Say yes to AI.
Keep your data.
nPro shows which AI tools your staff use, rates how risky each one is, and controls what sensitive data reaches them. Every check runs on your own servers.
In short
- Know the tools. An AI app registry rates every AI tool from Low to Critical risk, and tools nobody has approved yet are flagged for review.
- Control the data. Pastes and uploads are recorded against the real destination, and policies can stop restricted data reaching any high-risk AI tool.
- Keep it sovereign. nPro is self-hosted only. The prompts and files it checks never go to a vendor cloud to be inspected.
Visibility
Know every AI tool in use
New AI tools appear every week. Listing websites one by one does not keep up, so nPro works from a catalogue that rates each tool by risk.
AI app registry
Each AI tool is rated by whether it trains on your data, where it stores data, whether it offers a data processing agreement and whether an enterprise version exists. Admins can edit ratings and add tools.
Unknown AI detection
When data goes to an AI tool that is not in the catalogue yet, it is flagged for an admin to review and add. That is how shadow AI, the tools nobody has approved, gets caught.
The real destination
When someone pastes into or uploads to a website, nPro records the actual app. A paste into Gemini shows as Gemini, not as an anonymous Google server address.
AI tools on each laptop
See which AI tools are installed on each endpoint, and which plug-ins (MCP servers) they are set up to use. Plug-ins can reach files and passwords, so they are a risk in themselves.
This reports what is installed and configured, not what the AI tool did.
Control
Govern AI instead of banning it
Banning AI tends to push it onto personal phones and accounts. These controls let staff keep using it while restricted data stays where it belongs.
AI Gateway
A single approved route for staff to use AI tools. Every prompt is checked against company policy and logged, so adopting AI does not mean losing sight of it.
Risk-based rules
Write policies the way you think about them, such as "block restricted data to any high-risk AI tool", combining data sensitivity, destination risk, channel and time of day.
Warn before you block
In Audit posture, staff see why an action is risky and can carry on, while the event is recorded. Messages can be shown in English, Bahasa Malaysia or Bahasa Indonesia.
Strict AI-agent template
One of nine ready-made policy templates, for organisations that want a tight starting point for AI. You see exactly what will change before it is applied.
Threats and evidence
Risks that only exist because of AI
Prompt-injection detection
Detects hidden instructions in content that try to hijack an AI tool. It is a new attack type that few DLP products cover.
Data lineage
Follows the same file from where it is stored to a browser upload or a USB copy, even if it was renamed on the way, to answer "did this file leave, and how?"
MITRE ATLAS tagging
Alerts are labelled with the MITRE ATLAS or ATT&CK technique they represent, so AI risks sit in the same framework language as the rest of your security alerts.
Unapproved AI in PDPA reports
Scheduled PDPA compliance reports include unapproved AI use alongside personal data found, cross-border transfers and blocks. PDF or CSV, emailed daily, weekly or monthly.
Why it matters where the checking happens
To govern AI use, a tool has to read what staff paste, upload and type into prompts. That is the most sensitive content in the organisation. Many AI security products send it to their own cloud to be checked.
nPro takes the other route. It runs on a server inside your network, the checks happen there, and the findings stay in your own database. For organisations under Malaysia's amended PDPA, Indonesia's PDP Law or Vietnam's PDPL, that keeps AI governance from becoming another cross-border transfer to explain.
It is the same platform as nPro DLP, XDR, SIEM and EMS, so AI events land on the same timeline as every other security event. See nPro DLP →
What it does not do
- On the endpoint, nPro reports which AI tools and plug-ins are installed and configured. It does not record what an AI tool did.
- Data lineage covers stored files, browser uploads and USB copies, not every channel.
- Outbound email is monitored through your mail platform's audit feed but not blocked inline yet.
Questions about AI governance
What is shadow AI?
Can nPro see which AI tools our staff send data to?
How does nPro rate the risk of an AI tool?
Does nPro block AI tools?
Does nPro send our prompts or files to its own cloud to check them?
Does nPro record what an AI tool did on a laptop?
Find out where your data already goes
The free 30-day Data Exposure Audit runs in monitor mode and shows which AI tools your sensitive data reached, by whom and through which channel. Nothing is blocked and nothing leaves your network.