# Orthalon

> Orthalon is the control plane for enterprise AI adoption. It discovers workforce AI use, applies identity-aware data policy, and produces reviewable governance evidence across browsers, endpoints, model APIs, identity systems, network controls, and MCP.

Last updated: 2026-09-12

## Product scope

Orthalon is built for security, IT, privacy, compliance, and engineering teams. It covers six AI asset classes:

1. AI applications
2. Models
3. Agents
4. MCP servers
5. MCP tools
6. AI browser extensions

Orthalon keeps observed use separate from its global risk catalog. A catalog entry means that Orthalon has vendor and risk intelligence for an asset; it does not mean that the asset was used by a customer. Observed assets include their discovery source and last-seen time so administrators can understand what each signal proves.

## Core capabilities

- Build an organization-scoped inventory from browser, endpoint, gateway, identity, SaaS, CASB, network, and MCP signals.
- Search global AI application risk facts, including data-use, retention, subprocessors, hosting, model-provider, and assurance information where sources are available.
- Sanction, unsanction, or review an observed AI application.
- Detect credentials, personal and health data, validated country identifiers, financial identifiers, source code, internal IPv4 ranges, and organization-defined patterns.
- Apply ordered policy outcomes: `ALLOW`, `REDACT`, `COACH`, `REQUIRE_APPROVAL`, or `BLOCK`.
- Target policy by application, person, group, detector, and supported AI account context.
- Review violations, approvals, sanctions, policy changes, and administrative actions.
- Map evidence to the EU AI Act, ISO/IEC 42001, and NIST AI RMF. These mappings support governance work; they are not a claim that using Orthalon makes an organization certified or compliant.
- Export event and audit evidence on eligible plans.

## Guided AI discovery assessment

New organizations can begin with a guided assessment before enabling enforcement. The assessment helps an administrator:

1. choose the environments the organization uses;
2. connect available discovery sources;
3. distinguish observed assets from catalog-only entries;
4. review risk facts, discovery source, and last-seen time;
5. sanction or flag applications for review; and
6. move a small pilot from monitor mode to active policy.

An empty inventory in a new organization is expected until a browser sensor, endpoint agent, gateway, MCP agent, connector, or import reports an observation.

## Browser prompt and file protection

The managed browser extension protects supported AI websites in Chrome and Microsoft Edge. A Firefox pilot is available; Safari distribution requires conversion and signing.

- Checks prompts and small readable files on the device before submission. Business and Enterprise can hold supported PDF, Office, spreadsheet, ZIP, and larger readable files for private short-lived analysis.
- Checks typed text, paste, Enter, and supported send-button actions without reading unrelated page fields or prior chat history.
- Supports ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, Poe, and additional catalogued domains.
- Supports monitor, coach, redact, request-approval, and block outcomes.
- Can distinguish supported personal accounts, managed workspaces, and sessions where account context is unknown.
- Shows the reason for an intervention and can suggest a sanctioned alternative.
- Retrieves versioned organization policy and queues metadata-only events during temporary connectivity loss.
- Uses an organization-scoped, revocable sensor credential configured through managed extension policy.

Browser DOM changes can affect an adapter. Orthalon records adapter health and coverage rather than claiming that every page or upload path is always inspectable.

## Desktop and IDE protection

Orthalon Desktop Protection v1 is a managed beta for macOS, Windows, and Linux. It runs a local loopback proxy for compatible applications and IDEs that accept a configurable model API base URL.

- Applies the organization policy before a compatible request leaves the endpoint.
- Supports OpenAI-compatible and Anthropic-compatible client traffic.
- Keeps the local redaction map in endpoint memory.
- Reports metadata-only discovery and policy decisions to the organization.
- Supports monitor-only operation on Monitor and active enforcement on Protect or higher.
- Supports in-memory response inspection on Business and Enterprise.
- Includes a checksum-verified per-user installer, bundled runtime, automatic startup, private enrollment and state directories, a health command, and upgrade/uninstall paths for macOS LaunchAgents, Windows Scheduled Tasks, and Linux systemd user services.

Orthalon is testing a separate macOS native control for accepted ChatGPT and Claude Desktop builds. It is not part of the v1 customer package. The source contract can stop Command-V before insertion and check the complete accessible editor before an accepted Enter or Send action. The submission check covers keyboard input and text inserted by context-menu paste or drag and drop. It does not cover draft synchronization, inaccessible or changed application controls, dictation, images, or voice.

The native file-analysis contract scans small readable files locally and can use the private, short-lived R2 analysis path for supported PDF, Office, spreadsheet, and ZIP files. Blocking file access in arbitrary native apps still requires an accepted operating-system file-open adapter. Orthalon does not present the analysis contract as universal desktop file blocking.

Orthalon v1 does not ship transparent traffic steering, TLS inspection, a production regional SWG, Windows or Linux native steering adapters, or a mobile traffic agent.

