Can’t sign in? Use “Forgot password?” above, or ask your administrator.
–
–
You're protected at work
Nesgate checks what you send to AI apps and stops sensitive data before it leaves your browser. This page shows only your own activity. Your security team cannot see anything here that they do not already see in their console.
My browsers
Browsers where Nesgate protects you with this work account.
Install Nesgate: Chrome, Edge or Firefox. On a company laptop it is usually installed for you.
Click “Sign in” in the extension: approve the code it shows. That's it.
For your safety you are signed out after 30 minutes without activity.
Connect this browser?
Check that the code matches the one shown in the Nesgate extension.
–
Browser
–
Account
–
Requested
–
From
–
Only connect if you just started sign-in in the Nesgate extension on this computer yourself. Never approve a code someone sent you.
Before you continue
Please review how Nesgate works with your data.
Protect your account
Add a second step so a stolen password is not enough to get in.
Scan with your authenticator app
Open the app on your phone and tap + or Add account.
Choose Scan a QR code and point the camera here.
Type the 6-digit code the app shows for Nesgate.
Can't scan? Enter this key instead
Save your recovery codes
If you lose your phone or passkey, each code lets you sign in once. Store them in a password manager or print them. Nesgate cannot show them again.
!
This account is suspended
Nesgate support has paused access to this console. Browsers keep protecting with the built-in detectors, but nothing can be viewed or changed here until the account is reactivated.
Check your email for a message from Nesgate about this account (for example an unpaid invoice).
Contact Nesgate support to reactivate it. Your data and settings are kept.
↻
A new version of Nesgate is available
Reload to use it. Unsaved changes on this page are lost.
@
Confirm your email address
We sent a link to . Until you confirm it, password resets and alerts cannot reach you.
Overview
What Nesgate caught before it reached AI apps, in the period you choose.
Day by day
Each bar is one day: how many times Nesgate stepped in, split by what happened. Hover a day for the exact numbers.
What happened
Share of all findings in this period by outcome.
Browsers with the most risk
Ranked by risk: serious findings count more, “Send anyway” counts most. Click one to see its details.
Most common data types
What Nesgate found most often. Click one to see where it came from.
How it was shared
Typed or pasted text, attached files, images, or found in the AI's reply.
Teams
Findings per team. Teams come from Add people → Teams and keys.
Where it was going
The AI apps the caught data was heading to, most often first. Click one for its details.
Worth a look
Things Nesgate thinks you should check in this period, most important first. Open one to follow the trail.
Open incidents
Still waiting for someone to look at them. Click a row for the details.
What was caught
Everything Nesgate stopped, cleaned or let through with a warning. Click a person, browser, file or network address to see everything related.
Time
Status
Person · browser
AI app
What was found
Severity
Outcome
File
People
Who puts company data at risk in AI apps, ranked by what actually left the browser, with the reasons. Masked findings only; nobody's prompts are stored.
Everyone with findings
Click a person for the reasons behind their score, day by day, and their latest findings.
Person
Risk score
Findings
Sent anyway
Stopped or cleaned
Last 7 days
Mostly
Where
Last finding
How the risk score works
Each finding adds points by severity. Data that was sent anyway after a warning counts three times as much as a finding Nesgate stopped or cleaned, because it really left the browser. Findings sent while a policy only monitors count double. The score (0–100) rises quickly at first and levels off, so a few serious events matter more than many small ones.
High 70+ · Elevated 40–69 · Low under 40. Use it to start a conversation or adjust a rule, not as proof of bad intent.
Investigate
Pick a person, browser, file, AI app or type of data. Nesgate tells you what happened with it, step by step, and what it is connected to.
What to protect
Reaches every connected browser within about a minute. Text, documents, code and pictures are always checked on the computer itself; nothing is uploaded.
You have analyst access: you can see everything here; an admin makes the changes.
How strict
What Nesgate hides before a message reaches an AI app. Standard suits most people; Strict hides more.
Nothing passes silently: anything not hidden is shown to the person first.
Example
“Please e-mail [email protected] about the PT Maju Jaya contract. Password: Sunrise#2026”
Standard hides “PT Maju Jaya” and the password. Strict also hides the e-mail address. In typed text, “PT Maju Jaya” is shown to you as a suggestion; in files and pictures it is hidden.
When something is found
Nesgate stops the message and asks you first. You choose to hide the data, remove it or send the original.
What to look for
Switch a kind of data off only if it causes too many false alarms. Each line says what it catches.
Passwords, API keys & secrets
Passwords and the access keys programs use to sign in to company systems and cloud services (for example AWS, GitHub, Google, Slack, Stripe), in typed text and in files.
