PromptGuard: Product, team and how it was built
PromptGuard (Security gateway that checks prompts before they reach an AI model, United Kingdom): Live with paid plans, November 2026. Evidence grade E: no revenue figure was checked. Team: Founder Arouba Zubair; 2 directors on the UK company register from 4 September 2026; headcount not published, 2 open engineering roles. Launched November 2025; still running.Added 5 November 2026
- Outcome
- Live with paid plans, November 2026
- Evidence
- E no revenue figure was checked
- Launch
- November 2025
- Status
- Still running
- Team
- Founder Arouba Zubair; 2 directors on the UK company register from 4 September 2026; headcount not published, 2 open engineering roles
- Outside funding
- None found in the sources read
- Main channel
- Not stated
What is not verified
No revenue figure and no user or customer count was found. We looked for a payment-processor profile, a founder interview with numbers, a funding announcement and company accounts; PG Tech Ltd was registered on 4 September 2026, so its first accounts are not due yet. A reader could look for those accounts on the UK register or for customer case studies. This story is grade E: the business is real and its product, price and customers are described from public pages, but no revenue figure was checked. Aiolum shows it as an idea worth studying, not as proof that it makes money.
PromptGuard is an LLM firewall: a program that inspects the text sent to and from a large language model and blocks or changes it by rules, as a network firewall does for network traffic. Its main target is prompt injection, an attack in which text written by a user or hidden in a document tells the model to ignore its instructions, for example to reveal its system prompt or to call a tool it should not call. The company's blog says it shipped fourteen detectors at launch in November 2025, built from fixed text patterns, a group of machine-learning classifiers and a language-model check.
Arouba Zubair pitched it at the Web Summit Qatar PITCH competition, and the event's write-up of 4 February 2026 lists PromptGuard among the standout startups. The company PG Tech Ltd was registered in England and Wales on 4 September 2026 with two directors. The pricing page sells plans from a free tier to an enterprise contract.
No revenue or user figure was found, so this story has evidence grade E. What is checked is that the product is live, sold with published prices, and run by a registered company with a named founder.
How much revenue does PromptGuard make?
Each row shows the evidence grade and the source numbers from the list at the end of this page. The grades are explained in How Aiolum verifies.
| Fact | Value | Grade | How we know | Sources |
|---|---|---|---|---|
| Status, November 2026 | live, with a free tier and three paid plans | C | Pricing page read 5 November 2026: Free, Developer US$20 a month, Team US$24 per seat a month, Enterprise from US$50 per seat a month billed yearly. | [2] |
| Revenue | not published | E | No figure on the site, in the event write-up or in the company register. The company was registered in September 2026, so no accounts are due yet. | [1, 5, 6] |
| Launch | November 2025 | C | Blog post "Why We Built a Transparent AI Firewall", dated 1 November 2025 and tagged Product Launch: "At launch we shipped fourteen specialized detectors". | [4] |
| Company | PG Tech Ltd, number 17437377, incorporated 4 September 2026 | B | UK company register. Status active. Business codes 62012 (software development) and 62020 (IT consultancy). The site footer says PromptGuard is the trading name of PG Tech Ltd. | [6, 3] |
| Founder | Arouba Zubair | C | Named as the person behind PromptGuard in the Web Summit Qatar PITCH 2026 write-up; also one of the two directors on the register. | [5, 7] |
| Team | 2 directors; headcount not published | B | The register lists 2 officers, both appointed 4 September 2026. The careers page lists 2 open full-time roles: Senior Security Engineer and Full-Stack Developer. | [7, 8] |
| Event | standout startup at Web Summit Qatar PITCH 2026 | C | Write-up dated 4 February 2026: "PromptGuard is the firewall for AI prompts" that "sits in front of the LLM, not inside it". | [5] |
| Detectors | 15 (10 always on, 5 optional) in 6 layers | C | About page. The launch post listed 14 in November 2025. | [3, 4] |
| Published detection benchmark | F1 score 0.887 on 2,369 samples; 271 of 1,378 attacks missed | C | About page. The company's own run on 8 datasets, 3 of them its own; precision 99.1%, recall 80.3% at the default setting. | [3] |
| Model providers supported | 12 adapters, including OpenAI, Anthropic, Gemini, Azure, Bedrock and Mistral | C | About and providers pages. Self-hosted models through Ollama or vLLM are also supported. | [3, 9] |
| Outside funding | none found | E | No round is named on the site, in the event write-up or on the register. | [1, 5, 6] |
| Time from launch to the status date | 12 months | calc | Calculated: November 2025 to November 2026. | [2, 4] |
How to read this table: a grade C value is the company's own statement on its site. A grade B value was read in the UK company register. A "calc" value was computed on this page. No revenue figure exists.
