Stop AI data leaks before they leave your perimeter.
BitDrip inspects supported AI traffic your team sends to
ChatGPT, Claude, Gemini and other LLMs —
where configured policies can detect and block PII, credentials, PHI,
and proprietary data in supported paths. The current product is for organizations and their authorized workforce;
it is not currently offered for personal or consumer use.
Designed to support compliance withGDPRHIPAAPCI DSSSOC 2ISO 27001CCPA
YOUR DATA STAYS YOURS.
< 5 min
Average deploy time
6
Compliance frameworks
15+
Detection categories
< 10ms
Avg policy check time
How It Works
Supported AI traffic. Evaluated before it leaves.
BitDrip's proxy and policy components run in your network. A lightweight proxy daemon inspects configured supported HTTPS traffic, the policy engine evaluates it against your rules, and the configured action is applied before forwarding. The separate commercial portal manages licensing and release delivery.
✕
Violation Detected — Blocked
When a supported configured detector returns a block action, the proxy rejects the request before forwarding. Validated audit configurations can record the rule, category, user identity, and a content hash without retaining the matched content in that audit record.
✓
Clean Request — Forwarded
When policy allows a supported request, it continues to the AI service. Validated audit configurations can record bounded metadata; confirm deployed fields and retention before relying on this description.
↺
Responses Scanned Too
AI responses pass back through the proxy. BitDrip checks for hallucinated PII, data exfiltration artifacts in responses, and jailbreak success signals on the return path.
Why BitDrip
Built for enterprise security teams
Nine capabilities that make BitDrip the right choice for organisations that take data privacy seriously.
Real-time Protection
Supported traffic to ChatGPT, Claude, Gemini and other configured AI services is checked before it leaves the device. Sensitive data — names, medical records, card numbers, passwords, and proprietary content — can be detected and blocked in real time. Tested browsers and applications that use the system proxy are protected with no browser add-on required.
AI Response Scanning
On supported configured response paths, BitDrip can evaluate documented PII patterns, jailbreak-success signals, and data-exfiltration artifacts. Coverage and detector outcomes require deployment-specific validation; no feature-parity claim is made about other products.
Customer-Controlled Content Path
The proxy, policy engine, dashboard, and their content-processing path run in your infrastructure. Supported configured requests go from the device through those customer-controlled components to the AI provider. The separate commercial portal is not in the documented prompt-content path.
Compliance & Audit
Built-in profiles and technical-control mappings can support an organization's GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, and CCPA work. Validated audit records can use hash-chain and signature evidence where the deployed release provenance confirms those features are enabled; the documented verifier can detect changes when verification runs.
SIEM Integration
Export audit events to Splunk (HEC/CEF), Elastic/OpenSearch, and Azure Sentinel in real time. Configurable per organisation — violations land in your existing security toolchain automatically.
MCP Policy Intercept Preview
Evaluate early MCP tool-call traffic through the policy layer for selected agent workflows. Full agentic AI discovery and monitoring remains on the product roadmap while the preview matures.
Throughput & Usage Analytics
Track AI usage volume by organisation and time period. Per-GB scanning metrics and time-series charts give security teams visibility into AI exposure across the entire organisation.
Fleet Visibility
Enroll workstations with a one-time token. The admin dashboard shows enrolled devices reported through the supported heartbeat path — including hostname, OS, proxy version, and online/offline status. Revoke a device in one click if it's lost or decommissioned.
System Tray App
A native app for macOS, Windows and Linux lives in your system tray and manages the BitDrip proxy daemon without any terminal required. Supports system proxy mode for centrally managed devices and PAC-based routing for BYOD and unmanaged devices. Shows live connection counts and blocked-request totals in the tooltip, with a built-in preferences window for proxy mode, policy engine URL, and CA certificate status.
Coverage & Compatibility
Know what BitDrip protects
Coverage depends on how each application connects. Validate every managed application before rollout.
Supported now
Tested browsers and applications that use your system proxy or the configured BitDrip PAC URL.
Requires configuration
CLI and SDK tools must be configured to use the BitDrip HTTPS proxy and local CA, then tested by your administrator.
Not guaranteed
Applications that bypass proxy settings, use certificate pinning, connect by direct IP, or use unsupported transports.
Covered routes and controls are implemented and tested to documented scope. Defense-in-depth is continuously assessed as the product evolves.
A01
Broken Access Control
Covered organization-scoped routes enforce and test tenant authorization. Authorization boundaries remain part of ongoing security review.