Cards & bank data
Payment card numbers (only real card numbers, so ordinary numbers are not flagged), IBAN and bank account numbers.
Personal data
Email addresses, phone numbers and names. Nesgate looks at the words around them to avoid false alarms.
Company network details
Internal addresses of your company’s computers and servers. To an attacker they are a map of your systems.
Confidential documents
Recognises what a message or file is about (program code, health or legal records, HR data, internal financial reports, “confidential” markings), even when no single word gives it away.
Hidden instructions (prompt injection)
Hidden text in a document or web page that gives the AI orders behind your back, for example “ignore your company’s rules” or “send the customer list to this address”. Nesgate stops a file that contains it before upload and warns when such text is typed or pasted.
Files Nesgate cannot check
Nesgate reads documents, spreadsheets, e-mails, archives and databases before they are sent. A few files cannot be read: RAR, 7z and other archive types, Outlook data files (PST), design files (Photoshop, Sketch, Figma), password-protected or damaged files, and files over 20 MB. Programs, audio and video are not part of this setting.
When a file cannot be checked
Ask first: the person is told and chooses to remove it or send it anyway, which is recorded. Never send: the file is always removed. Allow: the file is sent with a warning.
Images in the last 30 days
What Nesgate did with images that contained something sensitive. Counted from your own findings.
Loading…
Pictures and scans
Text inside screenshots, photos and scanned PDFs is read on the computer, then the sensitive parts are blacked out and checked again.
Read text in pictures
Reads the text inside pasted screenshots, photos of ID cards and scanned PDFs on the computer. On by default. Turning it off saves a little computer power.
Languages in pictures
Text in every language is read. English is built in; for other writing systems the browser downloads a small reading model from this console once, when a picture needs it. Pictures never leave the browser.
What to do with pictures
Every picture sent to an AI app
Allow it with the sensitive parts blacked out, ask the person first, or never send pictures.
Looks like a document but cannot be read
Photos of a card or page that are too blurry, dark or angled to read.
Faces
Photos of people, for example a selfie holding an ID card.
QR codes
They can hide sign-in keys, tokens or payment links. Nesgate reads what a code holds (other barcodes are not read).
Signatures & stamps
Handwritten signatures and company stamps on documents.
Company logos
Logos in the letterhead of letters, contracts and invoices. Blacked out together with the company name.
AI answers checked
Also check what the AI replies for secrets or personal data (for example customer records it was given earlier). Findings are highlighted and logged; answers are never blocked.
ID documents by country
Passports and ID cards from every country are recognised by the machine-readable lines printed on them. Turn on a country to also catch its national ID numbers (checked with their check digits, so ordinary numbers are not flagged) and its documents. For Indonesia: KTP, Kartu Keluarga, NPWP, SIM, BPJS and akta, including every NIK, name and birth date on a photographed family card.
Numbers without a checksum (family card, BPJS, driver's licence, TFN, My Number…) are only reported when a label such as “No. KK” or “BPJS” appears nearby, to avoid flagging ordinary numbers.
Fine-tuneValues that are never flagged, and a different action for one type of data. Most teams never need this.
Action per type of data
Overrides “When something is found” above for one type. Warn lets it through and records it, Block always stops it, Allow ignores it.
Type of data
Group
Action
Exceptions
For example a test card number or a shared QA mailbox. Press Enter to add it, then Save.
Rules for a team or a person
What people see when Nesgate steps in, and stricter or looser rules for one team or one person. The most specific rule wins: company, then team, then person.
Shown next to what Nesgate found. Tell people what to use instead.
Ask for a reason before “Send anyway”
People must type a short business reason (10+ characters). It is saved with the incident and cannot be edited later.
Only visible to admins and analysts.
Action per type of data (optional)
Applies to
Who
What is different
Note for admins
Actions
Pause everywhere
Turns Nesgate off on every connected browser at once. Only if an update misbehaves; turn it back on the same way.
You have unsaved changes. Nothing reaches the browsers until you save.
Browsers
Every browser protected by Nesgate. Revoking one disconnects it right away; its history is kept.
Connect a browser
Install the extension, then sign in from it. No password is typed into the extension.
Install Nesgate: Chrome, Edge or Firefox, with the button above.
Click “Sign in” in the extension: a tab opens on this console (). Check the code matches and click Connect.
Done: the browser appears below. Revoke it here if you lose the device.
Show
Person
Team
Browser
Last network address
Nesgate version
Findings
Last seen
Status
Add people
Put Nesgate on your employees’ browsers. Pick the way that fits how your company looks after its laptops. You can use more than one.