| Plan | Per month, billed yearly (US$) | Per month, billed monthly (US$) | Limit |
|---|---|---|---|
| Free | 0 | 0 | US$5 of usage a month, 1 API key, 24-hour log retention |
| Developer | 20 | US$20 of usage a month, unlimited API keys, 30-day logs | |
| Team | 24 per seat | US$8 of usage credit per seat, pooled; browser extension and desktop agent | |
| Enterprise | from 50 per seat | billed yearly, from 25 seats; air-gapped deployment |
The page has a Monthly and an Annual switch, but the text that loads without script shows only the monthly prices; the yearly column is left empty except for Enterprise, which is sold only per year. Each plan includes an amount of usage; above it, the Developer plan is metered up to a spend cap and the Free plan pauses.
When did PromptGuard launch, and how did it grow?
From a launch post in November 2025 to a registered UK company with paid plans in about twelve months. Each entry carries its grade.
- 1 November 2025CLaunch post "Why We Built a Transparent AI Firewall": a proxy between the app and the model provider, fourteen detectors, and three decisions (allow, block, redact) instead of two. [4]
- 4 February 2026CArouba Zubair pitches PromptGuard at Web Summit Qatar PITCH 2026; the event write-up lists it among the standout startups. [5]
- 4 September 2026BPG Tech Ltd is incorporated in England and Wales with two directors. [6, 7]
- November 2026CThe site sells Free, Developer, Team and Enterprise plans, a Shadow AI agent for staff devices, and lists two open engineering roles. [2, 8, 10]
Why did PromptGuard work?
Four causes, in the order they mattered. Each one is a reusable lesson.
One URL change
A developer points the AI client library at PromptGuard's address instead of the provider's. The request keeps the provider's format, so no other code changes, and the check runs before the model sees the text.
Cheap checks first
The launch post says most requests are judged by fixed text patterns in under 10 milliseconds, and only uncertain ones go on to the machine-learning classifiers, which take on the order of 100 milliseconds. That keeps the added delay low for normal traffic.
Redact instead of block
When a request is legitimate but carries personal data such as a US Social Security number, the gateway replaces the value with a token and forwards the rest, so the user still gets an answer.
Published limits
The about page prints the miss rate next to the detection score and marks which benchmark datasets the company wrote itself. Security buyers are told what the product does not catch.
How it was built
These details come from the company's own pages. They are grade C. [3, 4, 10]
- A proxy service that forwards requests to 12 model-provider adapters; the same engine runs in the company's cloud, in a customer's own cloud account, or fully offline.
- Detection in layers: text patterns, a group of machine-learning classifiers with calibrated confidence scores, and a language-model check for jailbreak attempts.
- Personal data detection for 39 or more data types with checksum tests, plus detectors for API keys, malware commands, unsafe URLs and injected instructions in agent tool calls.
- Four ways to integrate: patching the AI client library, a scan-only API, the HTTP proxy, and a GitHub app that finds unprotected model calls and opens fix pull requests.
- Each decision is logged with its reason and can be exported with HMAC-SHA256 signatures, so an auditor can check that the log was not changed.
- A browser extension and macOS and Windows agent for staff devices, sold in the Team plan.
Tools named in the sources
Each one opens its page in the Tools tab, with every story that uses it.
Who tried this before PromptGuard, and why did they fail?
Three security startups in our database of failed startups sold a single protection layer to companies and lost to larger security vendors. The values below are from that database and are not independently verified.
ThinAir
The promiseReal-time data loss prevention and insider-threat detection.
Why it diedCould not stand out in a crowded security market against vendors with more resources and reach.
Metapacket
The promiseCloud-based packet analysis and threat detection without on-site hardware.
Why it diedLarger vendors such as Palo Alto Networks and Cisco sold broader, integrated security, and the cloud processing cost was high.
Toopher
The promiseTwo-factor login that verifies users by their location.
Why it diedBought by Salesforce in 2015 and later shut down; buyers moved to broader authentication products.
