AIEGIS Privacy Policy

1. Who we are

aiegis is operated by aiegis Ltd (Ireland). Privacy contact: [email protected]. Postal address available on request via that mailbox.

2. What AIEGIS captures

AIEGIS EYE captures the following data on the endpoint:

Prompt content is captured only on flagged or blocked events. AIEGIS EYE does not perform in-browser text redaction. By default, the sensor records metadata only (tool identity, timestamp, allow/block decision). Full prompt text is captured and stored on the customer's own infrastructure only when the policy engine flags or blocks that specific prompt. The sensor does not invoke any AI model — local or remote — for post-processing. All captured records remain on customer-controlled infrastructure; AIEGIS does not receive prompt content.

3. What AIEGIS does NOT capture

• Anything outside the browsers / pages the customer's IT explicitly enables (default scope: chat.openai.com, chatgpt.com, claude.ai, gemini.google.com, copilot.microsoft.com).
• Personal browsing (Gmail, banking, social media) — content scripts only inject on the AI-vendor domains above.
• Keystrokes outside the AI chat boxes.
• Files, downloads, screenshots.
• Webcam, microphone, location.
• Anything once the extension is disabled in the browser settings.

4. Data flow and policy enforcement (intercept-and-conditionally-block model)

aiegis is not a passive logger. The browser extension intercepts AI service calls before they leave the browser, allowing the customer's policy engine to permit or refuse each prompt. The interception is read-only on prompt content — aiegis never modifies what the user typed before forwarding. The flow for a single prompt:

1. Observe. The extension's content script monkey-patches window.fetch + XMLHttpRequest. When the user submits a prompt to ChatGPT / Claude / Gemini / Copilot, the extension reads the prompt body client-side, in-browser. No data has left the machine yet.
2. Check policy. The prompt is evaluated by the customer's local policy engine (the aiegis daemon's /api/protect endpoint on localhost). The customer configures the policy.
3. Enforce. If the policy returns BLOCK, the wrapped fetch call is refused — the prompt never reaches the AI vendor. If ALLOW, the original (unmodified) request is forwarded to the original vendor URL the user requested (chatgpt.com / api.anthropic.com / etc.).
4. Log. Metadata (tool, timestamp, decision) is stored on customer-controlled infrastructure. Prompt text is stored only when the event was flagged or blocked.

What this means in practice:

• aiegis does NOT redirect AI-service traffic to a proxy. ALLOW'd prompts go directly to the vendor URL the user requested.
• aiegis does NOT modify prompt content before forwarding. The vendor sees exactly what the user typed.
• aiegis DOES have the technical capability to refuse forwarding. This is the BLOCK feature — disabled by default, enabled per customer policy.
• aiegis's own infrastructure receives nothing about the prompt. The policy check is local (localhost) and the audit log is local (SQLite).

4.1 Scope of the BLOCK feature (current limitations)

The intercept-and-conditionally-block model applies to chat-input prompt text — the content the user types into the chat box, or the JSON body of a direct API call to api.openai.com / api.anthropic.com / generativelanguage.googleapis.com.

It does not currently apply to:

• File attachments (PDFs, images, .docx, .txt, .csv, code files, etc.) uploaded via the vendor's attachment UI. These travel in multipart/form-data request bodies which the current content script does not inspect for redaction or policy check. File-content scanning ships in v0.5 — until then, customers should configure their policy to BLOCK on prompt phrases like "summarise the attached" if file leakage is a concern.
• Voice / image / video input that the vendor handles outside the standard text-prompt flow.
• Prompts submitted via vendor-native desktop apps (ChatGPT desktop, Claude desktop, Copilot in Word/Excel) that bypass the browser entirely. Native agent coverage ships in v0.5 (Mac) / v0.6 (Windows).

Customers deploying aiegis with the BLOCK feature enabled should review their employees' workflow with these gaps in mind. The compliance UI surfaces these limitations in the in-app deployment checklist.

