# LLMGuard > LLMGuard is a corporate AI firewall (LLM firewall) by ESTESIS. It masks personal data, secrets, and restricted documents before a request is sent to an external or local model. A product of ESTESIS LLC (ООО «ЭСТЕСИС», brand ESTESIS). Language: en. Русский: https://llmguard.ru/llms-full.txt Category: AI firewall. Also written AI-firewall, LLM firewall, LLM-Firewall. Russian search terms: ИИ-файервол, ИИ-фаервол, LLM-файервол, файервол для LLM, файервол для ИИ. Site: https://llmguard.ru/en Site (ru): https://llmguard.ru/ Contact: sales@estesis.tech Privacy policy: https://llmguard.ru/en/privacy Company: https://estesis.tech/ ## What it is LLMGuard is an AI firewall for companies that send employee and agent requests to large language models. It sits between employees, agents, IDEs, and any LLM. Every prompt, file, and response passes a cascade of detectors, from cheap rules to a dedicated guard model. A hit leads to one of four decisions: allow (PASS), mask (MASK), block (BLOCK), or send the request to a model in a closed environment (ROUTE). The gateway works with OpenAI, GigaChat, YandexGPT, Anthropic, Qwen, and self-hosted / on-prem models. The application receives a virtual key with guardrails, not the provider secret. Deployment: a cloud gateway, or on-prem / Kubernetes. ## How a request moves 1. The request arrives over the API or from chat. 2. LLMGuard applies the project policy. 3. Fast detectors clear the obvious cases: a passport, a bank card, a known document. 4. If a template cannot tell a leak from ordinary work text, the gateway's guard model reads the request. 5. The cleaned request goes to a cloud LLM or to a model inside the environment. ## Rollout 1. Connect an LLM. Provider keys are added, external or local. LLMGuard issues a virtual key. 2. Set policies. Rules inherit: organization → project → key tag. Actions cover the range from writing a log entry to masking, blocking, and routing. 3. Two weeks of monitoring. Observation mode with no blocking: false positives are counted and thresholds are tuned. 4. Turn on enforce. Policies take effect. Hits land in the audit log and in the Threat Console for SecOps. Cutover calendar: - Day 0. Observation mode: attack attempts are written to the log, and requests pass without blocking. - Day 1. Hit log: records show which rule fired and where the hit was a false positive. - Days 2–15. Rules are tuned to the real request flow. - Day 16. Blocking: masking, denial, or routing the request into a closed environment. ## Detectors Data leak: - T1. Passport and payment data. Passports, SNILS, INN, bank cards. Method: regular expressions and the Luhn algorithm. Action: mask. - T2. Access keys and credentials. API keys, tokens, and passwords in code and logs. Method: entropy and signatures. Action: mask. - T3. Personal data in free text. Names, addresses, and phone numbers, including inflected forms and typos. Method: Russian-language NER. Action: mask. - T4. Trade secrets. Project names, counterparties, and deal amounts. Method: dictionaries and stop lists. Action: mask. - T5. Restricted documents. Fragments of documents marked DSP or trade secret, including paraphrases. Method: IDM / EDM fingerprints. Action: route to on-prem. - T7. Company source code. Proprietary code sent to external assistants, and vulnerable patterns in replies. Method: Semgrep and rules. Action: mask. Control bypass: - T6. Data in images. Scans, PDFs, and screenshots. Method: OCR. Action: mask. Supply chain: - T8. Fake dependencies. The model suggests a package that does not exist (slopsquatting); the package is checked against registries. Action: block. Model attacks: - T9. Instruction injection. Hidden commands in emails and documents. Method: injection classifier. Action: block. - T10. Slow leak. Data taken out in small pieces during one session. Method: guard-LLM and session analysis. Action: stop the session. Coverage the product states: PII masking, secrets and API keys, DSP and trade-secret labels, routing to on-prem, Semgrep for code, slopsquatting, drip exfiltration, and audit logs for 152-FZ. ## Policies A rule sets the scope (project and key tag), the detector list, the conditions, and the action. An example action is route to an on-prem model, with mask as the fallback. Enforce mode is turned on after a monitor period. Threat Console reviews captured requests: what the detectors found and which decision the gateway made. The sandbox runs a rule against examples before rollout. ## Industries - Banks and fintech. Card numbers, client passports, and deal terms are masked before an external model. A request that contains banking secrecy goes to a closed environment. The hit log can be used for 152-FZ reporting. - Retail and e-commerce. Phones, cards, and order contents are masked in the conversation with the model. The log shows which field was hidden and by which rule. - Public sector. Fragments of documents marked DSP or trade secret, including paraphrases, are not released to a public model and go to a model inside the environment. - Industry. Drawings, formulas, and project codes are checked against a dictionary and document fingerprints. A question about an open manual passes if it contains no restricted information. - IT teams. Secrets are stripped from the request. The model is not allowed to suggest a package that is not in the registry. Fragments of private code go to a model inside the environment. ## Pricing Prices are not published on the site. A demo request goes to sales@estesis.tech. - Start. A cloud gateway for a team of up to 50, connected in one day. PII and secret detectors, virtual keys with guardrails, a 30-day audit log. - Business. For companies with an information-security team. Everything in Start, policy inheritance from organization to project, Threat Console, monitor → enforce, 99.9% SLA, 24/7 support. - Enterprise. On-prem in a closed environment. Everything in Business, on-prem / Kubernetes deployment, a guard-LLM in the customer's environment, IDM/EDM document fingerprints, SIEM and DLP integration, 152-FZ compliance, a dedicated rollout engineer. ## Site data The personal-data operator for the site is ESTESIS LLC. The "Request a demo" form collects a name, a company name, and an email address so the company can reply. Visit statistics use Yandex Metrica, counter 112954567. The site does not set advertising cookies. Policy revision: 23 September 2026. ## Indexing The site is open to search and LLM crawlers in Russian and English. Sitemap with hreflang: https://llmguard.ru/sitemap.xml. Indexes: https://llmguard.ru/llms.txt and https://llmguard.ru/en/llms.txt. `ai_crawlers_welcome` lists DeepSeekBot, QwenBot, TongyiBot, AliyunBot, Baiduspider, Bytespider, GPTBot, ClaudeBot, PerplexityBot, Googlebot, Bingbot, and YandexBot. The list: https://llmguard.ru/.well-known/ai-crawlers.json. The `/api/` path is disallowed in robots.txt. ## What this description does not contain The site does not publish prices, a separate API reference, or a white paper in the open. The white paper is requested through the demo form.