Shadow AI Monitoring

Shadow AI refers to AI services used by employees without IT approval — such as uploading company data to personal ChatGPT accounts, using unvetted AI tools, or accessing AI via personal devices.

PII Firewall includes a built-in Shadow AI service registry that lets IT administrators and developers define which AI services are approved, monitored, or blocked across the organization.

How It Works

When a user accesses an AI service URL, PII Firewall checks it against the service registry:

Status	Action
approved	Allow — no warning shown
monitoring	Allow with warning — usage is logged
blocked	Block — access is denied

Default Service List

PII Firewall ships with a default registry of common AI services:

Service	Domain	Default Status
ChatGPT	chatgpt.com	✅ approved
Claude	claude.ai	✅ approved
Gemini	gemini.google.com	✅ approved
OpenAI API	platform.openai.com	✅ approved
Anthropic Console	console.anthropic.com	✅ approved
Copilot	copilot.microsoft.com	✅ approved
Perplexity	perplexity.ai	✅ approved
Hugging Chat	huggingface.co	⚠️ monitoring
NotebookLM	notebooklm.google.com	✅ approved
Mistral AI	mistral.ai	⚠️ monitoring
Character.AI	character.ai	🚫 blocked
Poe	poe.com	🚫 blocked
Groq	groq.com	✅ approved
OpenClaw	openclaw.ai	✅ approved
Gemma	ai.google.dev	✅ approved
Antigravity	antigravity.google	✅ approved

Managing the Registry via API

All registry management is done through the REST API. Authenticate with your admin API key.

Get All Services

GET /shadow-ai/services
Authorization: Bearer YOUR_API_KEY

Response:

{
  "services": [
    { "id": 1, "service_name": "ChatGPT", "domain": "chatgpt.com", "category": "approved", "is_blocked": false },
    ...
  ]
}

Update a Service's Status

PATCH /shadow-ai/services/:id
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "category": "blocked",
  "is_blocked": true
}

Field	Values	Description
category	approved | monitoring | blocked	Sets the policy level
is_blocked	true | false	Enables hard block

Add a Custom Service

POST /shadow-ai/services
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "service_name": "Acme AI",
  "domain": "acme-ai.example.com",
  "category": "blocked",
  "is_blocked": true
}

Check a URL

Validate whether a specific URL is covered by the registry:

POST /shadow-ai/check
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "url": "https://chat.openai.com/..."
}

Response:

{
  "detected": true,
  "hostname": "chatgpt.com",
  "service": { "service_name": "ChatGPT", "category": "approved" },
  "action": "allow"
}

Recommended Policy Setup

For Most Organizations

1. Keep approved for verified tools (ChatGPT, Claude, Gemini via PII Firewall)
2. Set monitoring for grey-area tools used informally
3. Set blocked for tools that handle data in ways that violate your policy

For Strict Compliance Environments

Block all external AI services by default, then approve on a per-tool basis:

# Block all monitoring-category services
for id in 4 5 8 11 12; do
  curl -X PATCH https://pii-firewallproxy-production.up.railway.app/shadow-ai/services/$id \
    -H "Authorization: Bearer YOUR_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"category":"blocked","is_blocked":true}'
done

Enterprise: Persistent Configuration

By default, the registry resets on server restart (in-memory store). Enterprise plans support persistent storage via Supabase, allowing policy changes to survive deployments.

Contact enterprise@piifirewall.com to enable persistent Shadow AI configuration.

Next Steps

• REST API Reference
• Privacy & Security