Straight Answers About ProctoredAI

A small agent on each computer sees which AI tools people use, stops sensitive data before it reaches them, and keeps evidence for auditors. Your IT provider runs it for every client from one console.

ProctoredAI is sold through managed service providers. Your MSP deploys the agent, sets the policy with you, and answers alerts. Your own admins can sign in to see your company’s activity and reports.

230 catalogued AI apps (see the catalog), including chat assistants, coding tools, search, image, voice, and meeting assistants, agents, legal and clinical AI, AI browsers, model APIs, and AI built into everyday software such as Microsoft 365 Copilot and Notion AI. It also covers the ChatGPT and Claude desktop apps, command-line tools, MCP servers, and local AI runtimes such as Ollama.

With Discover Unlisted AI Apps turned on (the default), the agent notices hostnames that look like AI products and reports them, so new tools show up under Applications with an alert. Your IT provider then approves them, requires work accounts, or blocks them. Custom apps can also be added by domain.

Windows (x64 and ARM64), macOS (Apple silicon and Intel), and Linux (x64 and ARM64, including Raspberry Pi OS 64-bit). Chromebooks use a force-installed Chrome extension. There’s no agent for iPhone or Android, but the Microsoft 365 and Google Workspace connection shows AI apps connected to your company accounts from any device, phones included.

An extension sees one browser. The ProctoredAI agent covers every browser on the computer plus desktop AI apps, command-line tools, MCP servers, and file uploads, and it runs as a protected service that can’t be switched off from browser settings. We use an extension only where a native agent isn’t allowed, on Chromebooks.

Inspection happens on the computer itself, so it works the same in the office, at home, and on hotel Wi-Fi. Nothing is routed to a cloud gateway and there’s no hardware to install.

Yes. A client can run in Passive mode, which sees and reports everything (sensitive data, shadow AI, and every rule match) but blocks, redacts, and warns about nothing. Switching to Active turns on the rules as configured, with no reinstall.

No. Only traffic to AI services is opened and checked, plus webmail, file-sharing, and collaboration sites if your company turns those on. Banking and every other site are never decrypted, inspected, or logged.

With Discover Unlisted AI Apps on, other sites pass through the agent as a sealed tunnel so it can spot new AI tools by name. The connection stays encrypted end to end, and the only thing ever reported is a hostname that looks like an AI product, at most once a week. Turning the setting off sends other sites around the agent entirely.

Ordinary AI use is counted, not captured. Text is kept only when a data rule matches, and then only as your company’s capture setting allows. By default that’s a short excerpt with the sensitive values removed.

Each company chooses one of 3 settings:

• None keeps only what kind of data was found.
• Redacted (the default) keeps up to 500 characters, with each finding replaced by its type, such as [REDACTED:pii.ssn].
• Full keeps up to 4,000 characters for investigations. Changing the setting is recorded in the audit log.

No. A file that triggers a rule is recorded by name, size, type, and fingerprint (SHA-256), never its contents.

Yes. It reads which account an AI app is signed in to and compares it with your company’s work domains. If an app is set to Work Accounts Only, it will ask you to switch to your work account before sending a prompt. It never reads the AI’s answers to find addresses.

The ProctoredAI icon in the menu bar or notification area shows protection status, approved and blocked tools, the data rules, and your IT provider’s help contact. Block and warning screens explain what was found and why, and link to your company’s AI Use Policy.

It depends on the rule. Monitor lets it through and logs it. Warn asks you for a business reason before sending. Redact sends the message with the sensitive part removed. Block stops it and tells you why. Each rule carries a plain-language line explaining it.

Ask for an exception from the block screen or the ProctoredAI icon, with a reason and the time you need. Your IT provider approves or denies it. An approval is tied to your computer and ends on its own, and everything sent under it is still logged. Some rules, such as passwords and keys, controlled unclassified information, and prompt injection, are set to allow no exceptions.

