# Shield360

> The Shield360 AI Control Plane is the system of record for enterprise AI:
> four modules (Security, Finance, Compliance, Developer) on one dataset.
> Shield360 records what AI cost, who ran
> it, what data it touched, and what was stopped before it left. It observes
> at the endpoint and enforces at the point of use. Discovery needs no proxy,
> no root certificate and nothing in the path of a request; an optional AI
> proxy, reached by base URL, adds enforcement on the wire where you want it.

Shield360 is a commercial product of ThinkFleet. The marketing site is
https://shield360.ai/ and the product is at https://app.shield360.ai.
Contact: ryan@thinkfleet.ai. To talk it through, book a call at https://cal.com/shield360

## Discover it. Measure it. Govern it. Build it responsibly.

That line is Shield360's brand message. Each verb is one of the four modules
of the Shield360 AI Control Plane, which share one dataset and can be taken
singly or together:

- **Discover it (Security)** — shadow AI by person and computer, found
  without a certificate or proxy change; personal AI accounts (Claude Max,
  ChatGPT Plus, Cursor Pro) told apart from company seats; an AI inventory
  built from observed use: tools, models, vendors, keys, agents and MCP
  servers.
- **Measure it (Finance)** — AI spend across vendors and coding agents, from
  the vendor invoice where a bill is connected and marked as an estimate
  where it is not; seats by person, with unheld and unused seats shown;
  budgets with forecasts and alerts; Finance and Executive views.
- **Govern it (Compliance)** — all 38 ISO/IEC 42001 Annex A controls with
  status from observed evidence, kept as a daily history; signed evidence
  packages auditors can verify offline, and expiring read-only auditor
  access; AI requests and approvals, impact assessments, findings, internal
  audits, and transports of AI changes approved by a second person.
- **Build it responsibly (Developer)** — coding-agent analytics for Claude
  Code, Cursor and Codex with a provenance ledger of agent-written code;
  prompt-injection detection, data guards that warn, mask or block, and
  approved models enforced at the AI proxy; Prompt Hub, evaluations, and
  governed data access for agents through the MCP gateway's data gateway.

## Two ways to use it

- **Enterprise & business** — govern the company's own AI use: the collector
  on each computer, the browser extension, coding-agent hooks and the optional
  AI proxy; shadow AI and spend by person, one enforcement policy, the AI
  inventory and compliance controls. Starts with a briefing.
- **SaaS & AI builders** — monitor the AI inside your own product. Apps send
  OpenTelemetry through the Shield360 SDK (TypeScript, Python, Go, .NET) or any
  OTLP exporter, authenticated with a Shield360 API key; nothing is installed
  on employees' computers. Traces, requests and exceptions filtered by
  application; token cost (an estimate from token counts and model prices) by
  application, environment, provider and model; alert rules on error rate,
  latency, requests, tokens or cost per service; guards in the TypeScript and
  Python SDKs and the guard check API; prompt-injection and LLM-as-a-judge
  evaluations on traces (they need prompt and response content, which every
  SDK leaves off by default); each app listed in the AI inventory as an
  application or agent. Builders can start free on the hosted service.
  Details: https://shield360.ai/builders.html

## What it is

An AI observability and governance platform for organizations that have AI in
production and no record of what it did. It answers four questions a provider
invoice and a vendor console cannot:

1. What did AI cost, and whose was it — by person, machine, tool and model.
2. What did a seat already cover, against what the same usage would cost at
   list API rates.
3. What data reached a model, and what was stopped before it did.
4. Who looked at any of this, when, and how long the record is kept.