Orthalon does not install a root certificate or silently break certificate pinning. Proprietary clients with fixed backends or pinned TLS are discovery-only unless the vendor exposes a compatible routing option.

Orthalon does not currently ship an iOS or Android VPN/traffic agent. Mobile identity, SaaS, CASB, and network evidence is discovery data, not prompt inspection. The hosted AI gateway protects explicitly routed model API calls; it is not a general mobile secure web gateway.

## AI gateway for model API calls

The optional AI gateway protects sanctioned applications and server workloads that can route model requests through an administrator-controlled base URL.

- Supports OpenAI, Anthropic, Gemini, and OpenAI-compatible request paths.
- Authenticates the organization and applies provider allowlists, request limits, timeouts, and organization policy.
- Inspects requests before forwarding them to a model provider.
- Inspects supported response streams in memory on Business and Enterprise before releasing them to the client.
- Stores usage and decision metadata by default. Enterprise administrators may explicitly enable encrypted post-redaction evidence; original detected values are not retained.

The gateway does not automatically cover arbitrary third-party apps or vendor clients that cannot change their model API endpoint.

## MCP discovery and stdio policy

Enterprise organizations can inventory locally configured MCP servers and tools from supported clients such as Cursor, Windsurf, Visual Studio Code, and Claude Desktop.

- Collects non-secret server, command, URL, transport, and tool metadata.
- Never reports configuration credentials, tokens, or local file contents. Enterprise administrators may explicitly retain redacted stdio tool-call text after detected values have been replaced with typed placeholders.
- Identifies unapproved tools, duplicate servers, and endpoint coverage gaps.
- Provides an allowlisted wrapper for stdio MCP servers that can allow, deny, redact, or require approval for tool calls.
- Inventories remote HTTP and SSE MCP connections without claiming tool-call enforcement for those transports.

The endpoint MCP agent and the stdio wrapper run on the managed user device. The web control plane stores inventory and policy metadata.

## Identity, SaaS, CASB, and network discovery

Enterprise discovery connectors correlate authorized-application and network signals without treating those signals as inspected prompt content.

Identity and SaaS sources include:

- Google Workspace
- Microsoft Entra ID
- Okta
- Slack
- GitHub

Security telemetry sources include:

- Cloudflare Gateway
- Zscaler
- Netskope
- Microsoft Defender for Cloud Apps
- Palo Alto Prisma Access
- iboss
- Chrome Enterprise

Network, DNS, proxy, and CASB records show that an endpoint or user connected to a service. They do not reveal prompt contents or prove that inline protection ran.

## Identity and access administration

- Organization membership and role-based access control
- SSO through supported OIDC and SAML identity providers on Business and Enterprise
- SCIM provisioning, teams, and advanced roles on Enterprise
- Organization-scoped sensor credentials with explicit browser, desktop, gateway, or MCP scope
- Server-side tenant and plan authorization for every protected administrative operation

Leaked sensor credentials should be revoked and replaced. A sensor credential identifies an organization and one sensor type; it does not grant access to the web console or let a client select a different tenant.

## Detection and policy model

Orthalon uses a shared detection and policy model across supported enforcement points. Detectors include structured patterns and checksums, provider-secret patterns, high-entropy token checks, source-code heuristics, and organization-defined custom patterns.

Examples include cloud and API keys, private keys, JWTs, passwords, US Social Security numbers, UK National Insurance and NHS numbers, Brazilian CPF, Polish PESEL, payment-card numbers, IBANs, email addresses, phone numbers, health data, financial or legal content, source code, internal IPv4 ranges, and company-specific identifiers. CPF, PESEL, and NHS numbers must pass their defined checksum; compact country-number formats require an explicit label where needed to avoid treating ordinary order numbers as identity data.

Policy evaluation is deterministic and ordered. Monitor mode reports the decision without modifying the request. Active mode enforces the decision. Redaction uses typed placeholders and keeps the replacement map on the endpoint or within the in-memory gateway request.

## Privacy and stored data

- Browser prompt, small readable-file, and compatible desktop inspection runs locally on the endpoint. Supported document formats that require extraction use a private short-lived analysis object that is deleted after a terminal job state.
- Gateway content is processed in memory for the duration of a routed request.
- Orthalon does not store raw prompts or readable file contents by default.
- Security records contain detector type, match count, salted hash, application and user metadata, policy decision, timestamp, and optional placeholder-only excerpts.
- Enterprise organizations can optionally retain encrypted post-redaction prompt or response text from selected browser, desktop, gateway, and wrapped MCP stdio paths. The setting is off by default, retains only content released by a Redact decision, supports 7–90 day retention, restricts access to security administrators, and audits each reveal.
- Connector secrets are encrypted at rest and are not returned by list or status APIs.
- Organization credentials are scoped, revocable, and mapped to their tenant on the server.

