
Say yes to AI.
Set the rules once. Alesia enforces them on every device, and prompts stay on your devices.