Monitoring boundaries
AI Assure reports listed AI application and website activity at service or domain level. The agent checks running programs and requested website hostnames against its service list and the customer's policy. It reports matches, relevant blocked attempts, device details, installed listed AI applications, programs closed by policy, a fingerprint of installed programs, check-ins, and policy status. The local web-filtering proxy sees the requested hostname to apply policy. It does not decrypt allowed HTTPS connections or inspect remote page content, prompts, typed content, uploaded files, AI responses, emails, messages, or screen content. Allowed browser connections are forwarded to their requested destinations; blocked requests are not forwarded to the blocked destination.
Organisations decide which devices to enrol, what policies to apply, and how to communicate monitoring to staff. They are responsible for confirming that their use is lawful and appropriate for their workplace.
How the agent connects
The agent service makes outgoing secure (HTTPS) connections to AI Assure to register, check in on its company schedule, collect policy, report activity, and receive published agent updates. Check-ins are every 15 minutes by default and company owners can choose 5, 10, 15, 30, 60, or 120 minutes. The local web-filtering proxy listens only on the device itself (127.0.0.1). For allowed browser traffic it forwards the browser's requested connection to its destination; for a blocked hostname it does not contact that destination and can return the AI Assure block page in the browser. It does not decrypt allowed HTTPS traffic. AI Assure has no remote access to devices: we cannot connect to them, run commands, view their screens, or open their files. Each device has its own key, stored encrypted and readable only by Windows administrators on that device.
Blocked websites
When a policy blocks an AI website and someone opens it in a browser, the agent can show a page explaining the block in that browser tab. To do this, each device creates its own certificate, which is trusted on that device only. Its private key is created on the device, held in the device's TPM security chip where there is one and otherwise in the Windows key store, and cannot be exported. The agent uses the certificate only to answer connections to AI websites the policy blocks: it answers them itself, so nothing is sent to the blocked website. Allowed connections are tunneled without decryption or content inspection. Before using the certificate, the agent checks that Windows trusts it; if it does not, or a browser does not accept it, the explanation opens in a new tab instead. Company owners can turn this off on the Security page of the customer portal, which removes the certificate from each device at its next check-in. Removing the agent also removes it.
Where the service runs
AI Assure runs on servers in IGC Technical Solutions Ltd's own data centre in the United Kingdom, where customer data is stored.
Account and data protections
We use appropriate technical and organisational measures to protect accounts and customer information, including encrypted connections, hashed passwords, two-step sign-in for every account, sign-out after a period of inactivity that account owners choose, owner, standard, and read-only roles, limiting people to particular sites and departments, and audit records for security-relevant actions. Platform administrators also use two-step sign-in and are signed out after a period of inactivity.
Offline agents retain their last cached policy, which can continue to apply while the agent runs. They cannot receive changes or uninstall instructions while disconnected. If the filtering service is unavailable, network recovery can restore proxy settings owned by AI Assure to preserve connectivity; enforcement is reduced during that recovery.
Enforcement limits
Detection is limited to listed services and supported device signals. Existing proxies, PAC configuration, Secure DNS, VPNs, encrypted tunnels, non-proxy-aware applications and local administrator control can reduce coverage or bypass a particular layer. An observed hostname or installed application is not proof that a person intentionally used it. Provider grouping applies one decision to its listed products and URLs; a changed catalogue decision must be published in the relevant device policy. Policy precedence is device, department, site, then company. A report-only policy does not block.
Limitations
No online service can guarantee that it will always be available or that every security risk can be eliminated. Customers should secure their own devices, use strong unique passwords, limit account access, and contact us promptly about suspected compromise.
Contact
For security or responsible-monitoring questions, email hello@aiassure.net.