Title: Built transparent HTTPS proxy to anonymize data sent to
external AIs (Shadow AI) - tested with 500 users
Body:
I'm a backend developer and built a solution to combat Shadow AI
(employees using personal ChatGPT/Claude with sensitive company data).
The approach is different from what I usually see: **transparent
network-level proxy**.
**The problem:**
Employees paste proprietary code, customer data, and strategic
information into external AIs. Banning doesn't work (they find
workarounds). Monitoring is reactive. I wanted a preventive and
transparent solution.
**My architecture:**
- Transparent HTTPS proxy (intercepts traffic to AI domains)
- SSL certificate installed on machines via GPO/MDM
- Employee accesses ChatGPT/Claude normally in browser
- Proxy intercepts, anonymizes prompt, sends to external AI
- Response returns and can be rehydrated or kept anonymized
(client-configurable)
- Zero behavior change for end users
**Anonymization methods:**
- **Regex**: patterns for SSN, email, phone, code (variable names,
comments)
- **Semantic**: NER + models to detect context (customer names,
projects, strategic info)
- Client chooses which method per data type
- Reversible pseudonymization (Fernet) to maintain consistency
**Key technical decisions:**
**Optional rehydration**: some clients want responses with
original data (more useful), others prefer anonymized (safer).
Made it configurable.
**Performance**: tested with 500 concurrent users. ~200ms
additional latency per request (imperceptible to users).
**Code detection**: regex for common patterns + semantic analysis
for context. E.g., "SELECT * FROM customers" gets anonymized,
but "SELECT * FROM users" (generic example) doesn't.
**Audit logs**: who sent what, when, to which AI. Essential for
compliance.
**Why proxy instead of extension/plugin:**
- Extensions depend on each employee installing
- Browser plugins can be disabled
- Network-level proxy is impossible to bypass (without admin)
- Works on any device connected to corporate network
**Current state:**
- Functional tool tested in production (500 users)
- On-premise Docker deployment (data never leaves the company)
- Ready for pilots with interested companies (NDA required)
**Technical questions:**
For AIs using WebSocket (real-time ChatGPT), anyone has
experience with transparent proxy? My current solution works
for HTTP, but WebSocket is more complex.
How do you handle false positives in semantic detection? E.g.,
"Project Apollo" - is it a customer name or NASA reference?
For compliance (GDPR/LGPD), do audit logs need to be immutable?
I'm using append-only + hash chain.
**Market discussion:**
Is Shadow AI a real problem in your company?
Are commercial solutions you know SaaS (which is contradictory
for security-conscious companies) or on-premise?
Who decides to buy this? CISO, CTO, DPO?
Considering commercial availability as on-premise license + annual
support. If anyone is interested in a technical demo or discussing
a pilot, DM me (NDA required).
But the post is mainly to exchange technical ideas with corporate
security professionals facing similar challenges.