The failed startups come from our database of 1,749 dead startups, retold here in our own words. Its entries are AI-assisted summaries of public sources, so these cards carry no evidence grade.
What changed
All three sold one security layer to enterprises and were outsold by large vendors with a full product line. PromptGuard faces the same risk: the model providers and the cloud platforms, for example Amazon Bedrock Guardrails, which the site compares itself with, sell their own filters.
What is different is the place in the stack. Every AI request already passes through one address, so a gateway can be added in minutes and sold by usage, with a free tier, to developers who would never start an enterprise security purchase. The open questions are whether that self-serve start turns into paid seats, and how long a two-director company can keep its detectors ahead of new attacks.
Can one person copy PromptGuard now?
The product shape, yes. The trust it needs, slowly.
A usage-priced gateway in front of an AI provider can be built by a small team with open-weight classifiers and pattern lists. Selling security, however, depends on audits, benchmarks and deployment options that take time to build, and the sources show no customers yet.
Where it is still open: Narrow checks for one kind of AI traffic: agent tool calls, code assistants, or customer-support bots in one regulated industry.
- 1Put the product in the request path with one URL change, so trying it costs the developer nothing.
- 2Give a free monthly usage amount and meter the rest.
- 3Publish benchmark results with the misses and the datasets named.
- 4Offer self-hosted and offline versions for buyers in regulated industries.
What could go wrong for PromptGuard?
The risks are the mirror image of the causes above.
What is not verified
No revenue figure and no user or customer count was found. We looked for a payment-processor profile, a founder interview with numbers, a funding announcement and company accounts; PG Tech Ltd was registered on 4 September 2026, so its first accounts are not due yet. A reader could look for those accounts on the UK register or for customer case studies.
Competition
The site has comparison pages for Lakera, Amazon Bedrock Guardrails, LiteLLM and Portkey, and model providers sell their own safety filters. On this site, LLM Gateway and Metorial sell gateways in front of AI models, but neither is mainly a security filter.
Depends on model providers
The product forwards traffic to providers such as OpenAI, Anthropic and Gemini, and the launch post says image checks use Cloud Vision or Azure Content Safety and one check uses an open-weight safety classifier. Changes in provider APIs or built-in safety features affect what customers need from it.
Staff monitoring in the Team plan
The Shadow AI page says companies can "Enroll every employee's device" and "See all AI activity, your apps and your people, in one dashboard, attributed per user", and the pricing page lists a "Per-employee usage rollup". This is a data-loss-prevention feature for company devices; the pages read do not describe how employees are told about it.
Benchmark is the company's own
The about page says three of the eight benchmark datasets are the company's own, and that the evasion test suite "is ours". No outside party has published a test of the product in the sources read.
Sources
The grade next to each source is the best grade that the source can support. "Read in full" means that the text of the page was downloaded and the numbers were checked in it.
- C PromptGuard home page, read 5 November 2026Read in full. Product description and the fail-open or fail-closed option.
- C PromptGuard pricing page, read 5 November 2026Read in full. Source for the plans, prices, usage amounts and the per-employee usage rollup.
- C PromptGuard about page: Architecture, Evidence, Independence, read 5 November 2026Read in full. Source for the detector count, benchmark figures, deployment modes, provider adapters and the company footer.
- C PromptGuard blog, 1 November 2025: Why We Built a Transparent AI FirewallRead in full. Launch post. Source for the launch date, the fourteen detectors and the layered detection design.
- C UpNext, 4 February 2026: Web Summit Qatar PITCH 2026Read the section on PromptGuard. Names Arouba Zubair and quotes the pitch.
- B Companies House: PG TECH LTD overview, company number 17437377Read in full. Incorporation date, status, registered office and business codes.
- B Companies House: PG TECH LTD officersRead in full. Two directors, both appointed 4 September 2026.
- C PromptGuard careers page, read 5 November 2026Read in full. Two open full-time engineering roles.
- C PromptGuard providers page, read 5 November 2026Read the opening sections. Twelve adapters and self-hosted routing.
- C PromptGuard Shadow AI page, read 5 November 2026Read in full. Browser extension, desktop agent and per-user dashboard.
- C Database of failed startups, local exportLocal export. AI-written summaries, not independently verified. Source for the failed predecessors.
Run this company? Send corrections or a verified figure to aiolum@livyden.com