# PromptGuard Aiolum story: https://aiolum.com/story/promptguard/ · added 2026-11-05 · updated 2026-11-05 **In short.** PromptGuard (Security gateway that checks prompts before they reach an AI model, United Kingdom): Live with paid plans, November 2026. Evidence grade E: no revenue figure was checked. Team: Founder Arouba Zubair; 2 directors on the UK company register from 4 September 2026; headcount not published, 2 open engineering roles. Launched November 2025; still running. Security gateway that checks prompts before they reach an AI model · United Kingdom · AI-native · team of 2 to 10 · still running · group: Tools for using AI models - Outcome: Live with paid plans, November 2026 (evidence grade of the headline number: E; no revenue figure) - Launch: November 2025; months from launch to the outcome: 12 - Team: Founder Arouba Zubair; 2 directors on the UK company register from 4 September 2026; headcount not published, 2 open engineering roles - Outside funding: None found in the sources read - Main factor: Inline security for AI requests - Meters, 1 to 4: evidence strength 1, copyable pattern 2, capital needed 1 - Tags: AI-native, Small team, Running, B2B, Cybersecurity Links: - Visit promptguard.co: https://promptguard.co/ **The product.** A gateway that sits between an application and its AI model provider and checks every request before it is sent: it blocks prompt injection and leaked secrets, replaces personal data with tokens, and logs each decision with its reason. A browser extension and a desktop agent do the same for the AI tools that a company's staff use. **Why it worked.** Companies that put large language models into their products, or let staff use ChatGPT and similar tools, send their data and their users' text to an outside model. PromptGuard sells a check in front of that model that a developer adds by changing one URL, with a free tier and published benchmark numbers that include the attacks it misses. Evidence grades: A = disclosed by a public company, a filing or a payment processor, or verified by one; B = two or more independent reports agree, or a journalist confirmed it; C = a founder claim that no one else verified; D = reported, not verified: one founder claim or a third-party estimate with no second source; E = no revenue figure found, so the headline is a non-money fact and the other facts carry their own grades; calc = computed on this page from graded facts. ## Summary PromptGuard is an LLM firewall: a program that inspects the text sent to and from a large language model and blocks or changes it by rules, as a network firewall does for network traffic. Its main target is prompt injection, an attack in which text written by a user or hidden in a document tells the model to ignore its instructions, for example to reveal its system prompt or to call a tool it should not call. The company's blog says it shipped fourteen detectors at launch in November 2025, built from fixed text patterns, a group of machine-learning classifiers and a language-model check. Arouba Zubair pitched it at the Web Summit Qatar PITCH competition, and the event's write-up of 4 February 2026 lists PromptGuard among the standout startups. The company PG Tech Ltd was registered in England and Wales on 4 September 2026 with two directors. The pricing page sells plans from a free tier to an enterprise contract. No revenue or user figure was found, so this story has evidence grade E. What is checked is that the product is live, sold with published prices, and run by a registered company with a named founder. ## Pricing PromptGuard prices from the company's pricing page, read 5 November 2026 (grade C) | Plan | Per month, billed yearly (US$) | Per month, billed monthly (US$) | Limit | |---|---|---|---| | Free | 0 | 0 | US$5 of usage a month, 1 API key, 24-hour log retention | | Developer | | 20 | US$20 of usage a month, unlimited API keys, 30-day logs | | Team | | 24 per seat | US$8 of usage credit per seat, pooled; browser extension and desktop agent | | Enterprise | from 50 per seat | | billed yearly, from 25 seats; air-gapped deployment | The page has a Monthly and an Annual switch, but the text that loads without script shows only the monthly prices; the yearly column is left empty except for Enterprise, which is sold only per year. Each plan includes an amount of usage; above it, the Developer plan is metered up to a spend cap and the Free plan pauses. ## How much revenue does PromptGuard make? The numbers, graded A UK AI-security gateway with a free tier and paid plans, launched in November 2025, with no published revenue or user count | Fact | Value | Grade | Note | Sources | |---|---|---|---|---| | Status, November 2026 | live, with a free tier and three paid plans | C | Pricing page read 5 November 2026: Free, Developer US$20 a month, Team US$24 per seat a month, Enterprise from US$50 per seat a month billed yearly. | [2] | | Revenue | not published | E | No figure on the site, in the event write-up or in the company register. The company was registered in September 2026, so no accounts are due yet. | [1, 5, 6] | | Launch | November 2025 | C | Blog post "Why We Built a Transparent AI Firewall", dated 1 November 2025 and tagged Product Launch: "At launch we shipped fourteen specialized detectors". | [4] | | Company | PG Tech Ltd, number 17437377, incorporated 4 September 2026 | B | UK company register. Status active. Business codes 62012 (software development) and 62020 (IT consultancy). The site footer says PromptGuard is the trading name of PG Tech Ltd. | [6, 3] | | Founder | Arouba Zubair | C | Named as the person behind PromptGuard in the Web Summit Qatar PITCH 2026 write-up; also one of the two directors on the register. | [5, 7] | | Team | 2 directors; headcount not published | B | The register lists 2 officers, both appointed 4 September 2026. The careers page lists 2 open full-time roles: Senior Security Engineer and Full-Stack Developer. | [7, 8] | | Event | standout startup at Web Summit Qatar PITCH 2026 | C | Write-up dated 4 February 2026: "PromptGuard is the firewall for AI prompts" that "sits in front of the LLM, not inside it". | [5] | | Detectors | 15 (10 always on, 5 optional) in 6 layers | C | About page. The launch post listed 14 in November 2025. | [3, 4] | | Published detection benchmark | F1 score 0.887 on 2,369 samples; 271 of 1,378 attacks missed | C | About page. The company's own run on 8 datasets, 3 of them its own; precision 99.1%, recall 80.3% at the default setting. | [3] | | Model providers supported | 12 adapters, including OpenAI, Anthropic, Gemini, Azure, Bedrock and Mistral | C | About and providers pages. Self-hosted models through Ollama or vLLM are also supported. | [3, 9] | | Outside funding | none found | E | No round is named on the site, in the event write-up or on the register. | [1, 5, 6] | | Time from launch to the status date | 12 months | calc | Calculated: November 2025 to November 2026. | [2, 4] | How to read this table: a grade C value is the company's own statement on its site. A grade B value was read in the UK company register. A "calc" value was computed on this page. No revenue figure exists. ## When did PromptGuard launch, and how did it grow? Timeline From a launch post in November 2025 to a registered UK company with paid plans in about twelve months. Each entry carries its grade. - **1 November 2025** (grade C [4]): Launch post "Why We Built a Transparent AI Firewall": a proxy between the app and the model provider, fourteen detectors, and three decisions (allow, block, redact) instead of two. - **4 February 2026** (grade C [5]): Arouba Zubair pitches PromptGuard at Web Summit Qatar PITCH 2026; the event write-up lists it among the standout startups. - **4 September 2026** (grade B [6, 7]): PG Tech Ltd is incorporated in England and Wales with two directors. - **November 2026** (grade C [2, 8, 10]): The site sells Free, Developer, Team and Enterprise plans, a Shadow AI agent for staff devices, and lists two open engineering roles. ## Why did PromptGuard work? ### One URL change A developer points the AI client library at PromptGuard's address instead of the provider's. The request keeps the provider's format, so no other code changes, and the check runs before the model sees the text. ### Cheap checks first The launch post says most requests are judged by fixed text patterns in under 10 milliseconds, and only uncertain ones go on to the machine-learning classifiers, which take on the order of 100 milliseconds. That keeps the added delay low for normal traffic. ### Redact instead of block When a request is legitimate but carries personal data such as a US Social Security number, the gateway replaces the value with a token and forwards the rest, so the user still gets an answer. ### Published limits The about page prints the miss rate next to the detection score and marks which benchmark datasets the company wrote itself. Security buyers are told what the product does not catch. ## How it was built These details come from the company's own pages. They are grade C. - A proxy service that forwards requests to 12 model-provider adapters; the same engine runs in the company's cloud, in a customer's own cloud account, or fully offline. - Detection in layers: text patterns, a group of machine-learning classifiers with calibrated confidence scores, and a language-model check for jailbreak attempts. - Personal data detection for 39 or more data types with checksum tests, plus detectors for API keys, malware commands, unsafe URLs and injected instructions in agent tool calls. - Four ways to integrate: patching the AI client library, a scan-only API, the HTTP proxy, and a GitHub app that finds unprotected model calls and opens fix pull requests. - Each decision is logged with its reason and can be exported with HMAC-SHA256 signatures, so an auditor can check that the log was not changed. - A browser extension and macOS and Windows agent for staff devices, sold in the Team plan. Sources: [3, 4, 10] ## Who tried this before PromptGuard, and why did they fail? Three security startups in our database of failed startups sold a single protection layer to companies and lost to larger security vendors. The values below are from that database and are not independently verified. The failed startups come from our database of dead startups, retold here in our own words; Its entries are AI-assisted summaries of public sources, so they carry no evidence grade. ### ThinAir (2015 to 2018; funding US$4.5M; cause: Competition) - Promise: Real-time data loss prevention and insider-threat detection. - Why it died: Could not stand out in a crowded security market against vendors with more resources and reach. - Record: ### Metapacket (2016 to 2019; funding US$120K; cause: Competition) - Promise: Cloud-based packet analysis and threat detection without on-site hardware. - Why it died: Larger vendors such as Palo Alto Networks and Cisco sold broader, integrated security, and the cloud processing cost was high. - Record: ### Toopher (2011 to 2018; funding US$3M; cause: Competition) - Promise: Two-factor login that verifies users by their location. - Why it died: Bought by