01 / 09

Network-Level AI Inspection

Inspect every AI interaction across your network—browser, API, mobile, and developer tools—without disrupting your team's workflow. Runs entirely within your infrastructure.

Broad Coverage: Inspect browser and API sessions across ChatGPT, Claude, Gemini, and more.
Frictionless Rollout: Deploy seamlessly via Enterprise CA—zero configuration required on client devices.
You Set the Latency Budget: Pattern-based detection runs inline in the request path. Heavier controls—ML guardrail, OCR, external DLP—are enabled per rule, so you decide what each user's traffic pays for.
Strict Data Sovereignty: Fully self-hosted architecture. No outbound connections except to the LLM endpoints you explicitly allow.
Complete Audit Trail: Every intervention is recorded—blocked, masked, or simply observed—filterable by date, outcome, and event type, with instant search across millions of events.

Inspection pipeline · live

            # arceris.gateway/inspect log

            → REQUEST POST claude.ai/api/v1/messages

              POLICY pii_check=PASS inject_check=PASS

              ROUTE → claude.ai (upstream)

            ← RESPONSE 200 OK · 384ms

              LOG event_id=evt_4831 action=ALLOW

8

Controls in one pass

0

Data leaves your network

100%

Self-hosted

API Gateway · drop-in

            # only two lines change

            - base_url = "https://api.openai.com/v1"

            + base_url = "https://ai.your-co.internal/v1"

            - api_key  = OPENAI_API_KEY

            + api_key  = ARCERIS_USER_KEY

            # every call now inherits

              POLICY redact=ON model_acl=ON rate_limit=ON

              SPEND team:data $412 / $500 OK

              LOG event_id=evt_5102 complete

1

Key per user

0

Provider keys on laptops

100%

Calls logged

02 / 09

Unified AI API Gateway

One gateway key per user, one endpoint for every AI provider. Real provider keys are entered once, stored encrypted inside your own infrastructure, and never appear in code, config files, or on laptops again. Every call automatically inherits the full protection stack.

Drop-in Adoption: Change only the address and the key—existing code and SDKs keep working.
Keys Stay in the Vault: Provider credentials never leave your infrastructure—rotated and revoked centrally.
Cost Visibility: Per-user and per-team usage and cost reporting, in one panel.
Spend Limits That Act First: Budgets are enforced before the money is spent—not reported after.
Self-Serve or Centrally Assigned: Users connect their own provider accounts, or admins assign them from the panel.

03 / 09

Advanced PII Scanning & Redaction

28+ out-of-the-box detectors covering global and regional data types. Block, mask, or log in real time—on requests and on responses, which now stream to users word-by-word while sensitive data is masked in flight.

Live Streaming Protection: Responses flow word-by-word with zero waiting; sensitive data is masked mid-stream—even when it's split across the stream mid-sentence—across ChatGPT, Claude, and Gemini.
Smart Identification: National ID numbers with algorithmic checksum validation—eliminating the false positives of basic regex.
Financial Data Protection: Detects IBAN, SWIFT, and credit/debit card numbers instantly.
Secrets Management: Prevents the leakage of AWS/GCP/Azure credentials, JWTs, and private keys.
Fully Extensible: Create custom regex patterns and structured entity rules tailored to your organization.

PII Scanner · live

Credit CardIBANAWS Key JWTSSNSWIFT Private KeyPassport NoHealth ID Phone NumberNational IDEmail

            input: "Customer card 4532 0151 1283 0366, SSN 078-05-1120"

            DETECT Credit Card → 4532 0151 1283 0366 (Luhn ✓)

            DETECT SSN → 078-05-1120

            output (masked):

            "Customer card ●●●● ●●●● ●●●● ●●●●, SSN ●●●-●●-●●●●"

            response stream (live):

            "You can reach the customer at ●●●●●@●●●●●.com"▍ ← masked mid-stream

Topic & injection policy · test mode

            # topic policy test · admin panel

            input: "Şirket birleşmesi duyurusundan önce nelere dikkat etmeliyiz?"

            TOPIC M&A / acquisitions → MATCH

            RULE "finans-gizli" · scope: group=finance

            ACTION → BLOCK (test — not enforced yet)

            # injection attempt

            input: "Ignore prior instructions and…"

            RULE "jailbreak-klasik" → BLOCK

            action: request blocked · logged with your rule name

04 / 09

Prompt Injection Defense & Topic Controls

Hardened against current injection and jailbreak phrasings in both English and Turkish. And it goes beyond patterns: Arceris understands what a conversation is about, and enforces policy by subject matter.

Policy by Meaning: Block restricted subjects outright, or keep sensitive topics on approved models only.
Bring Your Own Categories: Define the topics that matter to your organization and safely test them against sample prompts in the admin panel before enforcing anything.
Scoped Rollout: Apply topic policies per user, per group, or per model.
Works Across Languages: First-class Turkish support alongside English.
Your Names, End to End: Rules carry the names you gave them—what appears in the audit log is exactly what you configured.
Per-Rule Strictness: Each rule can block, sanitize, or simply detect and record—enforcement is your choice, rule by rule.