4.2 Behaviour when the policy engine is unreachable

If the local policy engine cannot be reached for any reason (engine crashed, configuration error, port collision), aiegis defaults to fail-CLOSED for sovereign and enterprise tiers (the BLOCK verdict is returned to the wrapped fetch and the user sees a banner: "aiegis could not verify this prompt. Submission paused. Retry or contact admin.") For SMB tier deployments, the default is fail-OPEN with the event logged and a customer-visible warning. The fail-mode is bound to the license tier claim and is configurable via the deployment policy.

4.3 Threat model: co-installed extensions with debugger access

aiegis protects against the network-layer threats above (data exfiltration, prompt forwarding, policy bypass). It does not protect against a malicious co-installed browser extension that has been granted debugger permission by the user, since such extensions can read the message traffic of every extension running in the same browser profile. Customer IT should pin allowed extensions via GPO / Intune / MDM and prevent users from installing arbitrary "productivity" or "tab-management" extensions that request debugger permissions. A recommended Edge / Chrome ExtensionInstallAllowlist + ExtensionInstallForcelist policy template is on our v0.3.7 roadmap; until then, customer IT can build their own policy referencing the aiegis extension ID published in the deployment section of /.well-known/privacy.json.

There are exactly three outbound network calls aiegis itself makes (separate from the user's own AI-service traffic):

Captured prompts are never sent to aiegis Ltd or any third party. They live in a local SQLite database on the capturing machine. The compliance dashboard runs on the customer's own machine and queries the local database over localhost. aiegis Ltd's infrastructure never sees prompt content — that's both a policy commitment and a structural property of the system, verified by static analysis (see check_outbound_endpoints.sh).

5. Edge / Microsoft Add-ons specific disclosure

Per Microsoft Edge Add-ons policy 1.6 and 1.5.3:

5.1 Permissions and why

5.2 First-run consent (v0.3.6+)

The extension shows a first-run consent dialog before any capture occurs. Capture is opt-in (administrator policy), and the user can disable enforcement via the popup at any time, even when policy-installed.

5.3 Third-party data sharing

None. aiegis does not share captured data with OpenAI, Anthropic, Google, Microsoft, aiegis Ltd, or any other third party. The data lives on the customer's machine, end of pipeline.

6. Legal basis (GDPR Article 6 / Article 13)

Lawful basis: Article 6(1)(f) — legitimate interest. The customer (the data controller) has a legitimate interest in evidencing AI usage for regulatory compliance (EU AI Act Article 26 record-keeping obligations, ISO 42001 controls).

Data subjects' rights: Employees of customer organisations may request access, rectification, or deletion of records pertaining to them through their employer's compliance officer. aiegis Ltd does not have access to the customer's local database and cannot fulfill these requests directly — only the customer can.

7. Retention

aiegis Ltd retains zero captured prompt data — it never reaches us. Captured data persists in the customer's local SQLite database indefinitely, until the customer deletes it. The daemon does not auto-prune or rotate the database; that decision sits with the customer and their IT / DPO. A 90-day local-rotation policy is on our v0.4 roadmap as a configurable opt-in. Until then, retention is 100% under customer control: the database file at ~/Library/Application Support/aiegis/captured.db (Mac), %LOCALAPPDATA%\aiegis\captured.db (Windows), or ~/.local/share/aiegis/captured.db (Linux) is the authoritative store.

8. License revocation and account termination

When a license is revoked (admin action), the daemon stamps subsequent events as license_revoked security events but does not delete prior captures (Article 26 evidence retention). The customer retains full local access to their database; aiegis Ltd has no access before, during, or after revocation.

9. Cookies and tracking on aiegis.ie

The aiegis.ie marketing site uses no third-party trackers, no advertising pixels, and no cross-site cookies. A single first-party session cookie is set on the admin dashboard for authentication only.

10. Machine-readable disclosure

A machine-readable summary of this policy is published at /.well-known/privacy.json for enterprise procurement / DPIA tooling. The JSON document mirrors this page's data-flow tables and is updated when this policy is revised.

11. Changes to this policy

Material changes are announced 30 days in advance via email to the registered admin contact for each customer. The version number and effective date at the top of this page are authoritative.

12. Contact

• Privacy: [email protected]
• Security: [email protected]
• General: [email protected]