Your company can choose which browsers are allowed. AI browsers such as ChatGPT Atlas and Perplexity Comet act inside your signed-in sessions, so many companies don’t allow them. A browser that isn’t allowed closes within a few seconds and a notification says so.

Your company chooses. The default is 365 days, after which events, closed alerts, and expired exceptions are deleted automatically.

AI services use HTTPS, so the agent has to open AI requests on the computer to check them. It creates its own certificate authority at install time, unique to that one device.

No. Only AI services are decrypted. Every other site keeps its own encryption (except webmail, file-sharing, and collaboration sites your company chooses to manage), and the certificate’s private key never leaves the computer, so nobody elsewhere can use it.

No. Each device generates and keeps its own key, and no two devices share one. The key never reaches the console, so a breach of the console doesn’t expose it.

No on-device inspection can open them, ours included. They’re marked in the catalog, can still be allowed or blocked as a whole app, and show as Seen, Not Inspected so nobody assumes a control that isn’t there.

Yes, along with the proxy setting, the program, and its data.

The agent is a single static program using about 20 MB of memory and close to zero CPU, plus a small tray helper. Websites other than AI services aren’t inspected.

A typical prompt is checked in milliseconds, on the computer, with no round trip to a cloud. Large uploads are scanned on spare processor cores so your own work keeps running.

Yes. Protection runs on the device, so it works on any network. Events wait on the device and upload once it’s back online.

AI apps send their own analytics every 1 to 2 minutes. Since 2.0.15 that traffic is passed through without inspection and isn’t counted as AI use, and repeats of the same event are grouped as Repeated N Times.

One installer per operating system covers every client. Run it silently from your RMM or MDM with your organization key and the client ID, for example ProctoredAI-Setup.exe install --org-key GOV-… --client-id ABCD-12345. Chromebooks get the extension from Google Admin Console. Devices report within a minute of installing.

Yes. The agent’s built-in health check command returns exit codes for script monitors in NinjaOne, Datto RMM, N-able, and ConnectWise RMM.

Not without you noticing. Setup checks the key and client ID with the console before it asks for admin rights, then shows the client and MSP by name to confirm. One MSP’s key can never enroll a device into another MSP’s client.

Reinstalling re-enrolls the device and retires its old record, so the device appears once.

It doesn’t hook the kernel or inject into browsers. It runs as a system service with a small helper in the user’s session, and it coexists with EDR, RMM, and backup agents. Allow-list the ProctoredAI program in your EDR as you would any new tool.

On a manual first run, yes, for now. Choose More Info, then Run Anyway. Silent installs from an RMM aren’t affected. macOS installers are signed with our Apple Developer ID and notarized by Apple.

Silently, on Windows, macOS, and Linux. Every release carries ProctoredAI’s signature, devices check it before installing, and they refuse any version older than the newest they’ve run.

From Settings, then Apps on Windows, or with the uninstall command on any platform. It needs admin rights, and when the client has an uninstall code it needs that code too.

Not as standard users. On Windows and macOS protection runs as a system service they can’t stop or reconfigure. A guardian service restores the proxy setting within 30 seconds, locks browser proxy settings, and restarts anything that’s been stopped.

A per-client code your MSP sets, required to remove ProctoredAI. On Windows the agent’s services and folders are locked so that even an administrator’s normal session can’t remove it without the code. On macOS and Linux an administrator can still remove it, and the console shows the device as Uninstalled.

By default AI traffic is blocked until the agent is healthy again, and a client can choose to let it through instead. Either way the console shows the device isn’t enforcing and raises an alert within minutes.

We’d rather you know:

• Someone with admin rights (outside the Windows uninstall lock) or physical access.
• Devices that don’t have the agent.
• Apps that ignore the system proxy entirely. Command-line AI tools are covered on macOS and Windows, not yet on Linux.

No. For the strongest setup, keep users standard and push the proxy and certificate settings through Intune, Jamf, or Group Policy so they’re locked.