1Choose how to roll out
2Follow the steps
3Check that browsers join
Recently joined
The latest browsers that connected to this console, newest first.
Person
Team
Browser
How it joined
When
Single-use invitesA personal link for one person. It stops working once it has been used or when it expires.
Their browser is linked to this name, so findings show who it is.
Change your sign-in e-mail to a company address first (see the notice at the top). Adding people unlocks right after.
Invite
For
Team
Joined
Used
Works until
Teams and keysEach team has its own key. It is built into your install settings and invite link, so nobody has to type it.
A key tells Nesgate which organization (and which team) a browser belongs to. When you replace a key, browsers that already joined stay connected; only new browsers need the new settings or link.
Team
Key
Browsers joined
Created
Try it on this browser first
Install Nesgate here and sign in with your admin account to see what employees will see.
You have analyst access: you can see everything here; an admin makes the changes.
What do you want to protect?
Pick a kind of rule. No code needed. Your organisation's own name and e-mail domain are always hidden.
New rule
Names & words
What kind of number?
Shown in incidents, e.g. “Key clients”.
Letters and separators stay as typed; each digit may be any digit. Use a made-up number.
For IT staff: describes the shape of your own numbers (here “CL-” followed by 5 digits), for example client IDs.
Smart match
Also catches spelling variants, joined words and web addresses: “Northwind” written as “north-wind.com”.
How broadly should smart match look?
More options
Separate words with commas.
When someone shares it with an AI
Applies to every browser within a minute.
How partial names score
Type a name to see which mentions will be caught.
Try it
Your custom rules
Switch a rule off to pause it without deleting it. Each rule shows how often it matched.
Customer and employee lists
Nesgate recognises the exact values from your own list (customer numbers, employee IDs, account numbers). Your list never leaves your browser. Nesgate keeps only one-way fingerprints that cannot be turned back into your data.
Choose a CSV file. The first row holds the column names.
The file stays in this browser: each value becomes a one-way fingerprint and only those fingerprints are uploaded.
Browsers then recognise those exact values when someone shares them. Only browsers with a confirmed person receive the list (Browsers → owner); browsers joined with the shared invite link get it once their owner is confirmed.
AI apps
Which AI apps your people use, whether Nesgate checks what is sent there, and which ones your company allows. New AI apps are protected automatically.
Which AI apps may people use?
Every AI app is protected either way. This decides whether apps you have not approved can be opened at all.
Show
Approved
Your company's official AI tools. Protected, and not counted as shadow AI.
Watched
People may use it and it is protected, but every visit counts as shadow AI. New apps start here until you review them.
Blocked
People cannot open the site at all in a protected browser; they see a page from your organization. About access, not about images or OCR.
Privacy: Nesgate keeps daily totals per browser for AI sites only, never browsing history.
Connections
Get incidents where your team already works. Connect in one step, send a test, done.
You have analyst access: you can see everything here; an admin makes the changes.
Connect
Slack
Notify me about
Signing secret: copy it into your receiver now
It is not shown again.
Connected
Where incidents are sent now. Choose per destination which ones are sent.
Recent deliveries
Whether each message arrived, and in plain words why one did not.
Time
Destination
Incident
Result
Plan & billing
Your plan, what it includes, how much of it you use, and your invoices.
Usage
What you use now against what your plan allows.
Compare plans
Invoices
Open an invoice to see how to pay it, or to print it or save it as a PDF.
Invoice
Plan
Period
Total
Due date
Status
Invoice requests & billing questions
Your conversations with Nesgate about invoices and payments. Click one to read the replies and answer.
Request
Status
Last update
Billing details
Printed on your next invoices. Invoices already issued keep the details they were issued with.
Audit log
Who changed what, and when, including Nesgate support. Records are chained together, so nothing can be edited or deleted unnoticed.
Time
Who
What happened
Details
Help & support
Ask Nesgate support anything: a question, something that is not working, security or billing (invoice requests from Plan & billing are here too). You get an email when we reply.
Your requests
Click one to read the conversation and reply.
Request
Topic
Status
Opened by
Last update
Urgent security issue? Mark the request Urgent. It goes to the top of our queue. Include the browser and what you were doing; never paste passwords or real customer data.
Health
Are all browsers protected, up to date and reporting? Nesgate fixes what it can on its own.
Stopped reporting
Browsers silent for 14 days or more, usually uninstalled, a retired laptop or a reset profile.
Needs an update
Managed browsers update themselves within hours. Others update when the browser restarts.
