Orthalon documentation
Set up Orthalon, protect workforce AI use, and operate browser, desktop, API, and MCP coverage from one organization.
Orthalon helps security and IT teams discover workforce AI use, apply policy, prevent sensitive data from leaving the organization, and produce evidence of the controls in place.
Start here
If this is your first Orthalon deployment, follow these guides in order:
- Create your account and organization.
- Choose the right plan for the controls you need.
- Run your first monitored rollout.
- Choose the environments to protect.
- Configure policies and detection.
What Orthalon protects
Orthalon combines several coverage layers because no single layer sees every AI interaction:
| Environment | What it covers | Starting plan |
|---|---|---|
| Browser extension | Prompts and readable file uploads on supported AI websites in Chrome, Edge, and packaged Firefox deployments | Monitor |
| Desktop protection | Compatible native apps and IDEs that accept a custom model API base URL | Monitor |
| AI gateway | Server applications calling OpenAI, Anthropic, or Gemini APIs | Monitor |
| Network and directory discovery | AI services visible in imported network data or enterprise providers | Enterprise |
| MCP discovery and runtime proxy | Known MCP client configurations plus explicitly wrapped stdio tool calls | Enterprise |
Monitor observes and reports. Protect and higher plans can redact, coach, require approval, or block. Business adds identity, response inspection, custom detectors, and compliance evidence. Enterprise adds large-scale provisioning and additional discovery surfaces.
Privacy model
For browser and compatible desktop traffic, detection and redaction happen at the enforcement point. Orthalon records detector types, counts, decisions, timestamps, and optional placeholder-only excerpts. It does not store raw prompt bodies by default.
The hosted AI gateway necessarily handles a request in memory while proxying it to the selected model provider, but it persists metadata rather than raw prompt content.
Know the coverage boundary
Orthalon does not silently claim complete coverage. The browser extension cannot protect unsupported browsers, mobile apps, or traffic outside its supported page adapters and standard file inputs. Desktop protection covers clients that can use the local Orthalon proxy. MCP discovery inventories configuration; the separate runtime proxy authorizes only stdio servers that an administrator explicitly wraps.
Use the Security overview coverage panel to verify which layers are reporting before moving policies from Monitor to Active.