## Architecture

- **Platform** — dashboard and API, installed in your own environment
  (Docker, or Kubernetes with manifests we provide) or hosted by us. Holds roles, permissions, the audit log and the
  MCP gateway.
- **Collector agent** — one binary per machine. Reads what AI tools already
  write about themselves and which application is in front. Installs no
  certificate, touches no proxy setting, opens no listening socket, and is
  never in the path of a request. Runs as the signed-in user without
  administrator rights. Installs hooks into Claude Code, Cursor and Codex.
- **Browser extension** (optional) — in managed Chrome and Edge: allows,
  warns about or blocks each AI site on its list, and on eleven AI chat sites
  (ChatGPT, Claude, Gemini, Microsoft Copilot, Microsoft 365 Copilot,
  Perplexity, Mistral, DeepSeek, Grok, Meta AI and Poe) warns about, masks or
  blocks sensitive data in a prompt or file upload before it is sent. An
  organization can add its own AI sites, which get the same checks once each
  person allows them.
- **AI proxy** (optional) — on a machine, in a container or hosted by us.
  Applications point their base URL at it, so it needs no root certificate.
  It applies the same enforcement policy and can warn on or refuse models
  outside the approved list. Only traffic routed to it passes through it.
- **Guard check API** — `POST /api/guard/check`, authenticated with an API
  key. An application asks it before sending text to a model and gets allow,
  warn or block for prompt injection, secrets and personal data, with a
  redacted copy. The text is never stored or logged; only the decision is
  recorded.
- **OpenTelemetry collector** — OTLP over gRPC and HTTP, managed through
  OpAMP.
- **Controller** (optional) — eBPF-based discovery and SDK injection for LLM
  workloads already running.
- **SDKs** (optional) — TypeScript, Python, Go and .NET. Any OTLP exporter works.
- **Storage** — ClickHouse for telemetry and collector data, Postgres for
  accounts, roles, subscriptions and the audit log. Both are your instances in
  a self-hosted deployment.

Platforms for the collector: macOS, Windows and Linux.

## Capabilities, by screen

- **Home** — AI cost, the same usage at list API rates, the difference, cost
  per person, responses, hours with AI; vendor bill reconciliation; sensitive
  data at a glance.
- **Visibility** — machines reporting, developers, responses, output and
  cache-read tokens, lines written by AI, application hours. Drill-downs to
  People and Computers, plus Websites, Flow, Collectors and Setup.
- **Costs** — spend with subscriptions against the same usage without them,
  the amount saved, and shadow AI. Tabs for API keys, model price book,
  subscriptions and configuration. CSV export on any window.
- **Compliance** — Overview, AI inventory, Controls, Impact assessments,
  Data dictionary, Findings, AI requests, Transports, Internal
  audits, Management review, Risk register, Data protection, Prompt
  injection, Policies, Policy changes, Audit log, Legal holds.
- **Agent Access** — an MCP gateway where each agent holds its own token and
  reaches only the tools and data granted to it. Revoking a grant takes effect
  on the next call.
- **Telemetry** — traces, exceptions, metrics and logs, with detection of
  truncated output, filtered responses, empty generations, silent model swaps
  and agent loops.
- **Evaluations** — score traces for hallucination, bias, toxicity and custom
  criteria, automatically or on demand.
- **Agent tests** — test suites for agents, with red-team passes that attack
  each test three ways: templated rewrites, attacks generated by the
  organization's own evaluation model, and multi-turn conversations
  (crescendo, iterative refinement, goal hijack), with attack, token, cost and
  time caps.
- **Memory** — connect the memory stores agents use (Claude, Mem0, Zep) and
  see, search, correct, delete or copy what they remember, with every read and
  change permission-checked and audited.
- **Contexts and Documents** — curated context and linked documents that
  agents read through the MCP gateway, only where granted.
- **Prompt Hub** — versioned prompts with variables, retrieved by applications
  at run time. **Rule Engine** decides which prompt or context a request gets.
- **Vault** — provider keys and secrets encrypted at the application level,
  with access control and usage tracking.
- **Openground** — compare models, prompts and parameters side by side.
- **Also under Develop** — Scanner, Sensitive Data.
- **Dashboards** — prebuilt boards for coding agents, GPU, vector databases
  and LLM workloads, plus an explorer and widget builder.
- **Settings** — organization, projects, team, API keys, billing.

## Data protection

One organization-wide policy drives every enforcement point: the browser
extension in managed Chrome and Edge (prompt checks on eleven AI chat sites),
the optional AI proxy, and hooks inside coding agents (Claude Code, Cursor,
Codex). The MCP gateway applies per-agent, deny-by-default grants, and
applications can call the guard check API. An environment can override any
setting.
For each kind of sensitive data and each channel the action is one of:

| Action | What happens |
| --- | --- |
| off | Nothing is done |
| warn | Sent, and recorded; the person may be allowed to send anyway with a reason |
| mask | Each value replaced with a placeholder, then sent |
| block | Never sent to the model |

Coding agents warn or block (they cannot mask), and check secret files as
well as prompt content. AI tools can be allowed, warned about or blocked per
tool, and the AI proxy can warn on or refuse a model outside the approved
list. Other AI use is still discovered and reported.