A02
Cryptographic Failures
AES-256 at rest, TLS 1.3 in transit, ed25519 license signing.
A03
Injection
Covered data paths use parameterized queries and schema validation. Covered output paths apply tested contextual encoding and sanitization, with defense-in-depth reviewed continuously.
A04
Insecure Design
Customer-controlled content processing and data-minimizing audit designs. Validate deployed fields, logs, diagnostics, and retention rather than assuming universal non-storage.
A05
Security Misconfiguration
Helmet.js (HSTS, CSP, X-Frame-Options). CORS allowlisting. No default credentials.
No external URL fetching from user content. Outbound connections allowlisted.
Zero Trust Data Flow
Validated audit configurations can use hashes and bounded metadata instead of full matched content. Confirm the deployed schema, logs, diagnostics, and retention before relying on that behavior.
Cryptographic Verification
Authenticated release evidence includes SHA-256 checksums for promoted installer bundles. License JWT verification uses ed25519; verify the deployed release and issuer evidence before use.
Self-Hosted by Design
Policy decisions for supported configured traffic run in your environment. The commercial portal has a separate, bounded account, licensing, deployment, billing, and release-delivery data path described in the privacy notice.
Designed to support compliance withGDPRHIPAAPCI DSSSOC 2ISO 27001CCPA
Documented, tested capabilities can support selected technical-control objectives on validated paths; this is not certification or complete control coverage. Read the documentation →
Compliance Coverage
Designed to support your compliance requirements
BitDrip provides configurable detectors, policy actions, and evidence that can support selected framework objectives on validated paths. It does not determine legal compliance or guarantee detection or blocking.
GDPR
PII & special-category data — names, emails, addresses, national IDs
HIPAA
PHI & patient data — medical records, conditions, insurance IDs
PCI DSS
Card numbers (Luhn-validated), CVV codes, PINs
SOC 2
API keys, passwords, secrets & credentials
ISO 27001
Credentials, proprietary data & internal document markers
CCPA
California resident PII & consumer personal data
Designed to support compliance — not a substitute for legal review.
Getting Started
From zero to protected in minutes
Register once, deploy anywhere. No SaaS. Your AI data stays in your infrastructure, always.
1
Register
Create your account and choose a plan. Receive your signed license file by email.
2
Download
Download the installer bundle. Verify the SHA-256 checksum. Extract and review.
3
Deploy
Run ./install.sh — it starts all services automatically. Then run bitdrip cert generate && bitdrip cert install to install the CA certificate, and bitdrip proxy start to begin intercepting traffic (or use the system tray app).
4
Protect
Configure policies in the dashboard. Enroll additional workstations from Settings → Workstations. Test browsers and configure each CLI or SDK tool that must use the BitDrip proxy.
Full installation guide, configuration reference, and troubleshooting are in the documentation.
The dashboard presents policy events, technical-control mappings, and enrolled-workstation state from the customer-controlled deployment. Validate deployed audit fields, logs, diagnostics, and retention; the dashboard does not establish legal compliance.
BitDrip Dashboard · Recent Violations
23blocked today
2,841allowed today
12workstations
PII
Full Name detected → ChatGPT
"Please analyze patient John ████████'s lab results..."
hr@company.com · 2 minutes ago · BLOCKED
PHI
Medical Record ID detected → GPT-4
"Patient MRN ████████ was diagnosed with..."
clinic@company.com · 8 minutes ago · BLOCKED
CRED
API Secret Key detected → Claude
"sk-████████████████ is our prod key for..."
dev@company.com · 14 minutes ago · BLOCKED
PII
Email Address detected → Gemini
"Contact ████████@client.com to close the deal..."
sales@company.com · 31 minutes ago · BLOCKED
BitDrip Dashboard · Compliance Overview
94%
GDPR
87%
HIPAA
100%
PCI DSS
96%
SOC 2
91%
ISO 27001
98%
CCPA
LAPTOP-MBP-01macOS · Client 1.3.3
DEV-UBUNTU-03Linux · Client 1.3.3
WIN-HR-WORKST-04Windows · Client 1.3.3
FINANCE-WIN-02offline
Pricing
Simple, transparent pricing
Start free. No credit card required for the Community tier.
For licensing, one user means one enrolled workstation or device seat.
Register free, download the installer and have BitDrip running in your environment today.
Community tier covers up to 3 users for evaluation. Team plan starts at $99/mo for up to 10 users.
Linux x86_64Linux arm64macOSWindows x64DockerPodman
