Prompts and responses.
Protected in transit.
SQPrompt keeps what people type into AI tools, and the answers that come back, encrypted from their browser or app until it reaches the server you choose.
Your AI model runs unchanged. SQPrompt is delivered as front-end and back-end SDKs and deployed on your infrastructure.
TLS protects the pipe, not the data inside it.
An AI prompt is the sensitive content itself. Much of the path it travels runs through organizations you do not run. Under TLS alone, each intermediary that terminates the connection sees plaintext.
TLS protects the pipe, not the data inside it.
Today's fixes leave the payload exposed, or the cost high.
| Fix | What it covers | What it leaves |
|---|---|---|
| TLS and certificates | The connection between two points | Plaintext at every intermediary that terminates it |
| Session tokens and cookies | Proof of who signed in | A leaked token stays valid for its remaining lifetime |
| Content filtering and data-loss scanning | What a prompt says | The prompt and response in transit between user and server |
| A key program for the payload | The data, end to end | Keys to store, distribute and rotate |
Security without the cost of running it.
The usual trade
- Keys you must manage, distribute and rotate.
- Security or low operating cost, not both.
With SQPrompt
- No keys to manage, distribute or rotate.
- No secret or key is transmitted, only a sync reference.
- A new transition commits every one to two seconds.
Both ends derive their own key material and keep it in step.
One session, start to finish. Sign-in, single sign-on and MFA stay with your own identity layer.
You authenticate the user
Your identity check runs as it does today, unchanged.
Your backend starts a session
It binds the session to the result of your identity check and creates a starting synchronization reference, which it delivers to the front-end SDK.
The front end completes provisioning
The session becomes trusted and unique to that session. Browser and backend now hold synchronized state, and the state commits a new transition every one to two seconds.
Each end derives its own key material
No secret or key is transmitted, only a sync reference.
Prompts and responses move through the channel
Your backend decrypts at the point you choose and forwards the request to your existing AI model, unchanged.
On top of the TLS you already run.
SQPrompt works at the application layer, independent of TLS and complementary to it.
Built for teams putting AI tools into real use.
Enterprises deploying internal or customer-facing AI tools, regulated industries piloting LLM use cases, and security teams evaluating AI data exposure.
Internal and third-party LLM services
Encrypt prompts and responses between an enterprise session and the LLM service behind it.
The AI tools people already use
Secure customer-support, coding-assistant and copilot tools in the browser, mobile and desktop apps already in place.
Upstream of your AI gateway
Decrypt at a point on the network path ahead of your gateway or prompt-security tooling, so those tools inspect plaintext. This is the recommended configuration.
Sovereign and private AI
For organizations that keep their models and data on their own infrastructure, SQPrompt protects the path prompts and responses travel between the user and that infrastructure.
It fits what you already run.
Your infrastructure
SQPrompt is delivered as front-end and back-end SDKs. Deployed on your infrastructure, it sends no customer data to SQE.
Your identity check stays yours
SQPrompt complements sign-in, single sign-on and MFA. It does not replace them. SQE binds the result of your check to a single-use session.
Your AI model, unchanged
SQPrompt protects the prompts and responses. It does not modify the underlying model.
An honest limit
SQPrompt governs who can establish a session, not who is at the keyboard. Its strength is the strength of your own check.
What security and platform teams ask.
Does SQE see our data?
No. Deployed on your infrastructure, SQPrompt sends no customer data to SQE.
Does this replace our identity provider?
No. Your identity check stays yours. SQPrompt binds the result of that check to a single-use session.
Why decrypt before the AI gateway?
So the gateway and your prompt-security tools can see plaintext. The deeper you decrypt, the less edge tooling can inspect, and the stronger the trust boundary. Where decryption happens is your decision.
Why not just TLS plus a gateway?
TLS ends at each intermediary that terminates the connection, and each one sees plaintext. A gateway or scanning tool looks at what a prompt says. It does not protect the prompt and response as they travel. SQPrompt keeps them encrypted from the user's session until they reach the server you choose, and it works on top of the TLS you already run.
Does SQE hold FIPS, SOC 2 or ISO certification?
SQE does not hold FIPS 140-3 validation, SOC 2, or ISO certification. The platform is designed to deploy alongside a validated module where one is required, and customer-hosted deployments keep customer data on customer infrastructure.
Define your trust boundary.
Protect the path to AI.
Talk with SQE about your infrastructure, identity layer, and where SQPrompt fits in your AI deployment.