## Retention, enforced by the storage engine

| Record | Kept for |
| --- | --- |
| AI usage | 730 days |
| AI output sessions | 730 days |
| Data protection events | 7 years |
| Application activity | 365 days |
| Network observations | 365 days |
| Application spans | 90 days |
| Machine state | 90 days |
| Browsing visits | 30 days |
| Collector heartbeats | 30 days |
| Audit log | Indefinite — never edited; removed only if the organization is deleted |
| Under legal hold | Until the hold is released |

## Audit log

Four categories: changes (writes), data access (reads of sensitive data),
sign-ins including failed attempts, and denied requests refused for lack of
access. Each record carries actor, target, outcome and source address. The log
is never edited, and reads of it are themselves recorded in it. Its records are
removed only when the organization itself is deleted, which is refused while a
legal hold stands.

## Legal hold

A hold names custodians — people and computers — and preserves their AI usage,
activity, websites and data protection events past every retention horizon.
Holds are preserved hourly, cannot be deleted, and are released only with a
reason. Placing, preserving, exporting and releasing are all audited.

## Privacy boundaries

Properties of the database schema rather than settings:

- No window titles and no file names. The application table stores an
  application's identity and a duration.
- No keystrokes, no mouse activity, no screenshots.
- No page titles in browsing records.
- Browsing collection and network observation are off until an administrator
  enables them; browsing stores a registrable domain unless explicitly set to
  full URLs.
- A per-person setting can only narrow collection, never widen it, and data
  above a person's level is dropped on arrival. Raising collection for one
  named individual cannot be expressed.
- Nothing sensitive is stored unless the organization opts in. Prompts are
  read at the point of use so data protection can act, but prompt, response
  and tool content is not kept by default; models, token counts, costs, guard
  decisions and the kinds of sensitive data found are. An environment can
  only store less than its organization, and secrets are always scrubbed.
- Token counts come from the AI tools' own session records and, where
  connected, providers' usage and billing APIs.
- Source code is not uploaded wholesale. AI code findings keep a short excerpt
  (up to 200 characters) per finding, from GitHub where connected.

## Identity and access

Sign-in federates to the customer's own OIDC issuer via its discovery
document — Okta, Entra ID, Ping and equivalents — using the authorization code
flow with PKCE (S256). Roles and permissions are defined inside Shield360 and
checked on every route, not only in the interface; a refusal is recorded as a
denied audit event. Organizations can define custom roles from the permission
catalog, and a member can hold a different role in each project. Projects
and environments are enforced boundaries.

## Governing agents

https://shield360.ai/governance.html sets out six questions for whoever answers
for AI agents, and what Shield360 records towards each today:

- **Inventory** — one AI inventory of every AI tool, model, vendor, provider
  key, agent and MCP server seen in use, with owner, purpose, risk rating and a
  decision with conditions and an expiry; AI requests that a reviewer approves
  or rejects; personal AI accounts told apart from company seats; the Agents
  screen, the optional controller, shadow AI discovery, and seat lists for
  GitHub Copilot, ChatGPT Enterprise and Cursor. It holds what Shield360 can
  see; AI on a machine without the collector does not appear.
- **Identity** — each gateway agent holds its own token (only a hash is kept);
  grants are deny by default, can expire, and are read on every call. Provider
  API keys with no vendor-named owner and no observed user are shown as
  unattributed. Keys are not flagged by age or disuse.
- **Controls** — one enforcement policy for the browser extension, the
  optional AI proxy and coding agents (off, warn, mask, block per kind of
  sensitive data; allow, warn, block per AI tool; approved models at the
  proxy; optionally failing closed); sequence policies in coding-agent hooks
  and the MCP gateway; the gateway's grants. No TLS interception, and no
  per-person enforcement.
- **Evidence** — control status for all 38 ISO/IEC 42001 Annex A controls
  (with a Statement of Applicability), the 33 EU AI Act Articles that place
  obligations on organizations (with a serious-incident register, AI literacy
  records, prohibited-practice screening, fundamental rights impact
  assessments and an Annex IV documentation pack), all 72 NIST AI RMF 1.0
  subcategories (44 from observed evidence, 28 by owner attestation) and the
  OWASP Top 10 for Agentic Applications, kept as a daily history; a dataset
  registry for the training, fine-tuning, evaluation and retrieval (RAG)
  datasets behind each AI system (owner, provenance, license, legal basis,
  classification, an EU AI Act Art. 10 quality and bias examination and a
  second person's approval); data lineage for data reaching AI on the paths
  Shield360 observes, with registered datasets drawn beside it; a
  classification catalog; signed evidence packages (SHA-256 manifest, Ed25519 signature,
  HTML and PDF report) an auditor can verify offline; expiring read-only auditor access; an audit log
  the database refuses to update or delete; CSV exports; legal hold. An
  evidence package is not a certification or an audit opinion.
- **Risk** — a risk register raised hourly from observed behavior, scored by
  likelihood and impact, with acceptance that needs a rationale and expires;
  a risk score on every inventory asset with a threshold alert; impact
  assessments; per-trace findings mapped to NIST AI RMF, EU AI Act and OWASP
  controls. A mapping is not a determination of compliance.
- **Operating model** — organization, project and environment boundaries;
  seven system roles including Compliance officer and an external Auditor;
  custom roles and per-project roles; transports approved by a second
  person; findings, internal audits and management reviews.