## Governance intelligence and evidence

Orthalon separates three types of information:

1. **Observed use:** organization-specific signals with source and last-seen metadata.
2. **Catalog intelligence:** sourced vendor and product facts that do not imply customer use.
3. **Governance evidence:** versioned records of policy decisions, approvals, sanctions, incidents, and administrative actions.

Risk facts should be read with their source, version, and evidence state. Missing certifications or vendor disclosures are shown as missing evidence, not silently treated as proof of safety.

## Plans and feature boundaries

- **Monitor — free, up to 25 users:** guided discovery assessment, risk catalog, browser/desktop/model API monitoring, read-only metadata events, and 30-day retention.
- **Protect — $19 per user/month or $180 per user/year:** everything in Monitor plus prompt and readable-file enforcement, identity-aware policy templates and testing, bounded approvals, managed Chrome/Edge and Firefox pilot rollout, and 90-day retention. Includes a 14-day trial.
- **Business — $35 per user/month or $348 per user/year:** everything in Protect plus SSO/SAML, custom detectors, governance evidence and exports, response inspection for gateway and compatible desktop traffic, versioned evidence, and 13-month rollups. Includes a 14-day trial.
- **Enterprise — custom pricing:** everything in Business plus SCIM, teams, advanced RBAC, MCP inventory and stdio policy, identity/SaaS/security telemetry connectors, optional encrypted redacted prompt evidence, residency options, SLA, and a named contact.

Subscriptions belong to an organization and paid plans are billed per active seat. The server enforces plan boundaries; hiding a control in the interface is not the security boundary. See [machine-readable pricing](/pricing.md) for the detailed matrix.

## Deployment model

The Orthalon-managed deployment includes:

- localized web console and authenticated administrative API;
- PostgreSQL-compatible database for tenant, policy, catalog, and metadata records;
- telemetry ingestion service;
- optional AI gateway;
- background jobs for rollups, risk scoring, policy compilation, retention, connector syncs, catalog refresh, and notifications; and
- endpoint components distributed through browser management, MDM, macOS launch agents, Windows services, or Linux systemd.

Browser extensions, desktop agents, and MCP agents run on managed endpoints. A data-residency commitment must cover every database, service, job, log destination, and backup that processes tenant data.

## Public resources

- [Homepage](/en)
- [Documentation](/en/docs)
- [Plans and feature access](/en/docs/plans)
- [Protected environments](/en/docs/environments)
- [Connector configuration](/en/docs/configure/connectors)
- [Policies and detection](/en/docs/configure/policies-and-detection)
- [SSO and SCIM](/en/docs/configure/sso-and-scim)
- [AI security insights and engineering blog](/en/blog)
- [Changelog](/en/changelog)
- [Contact Orthalon](/en/contact)
- [Machine-readable pricing (Markdown)](/pricing.md)
- [Machine-readable pricing (Text)](/pricing.txt)
- [Site directory for LLMs](/llms.txt)

## Technical research articles and blog posts

Orthalon publishes research articles on AI threat vectors, prompt injection tactics, and data-loss prevention. Every blog post provides an interactive web version and a pure machine-readable raw Markdown endpoint for AI agents.

- **Blog Index**: [/en/blog](/en/blog)
- **2026 Prompt Injection Techniques, AI Jailbreaks, and How Orthalon Stops Them**:
  - Web article: [/en/blog/prompt-injection-techniques-2026](/en/blog/prompt-injection-techniques-2026)
  - Raw markdown for AI agents: [/en/blog/prompt-injection-techniques-2026/raw](/en/blog/prompt-injection-techniques-2026/raw)
  - Technical analysis of 2026 prompt injection vectors (multilingual evasion across 9 languages, Cyrillic homoglyphs, ChatML delimiter hijacking, multi-turn crescendo attacks, and indirect MCP tool injection) with endpoint pre-flight defenses operating under a 5ms latency budget.
- **Orthalon Desktop: Universal Endpoint AI Protection, Local DLP, and MCP Governance**:
  - Web article: [/en/blog/orthalon-desktop-universal-ai-protection](/en/blog/orthalon-desktop-universal-ai-protection)
  - Raw markdown for AI agents: [/en/blog/orthalon-desktop-universal-ai-protection/raw](/en/blog/orthalon-desktop-universal-ai-protection/raw)
  - Details the Orthalon native Rust desktop app across macOS, Windows, and Linux, sub-30 MB RAM footprint, sub-millisecond in-memory DLP redaction, real-time MCP config monitoring (Cursor, Claude Desktop, Windsurf, VS Code), stdio tool-call supervision, and local loopback AI gateway proxy on 127.0.0.1:4110.


## Coverage limits

Orthalon does not claim to inspect every AI flow. Coverage depends on the integration and customer deployment. Mobile apps, proprietary fixed-backend clients, certificate-pinned traffic, unsupported browser DOM flows, and remote HTTP/SSE MCP tool-call enforcement may be discovery-only or outside inline enforcement. Vendor APIs and browser stores may also impose their own availability, permissions, and review requirements.