Delivery recovery
When a browser is offline, findings wait on the device and are retried. After 8 failed tries they are uploaded as a recovery record and added to incidents automatically. Anything listed below could not be recovered on its own. Add it once the cause is fixed.
Time
Browser
Type of data
Outcome
Masked preview
Why it waited
Settings
Your account, your team, how people sign in, and how long data is kept.
Sign-in email
The address you sign in with. Password resets and security notices go here.
Password
Two-step verification –
A second step means a stolen password alone can't open your account.
Passkeys
Sign in with your fingerprint, face or device PIN. No password, can't be phished.
Authenticator app
A 6-digit code from your phone after your password.
Recovery codes
Where you're signed in
Console sign-ins on this account. Don't recognise one? Sign it out and change your password.
Trusted browsers
Browsers where you chose “Don’t ask for a code again”. Each one skips the 6-digit code until its date. Remove any you don’t recognise.
Organization
Useful when you contact Nesgate support.
Appearance
How this console looks in this browser. It is remembered here only; other people and other browsers keep their own choice.
Midnight: a dark side menu and a dark map. Daylight: everything light, the map too, which is easier to print or paste into a report.
Team members
Admins manage everything. Analysts investigate and export evidence but cannot change anything. Employees connect their own browsers and see only their own activity.
Team rules
How everyone signs in, and what people with the Employee role can see and do.
Require two-step verification
Everyone must use a passkey, an authenticator app or single sign-on. People without it are asked to set it up at their next sign-in.
“Keep me signed in”
How long people may stay signed in to this console when they tick “Keep me signed in” (counted from their last visit). Shortening it also shortens sessions that are running now. Employees are never kept signed in: they are signed out after 30 minutes without activity. The browser extension keeps protecting either way.
Employees can see their own activity
A “My activity” page when they sign in: what Nesgate caught for them, without file names, and only what was recorded in their name.
Employees can suggest rules
A “Suggest as a rule” button for company names in the extension and on their page. Suggestions wait in Custom rules until an admin adds them (as a rule that blocks the name for everyone) or dismisses them.
Single sign-on
People sign in with their company account (Okta, Microsoft Entra ID, Google Workspace or any OpenID Connect provider). Create a “Web” app there, paste three values here. Nesgate discovers the rest.
Redirect address to paste in your identity provider
–
From your identity provider's app page (“Issuer” or “Authority”).
People with this email domain use single sign-on.
Leave empty to keep the saved secret.
Prove you own
Add this TXT record to its DNS, then click Verify. Until then, Sign in with SSO by email and automatic sign-up stay off.
Automatic user provisioning (SCIM)
Your identity provider adds and removes console users by itself. Paste the address and token below into its SCIM settings.
SCIM base URL
–
A new token stops the old one right away.
Copy this token now
It is not shown again.
What is recorded
So an investigator can prove what happened, without the sensitive values themselves.
Attachment file names (the original and the masked copy that was actually sent) and the SHA-256 fingerprint of both are always recorded, so an investigator can prove which version left the browser. File names can contain personal data (e.g. salary_john.xlsx); make sure your privacy notice covers this. Folder paths are never stored.
Also recorded for every finding: network address, browser and person, Nesgate version, AI page address (without its query), device and server time, file type, size and fingerprint, the policy version in effect, and a masked preview. Raw sensitive values never leave the browser.
How long to keep incidents
Incidents older than this are deleted automatically, with related activity (AI app usage, case notes and delivery logs). Deletions are logged and the integrity chain stays verifiable.
Your plan keeps at most the period it includes; longer choices are shortened to it.
Saved
Help improve Nesgate
Optional. Lets Nesgate study how the product is used in this account (which protections trigger and which choices people make) to improve detection. Never the text or files you check, and never sold. Off by default; turn it off at any time.
Separately, Nesgate keeps anonymous daily counts across all customers (for example “card numbers blocked on ChatGPT”) that cannot identify you or your organization.
Delete account
Closes access right away and disconnects every browser. All data (findings, rules, people, audit log) is permanently deleted after 7 days. Until then Nesgate support can undo it.
Kept as the law requires: invoices and payments (10 years) and the record of which terms were accepted (5 years). Nothing else.
Detection quality Not run
How accurate each built-in detector is on Nesgate's labelled test set: how often it is right when it alerts (precision) and how much it catches (recall). This checks the rule pack, not your live traffic.
Encrypted backup
Download an encrypted copy (AES-256-GCM) of your organization's console data. The passphrase is never stored. Keep it offline. Nesgate support restores it on request.