Salesforce in 2015 and later shut down; buyers moved to broader authentication products. - Record: ## What changed All three sold one security layer to enterprises and were outsold by large vendors with a full product line. PromptGuard faces the same risk: the model providers and the cloud platforms, for example Amazon Bedrock Guardrails, which the site compares itself with, sell their own filters. What is different is the place in the stack. Every AI request already passes through one address, so a gateway can be added in minutes and sold by usage, with a free tier, to developers who would never start an enterprise security purchase. The open questions are whether that self-serve start turns into paid seats, and how long a two-director company can keep its detectors ahead of new attacks. ## Can one person copy PromptGuard now? **Verdict: The product shape, yes. The trust it needs, slowly.** A usage-priced gateway in front of an AI provider can be built by a small team with open-weight classifiers and pattern lists. Selling security, however, depends on audits, benchmarks and deployment options that take time to build, and the sources show no customers yet. 1. Put the product in the request path with one URL change, so trying it costs the developer nothing. 2. Give a free monthly usage amount and meter the rest. 3. Publish benchmark results with the misses and the datasets named. 4. Offer self-hosted and offline versions for buyers in regulated industries. **What is still open.** Narrow checks for one kind of AI traffic: agent tool calls, code assistants, or customer-support bots in one regulated industry. ## What could go wrong for PromptGuard? - **What is not verified.** No revenue figure and no user or customer count was found. We looked for a payment-processor profile, a founder interview with numbers, a funding announcement and company accounts; PG Tech Ltd was registered on 4 September 2026, so its first accounts are not due yet. A reader could look for those accounts on the UK register or for customer case studies. - **Competition.** The site has comparison pages for Lakera, Amazon Bedrock Guardrails, LiteLLM and Portkey, and model providers sell their own safety filters. On this site, LLM Gateway and Metorial sell gateways in front of AI models, but neither is mainly a security filter. - **Depends on model providers.** The product forwards traffic to providers such as OpenAI, Anthropic and Gemini, and the launch post says image checks use Cloud Vision or Azure Content Safety and one check uses an open-weight safety classifier. Changes in provider APIs or built-in safety features affect what customers need from it. - **Staff monitoring in the Team plan.** The Shadow AI page says companies can "Enroll every employee's device" and "See all AI activity, your apps and your people, in one dashboard, attributed per user", and the pricing page lists a "Per-employee usage rollup". This is a data-loss-prevention feature for company devices; the pages read do not describe how employees are told about it. - **Benchmark is the company's own.** The about page says three of the eight benchmark datasets are the company's own, and that the evasion test suite "is ours". No outside party has published a test of the product in the sources read. ## Sources 1. PromptGuard home page, read 5 November 2026 — https://promptguard.co/ (grade C). Read in full. Product description and the fail-open or fail-closed option. 2. PromptGuard pricing page, read 5 November 2026 — https://promptguard.co/pricing (grade C). Read in full. Source for the plans, prices, usage amounts and the per-employee usage rollup. 3. PromptGuard about page: Architecture, Evidence, Independence, read 5 November 2026 — https://promptguard.co/about (grade C). Read in full. Source for the detector count, benchmark figures, deployment modes, provider adapters and the company footer. 4. PromptGuard blog, 1 November 2025: Why We Built a Transparent AI Firewall — https://promptguard.co/blog/introducing-promptguard-ai-security (grade C). Read in full. Launch post. Source for the launch date, the fourteen detectors and the layered detection design. 5. UpNext, 4 February 2026: Web Summit Qatar PITCH 2026 — https://upnext.world/web-summit-qatar-pitch-2026-whats-upnext/ (grade C). Read the section on PromptGuard. Names Arouba Zubair and quotes the pitch. 6. Companies House: PG TECH LTD overview, company number 17437377 — https://find-and-update.company-information.service.gov.uk/company/17437377 (grade B). Read in full. Incorporation date, status, registered office and business codes. 7. Companies House: PG TECH LTD officers — https://find-and-update.company-information.service.gov.uk/company/17437377/officers (grade B). Read in full. Two directors, both appointed 4 September 2026. 8. PromptGuard careers page, read 5 November 2026 — https://promptguard.co/careers (grade C). Read in full. Two open full-time engineering roles. 9. PromptGuard providers page, read 5 November 2026 — https://promptguard.co/features/providers (grade C). Read the opening sections. Twelve adapters and self-hosted routing. 10. PromptGuard Shadow AI page, read 5 November 2026 — https://promptguard.co/shadow-ai (grade C). Read in full. Browser extension, desktop agent and per-user dashboard. 11. Database of failed startups, local export — /method/#dead (grade C). Local export. AI-written summaries, not independently verified. Source for the failed predecessors. Contact: aiolum@livyden.com. Run PromptGuard? Send corrections or a verified figure to aiolum@livyden.com (subject: Correction: PromptGuard).