# LLMGuard > LLMGuard is an AI-firewall and the inspection layer for AI traffic. People, agents and tools hit it before a model sees the request. A product by Birchlab.uk. ESTESIS builds it. Language: en-GB. Region: United Kingdom. Site: https://llmguard.io/ Russian portal: https://llmguard.ru/ Company: https://estesis.tech/ Contact: https://llmguard.io/contact ## What it is LLMGuard sits on the path to the model. Every prompt, file and tool call is inspected in flight. A verdict is written on the request that caused it: mask, block or route. The round trip stays under 25 ms. Where the time goes: prompt 2 ms, inspect 9 ms, policy 14 ms, model 23 ms. The same verdicts run in three places: - Cloud. The layer is run for you. Calls to the model pass it, and the log stays in your tenant. - Private VPC. The layer runs in your network. The model on the other side can be yours or a vendor's. - Air-gapped. No outbound call. The same verdicts, on a machine that does not dial out. Security teams running it are named on the site as banking, retail, industrial and public sector. ## Verdicts - MASK. A customer record in a prompt, or vendor contract text. The model gets the task with the sensitive span replaced. The original stays in the log. - BLOCK. A secret in pasted code, or an injected instruction. The call stops. The person sees a refusal, not a silent rewrite. - ROUTE. A classified file upload. The request goes to the model inside your perimeter, and the person keeps working. Regex and keyword lists catch the sentence that was written down. A paraphrase walks past them. ## Rollout Nothing is enforced before it has been watched. Access is scoped per key. Every verdict names the caller. 1. Monitor. Two weeks of verdicts, zero blocks. 2. Calibrate. Policies move only where the record is already clean. 3. Enforce. Blocks start where the two weeks stayed clean. Four policies ship on day one: secrets-in-code, customer-pii, classified-docs, prompt-injection. Classified documents stay on monitor until the record is clean. The other three enforce. ## The gap The site describes three controls that do not watch the prompt: - The DLP already owned watches attachments and outbound mail. The copy-paste into a chat window never touches it. - A licence for everyone gives each person a model and the security team no record of what went in. - A blocklist is written once. It is accurate the day it shipped, and a rewritten sentence stops matching. ## Exposure scan The scan asks three questions and then draws a picture from the answers. It does not inspect the network. LLMGuard has not seen the traffic. 1. Which models are already in use? ChatGPT, Copilot, Gemini, a model you host, or models not listed. 2. What gets pasted, uploaded or handed to an agent? Customer records, source code and keys, contracts and filings, classified or internal files, or nothing known. 3. What watches the prompt path today? DLP on email and files, a blocklist or keyword list, proxy rules, or nothing on the prompt itself. ## Resources Docs ship with the tenant. The whitepaper, on the inspection path and the 25 ms budget, is sent on request. The changelog on the site records: - 12 Oct 2026. Route verdict for classified files. - 02 Sep 2026. Monitor mode keeps a fortnight of verdicts before a block is allowed. - 18 Jun 2026. Air-gapped install. No outbound call. The status note says the inspection layer is up, and that the page is not a live status feed. ## Data the site keeps The contact form asks for a name, a work email, a company, where it has to run, and a note. The exposure scan keeps the answers. The site says those details are not used to train a model, and that the site stores nothing in the browser for advertising. Yandex Metrika counter on this portal: 113666611. Privacy, terms and cookie policies are issued with the contract. ## Indexing This portal is the United Kingdom edition, en-GB. Search and generative-engine crawlers are welcome. The map is https://llmguard.io/sitemap.xml. The short index is https://llmguard.io/llms.txt. The crawler list is https://llmguard.io/.well-known/ai-crawlers.json and names DeepSeekBot, QwenBot, TongyiBot, AliyunBot, Baiduspider, Bytespider, GPTBot, ClaudeBot, PerplexityBot, Googlebot, Bingbot, YandexBot. Sign-in is per tenant, asks for no password, and is marked noindex. The Russian portal is a separate site at https://llmguard.ru/. ## What this description does not claim Prices are not published. Pricing sits with the deployment. Docs are not public; they are handed over with the tenant. The whitepaper is not posted on the site. The homepage comparison sits beside an illustrative log, so this file does not repeat those panel figures as measurements.