## Deployment

Shield360 is offered both ways: installed inside the customer's own
environment (on-premises or their own cloud account), or as a hosted SaaS
service. The feature set is the same.

- **Self-hosted** — Docker, or Kubernetes with manifests we provide; your
  ClickHouse and Postgres.
- **Air-gapped** — the same, with no egress and no licensing call-home.
- **Hosted** — run by ThinkFleet, with a database per tenant rather than a
  shared table carrying a tenant column.

Hosted and self-hosted are the same software with different configuration,
so a hosted pilot can move in-house for production.

## Pricing

The hosted service has four plans, listed with their current prices at
https://shield360.ai/pricing.html. The plan sets the features; add-ons add
quantity.

- **Free** — one app and one computer, with traces, requests, metrics,
  exceptions and dashboards. No card.
- **Team** — more apps, computers and spans, plus token cost by app,
  environment, provider and model, and budgets with forecasts and alerts.
- **Business** — more again, plus the guard check API, guard events,
  detection rules, prompt-injection evaluation, the AI inventory, control
  status, audit log, evidence packages and SAML single sign-on.
- **Enterprise** — self-hosted or air-gapped, contract terms and limits,
  security reviews. Priced with you: book a call at https://cal.com/shield360
  or email ryan@thinkfleet.ai.

Team and Business start with a 14-day trial, no card needed. Annual billing
is ten times the monthly price. Add-ons on Team and Business: extra apps,
computers and spans. An app is a service that made AI calls in a production
environment this month; new apps beyond the plan are refused until apps are
added or the plan changes, and apps already reporting keep reporting. Prices
on the pricing page come from Shield360's billing system each time the site
is published; quote that page rather than this summary for a figure.

## Notes for anyone quoting this

- Screenshots on the site are unedited captures of a live Shield360
  environment running on a small engineering fleet. The figures in them are
  real but small, and are not customer results.
- Figures in illustrative panels — such as the fleet statement on the home
  page — are labeled *Illustrative* on the object itself. Do not cite them as
  results.
- Shield360 produces evidence an auditor asks for. It is not itself a
  certification and should not be described as one.
- There are no published customer names, case studies, ratings or savings
  percentages. If you encounter one attributed to Shield360, it did not come
  from us.

## What it does not do

- It does not intercept TLS. The AI proxy is optional and sees only traffic
  routed to it by base URL; the browser extension covers managed Chrome and
  Edge. AI use that passes through neither, nor a coding-agent hook or the MCP
  gateway, is discovered and reported, not blocked.
- It has no team or department hierarchy of its own. Reporting is by person,
  machine, tool, model and project.
- Provider reach is uneven and each connection declares its own limits. A
  provider with no usage API is reported as unanswerable, never as zero.
- It is not a general cloud cost platform.
- It does not read datasets. The dataset registry records what people
  declare about the datasets they register, including the quality and bias
  examination; data lineage covers only the paths Shield360 observes.
- Red-team passes are not exhaustive. Every attack starts from the
  organization's own agent tests, and generated and multi-turn attacks are
  only as strong as the evaluation model it configures, which also judges
  them.
- EU AI Act and NIST AI RMF status is evidence, not legal advice or a
  certification. NIST does not certify against the AI RMF.