05 / 09

Advanced File & Image Inspection (OCR)

Real-time inspection for every document and image uploaded to AI services. Leverage built-in OCR and file type filtering to eliminate data exfiltration risks before files ever reach the LLM.

Real-Time OCR Scanning: Instantly extract and analyze text from uploaded images and PDFs to detect hidden PII and secrets.
Sensitive Document Detection: Automatically identify and block screenshots, invoices, legal contracts, and ID photos.
Granular File Filtering: Enforce strict MIME-type and extension controls to prevent unauthorized or malicious file uploads.
Zero-Trust for Attachments: Apply all your standard PII and injection rules directly to the contents of uploaded files.

File Scanner · live

📄 invoice_may2026.pdf SCANNING

              # OCR extract · real-time

              EXTRACT page 1/3 → text OK

              DETECT IBAN → TR●●●●●●●●●●●●●

              DETECT TCKN → ●●●●●●●●●●●

              DETECT Phone → +90●●● ●●● ●● ●●

              # verdict

              PII FOUND 3 items

              ACTION mask & forward → upstream

PDF

Scanned

3

PII found

✓

Masked

Developer enrollment · terminal

            $ arceris enroll

            → approve this device in your browser…

            ✓ device enrolled · dev-mbp-14 · d.aksoy · 54s

            $ claude

            ● protected by Arceris · policy: engineering

            DETECT .env → db_password ●●●●●●●● masked

            LOG event_id=evt_5144 · device=dev-mbp-14

<1 min

Enrollment

3 OS

macOS · Linux · Windows

1-click

Instant revoke

06 / 09

Developer & IDE Coverage

AI coding assistants are the fastest-growing AI surface in the enterprise—and most gateways can't see them at all. Arceris covers them: enroll a developer machine in under a minute, and every AI coding tool on it routes through the gateway automatically.

Terminal and IDE Coverage: Claude Code, Gemini CLI, aider, Cursor, and VS Code—with the same redaction, policy, and audit as everything else.
One-Minute Enrollment: Approve once in the browser—done. No manual configuration.
Visible in the Editor: A status indicator and one-click protection toggle, right where developers work.
Full Device Inventory: Admins see every enrolled device in the panel and can revoke any of them instantly.
Download from the Panel: Available for macOS, Linux, and Windows, directly from the admin panel.

07 / 09

Content and Response Controls

Most gateways inspect what goes out. Arceris also inspects what comes back—and what a conversation adds up to over time.

Content Moderation: toxicity, hate speech, violence and self-harm, using either a managed API or a fully local sidecar. Air-gapped deployments keep every byte inside the perimeter.
Response Data Exfiltration Detection: an injected instruction can make a model answer with a markdown image whose URL carries your data. The browser fetches it with no click at all. Arceris detects markdown-image, URL-parameter and zero-width channels, and can neutralize them mid-stream.
Multi-Turn Session Risk: a Crescendo jailbreak never sends a message that trips a pattern—it walks the model there over several innocuous turns. Arceris scores the trajectory of the conversation, not one message.
Mapped to Recognized Frameworks: findings carry OWASP Top 10 for LLM Applications (2026) and MITRE ATLAS technique identifiers, so your SOC can correlate them with everything else.

Session correlation · risk trajectory

8

Correlated signals

3

Exfil channels

ATLAS

+ OWASP 2026

Existing investments · connected

ICAP

Your DLP server

4

Identity protocols

SIEM

Structured export

08 / 09

Built on What You Already Own

Your DLP does not see the chat box—but it still holds the policy you spent years writing. Arceris captures the text your DLP cannot reach and hands it to that same policy.

ICAP DLP Integration: prompt text and uploaded files are submitted to your existing DLP server (such as Symantec), carrying the authenticated user so its own per-user policies actually fire. No second rulebook to maintain.
Enterprise Identity: LDAP and Active Directory, Kerberos SPNEGO with zero-touch device enrolment, OIDC/Keycloak, and agent-based SSO through Fortinet FSSO or Palo Alto User-ID.
Group-Based Policy: directory groups become policy targets directly. A user's LDAP groups decide which PII, DLP, moderation and model rules apply to them.
SIEM Export: structured JSON with severity mapping, so AI policy events land beside the rest of your security telemetry.

09 / 09

Governance, Cost and Evidence

Security is one question. The other two are what this costs and what you show an auditor.

Model Access Control: which user, role, group or network may reach which model—per model and per scope, with an implicit deny for anything unmatched.
Token and Cost Limits: daily and monthly budgets per user, enforced at the gateway rather than discovered on the invoice.
Policy Engine and Approvals: fine-grained, versioned policy with a maker-checker approval workflow, so a policy change is reviewed before it takes effect.
Periodic Reports: security and risk reports in Turkish or English, SHA-256 signed so their content is verifiably unaltered, delivered by email on a schedule you set.

Periodic report · integrity

TR/EN

Report languages

SHA-256

Tamper-evident

4

Policy target types

One platform. Total AI visibility and control.