42 built-in detectors with checksum validation, covering things like card numbers, Social Security numbers, bank and routing numbers, health identifiers, passwords, and API keys. It also recognizes 7 document types (contracts, financial statements, HR records, medical records, customer lists, credentials files, and source code), reads text in uploaded images, and matches your own keyword lists and customer records without storing the raw values.

Text and code files, Word, Excel, and PowerPoint documents, simple PDFs, and images. Files it can’t read, such as password-protected or scanned documents, are logged, or held if your company chooses.

Yes. It has 4 detectors for instruction overrides, attempts to extract system prompts, jailbreak personas, and hidden instructions, whether pasted or inside an uploaded file. They’re blocked by default.

Yes, for sensitive data in responses. Those findings are logged rather than blocked, because the answer has already reached the screen.

Yes. It lists the MCP servers configured in Claude Code, Claude Desktop, Cursor, VS Code, and Windsurf, alerts on new ones, and lets a client approve or block remote servers. Approved servers have every tool call checked against the client’s rules.

USB drives, the clipboard, webmail, and file-sharing sites, yes, with the same rules as AI. It can also report where sensitive files sit in user folders, by path and type only. Email DLP for Microsoft 365 is Coming Soon.

Yes. Per client, choose which browsers may run, including AI browsers such as ChatGPT Atlas, Perplexity Comet, and Dia, and alternatives such as Brave or Tor Browser. A blocked browser is closed within a few seconds. Passive clients get an alert instead.

Private app access through the ProctoredAI agent is Coming Soon.

There are 3 tiers: ProctoredAI, each MSP, and each client. Every request is scoped to the signed-in person’s tier, so a client sees only itself and an MSP sees only its own clients. Benchmarks compare against medians, never named companies.

Yes, as client admins or client viewers who see only their own company. You keep the partner view across all of them.

Single sign-on with Entra ID, Google Workspace, or any OpenID Connect provider, at the MSP and client level, with group-to-role mapping and an SSO-only option. Password accounts can add two-factor authentication, and anyone without it is reminded at every sign-in.

Yes. Your name, logo, and help contact appear on the tray, block pages, reports, and the AI Use Policy as “Proctored by” your company.

Alerts open tickets in ConnectWise PSA, Autotask, and HaloPSA, and post to Slack, Microsoft Teams, email, or any webhook. A read-only API feeds your SIEM.

Creating a client and applying an industry template takes minutes. Your RMM push does the rest.

Archive the client. Its records are kept, licensing stops at the archive date, and its devices stop enforcing so nobody’s browsing breaks.

9 frameworks: HIPAA, PCI DSS, SOC 2, ISO/IEC 42001, NIST AI RMF, the EU AI Act, CMMC, GDPR, and GLBA. One click applies the matching policies and lists what else the framework needs.

No tool does that on its own. ProctoredAI enforces your AI controls and produces the evidence an auditor asks for. Your compliance program does the rest.

A printable report mapped to each framework’s controls, a sealed evidence bundle, CSV exports, the audit log, the AI Use Register, and each employee’s acknowledgment of the AI Use Policy.

Not without it showing. Every console and agent action goes into a hash-chained audit log that can be verified, so any edit or deletion breaks the chain.

A plain-language acceptable-use document generated from the rules actually enforced, so the written policy and the real one can’t drift apart. Employees read and acknowledge it on their device, and each acknowledgment is kept as evidence.

Per device, per month. Partner prices start at $3.00 for Govern and $4.75 for Protect per endpoint, and drop as the fleet grows. No hardware and no setup fee. MSPs set their own price to clients. See partner pricing.

30 days of the full platform on one real client, with no credit card and no sales call. Start at ProctoredAI.com/trial.

The console goes read-only and devices keep enforcing their last policy. Nothing is deleted, and converting your account lifts the limit.

ProctoredAI hosts the console for partners on Google Cloud. If you need it on infrastructure you control, ask us.

Write [email protected]. A person answers.