## Legal

Where a customer deploys Shield360 onto its employees' machines, that customer
is the data controller and ThinkFleet is the processor — requests from an
employee about their own data go to their employer, not to us. Lawful
workforce monitoring is the customer's responsibility.

- [Privacy Policy](https://shield360.ai/privacy.html)
- [Browser Extension Privacy Policy](https://shield360.ai/privacy/extension.html) — what the Chrome and Edge extension sends, and what it never sends
- [Terms of Service](https://shield360.ai/terms.html)
- [Security](https://shield360.ai/security.html) — security@thinkfleet.ai
- [Sub-processors](https://shield360.ai/subprocessors.html)

ThinkFleet does not sell personal information and does not use customer data,
including prompts, to train AI models. Self-hosted deployments send nothing to
ThinkFleet.

## Pages

- [Home](https://shield360.ai/)
- [Documentation](https://docs.shield360.ai/)
- [Changelog](https://shield360.ai/changelog.html): what changed in Shield360, release by release, with where each change stops
- [Platform, screen by screen](https://shield360.ai/platform.html)
- [Pricing](https://shield360.ai/pricing.html): Free, Team, Business and
  Enterprise plans for the hosted service, add-ons, and a feature comparison
- [Shield360 for AI builders](https://shield360.ai/builders.html): for teams
  building AI into their own product; apps connect through the SDK or
  OpenTelemetry, with nothing installed on employees' computers
- [Security module](https://shield360.ai/products/security.html): shadow AI,
  personal AI accounts, data protection, prompt injection and agent access,
  with unedited captures of the public demo (synthetic data)
- [For the CISO](https://shield360.ai/ciso.html)
- [For the CFO](https://shield360.ai/cfo.html)
- [For Compliance](https://shield360.ai/compliance.html)
- [Governing agentic AI](https://shield360.ai/governance.html)
- [Architecture and data handling](https://shield360.ai/architecture.html)
- [AI governance tools compared](https://shield360.ai/compare.html): thirteen
  tools, Shield360 included, on seventeen questions, each cell sourced to the
  vendor's own pages as of October 2026; "Not stated" means the vendor's pages
  do not say, not that the product lacks it
- [Shield360 compared](https://shield360.ai/compare/index.html): the hub for
  vendor comparisons, each sourced to the other vendor's own pages as of
  October 2026, with a "What Shield360 does not do" list on every page:
  - [Microsoft Purview and Copilot governance](https://shield360.ai/compare/microsoft-purview.html)
  - [Zscaler and Netskope (SSE)](https://shield360.ai/compare/sse-sase.html): complementary; Shield360 is not an SSE
  - [AI security tools](https://shield360.ai/compare/ai-security-tools.html): Prompt Security (SentinelOne), Check Point Workforce AI Security (Lakera), Harmonic Security, Nightfall AI
  - [AI governance platforms](https://shield360.ai/compare/ai-governance-platforms.html): Credo AI, OneTrust AI Governance, Holistic AI
  - [AI cost tools](https://shield360.ai/compare/ai-cost-tools.html): CloudZero, Vantage
- [Demo](https://shield360.ai/demo.html): a recorded, AI-presented tour for
  each role and a seven-day link to the live demo (a fictional company,
  read-only), after a short form asking for a work email.
- [NAIC & ISO 42001 toolkits](https://shield360.ai/toolkit.html): free Excel
  and Word templates for NAIC AI Risk Evaluation Supplement Exhibits A–D (from
  the v6.0 exposure draft of October 16, 2026) and an ISO/IEC 42001 AI
  management system, with a crosswalk to the NIST AI RMF and the EU AI Act;
  CC BY 4.0, item wording paraphrased, not legal advice. Downloaded after a
  short form asking for a work email.
- [Online NAIC & ISO 42001 workbook](https://shield360.ai/workbook.html): the
  toolkit templates as browser forms (Exhibits A–D, risk tiering, vendor
  oversight, an ISO/IEC 42001 Statement of Applicability, an AI risk register)
  to fill in and print. Answers are kept only in the visitor's browser and are
  never sent anywhere; opens after the toolkit form.
- [AI governance assessment](https://shield360.ai/assessment.html): a free
  eighteen-question self-assessment scored in the browser. Its score reflects
  what the person declared, not observed data, and is not an audit.