AI data-loss prevention for Claude Enterprise
Stop sensitive data before it reaches the model.
EQUA Inference Hooks inspects every Claude Enterprise prompt in-line and returns an allow-or-deny verdict inside your 5-second budget. A leak is blocked before inference — not flagged after.
Anthropic sends the transcript to your hook before inference. A deny stops the prompt ever reaching Claude — and no raw values are stored.
How it works
A checkpoint between Claude and the model.
Before a prompt reaches inference, Anthropic forwards the transcript to your hook. It verifies the request, classifies the content, and answers allow or deny — all inside your organisation's verdict timeout.
Deny before inference
A block happens ahead of the model. There is no partial completion to claw back and no output to leak.
Inside your latency budget
Verdicts return within the organisation's 5-second timeout — typically well under — with fail-safe behaviour on timeout.
Nothing to leak later
Raw transcripts are never stored — only redacted, aggregated findings, encrypted at rest with 30-day retention.
Two ways to run it
Fully managed, or entirely your own.
The same detection engine and verdict contract, deployed the way your risk profile requires.
Hosted & managed by EQUA
We run it on Microsoft Azure in Europe. You point Claude at it and go.
- Per-customer isolated instance — no shared tenancy
- Custom domain and managed TLS
- Monitoring, upgrades and SLA handled for you
- EU data residency, Azure Europe regions
Your infrastructure, your control
One Docker image, activated with a code. A small Linux VM is enough.
- Single container — runs on a modest Linux VM
- Fully offline / air-gapped activation supported
- No prompt data ever leaves your network
- Built for defence and highly regulated environments
What it catches
20+ detectors across two precision tiers.
High-precision detectors validate structure with real checksums and known-token matchers. Context detectors read keywords and their surroundings. Both run on every prompt.
High-precision
Keyword & context
Operators can add custom rules for organisation-specific terms, code names and identifiers — and forward serious findings to Jira.
Security & compliance
Built to satisfy the people who review it.
A data-loss control has to be trustworthy with data itself. Here is exactly how EQUA handles yours.
EU data residency
Runs in Microsoft Azure European regions. Your data stays in Europe.
GDPR + signed DPA
GDPR-aligned processing under a Data Processing Agreement.
Redacted findings only
No raw values are persisted — findings record the category and location, not the secret.
Encryption at rest
Stored secrets and prompts are encrypted at rest.
30-day rolling retention
Aggregated findings expire on a 30-day rolling window, with export.
Signature-verified webhooks
Standard Webhooks signatures confirm every request originates from Anthropic.
Fail-safe behaviour
Configurable handling on timeout or error so the control never fails silently.
Admin SSO via Entra
Cloud admin access through Microsoft Entra (EasyAuth).
SOC 2 / ISO 27001 Roadmap
Formal certifications are on the roadmap; ask us for current status.
Pricing
Plans that scale from pilot to enterprise.
Pick a starting point below — we will tailor volume, detectors and terms to your organisation.
- EQUA Cloud, EU-hosted
- All 20+ core detectors
- Redacted findings dashboard
- Email support
- Everything in Starter, higher volume
- Custom detection rules
- Jira forwarding for serious findings
- Monitoring, custom domain & SLA
- Self-host + fully air-gapped activation
- SSO and priority SLA
- Custom detectors & onboarding
- DPA and security review
Get started
Create your EQUA account.
Tell us where Claude runs and how you want to deploy. We will verify your domain and set up your instance.
- No card required to start a trial.
- We verify your domain by email before provisioning.
- Choose EQUA Cloud or download the self-host image.
FAQ
Questions security teams ask us.
What data does EQUA actually store?
Never the raw transcript. When a detector fires, EQUA persists a redacted, aggregated finding — the category, severity and where it occurred — not the sensitive value itself. Stored secrets and prompts are encrypted at rest, and findings expire on a 30-day rolling retention window. You can export before they age out.
Will it slow down my users?
The hook returns a verdict inside your organisation's timeout, which is 5 seconds — and in practice classification completes well under that. Behaviour on timeout or error is configurable (fail-open or fail-closed), so the control degrades the way your policy requires rather than blocking work silently.
Cloud or self-host — which should we choose?
EQUA Cloud is the fastest path: we host and manage a per-customer isolated instance on Azure in Europe, with custom domain, monitoring, SLA and upgrades handled for you. Self-host is a single Docker image you run on your own infrastructure when data must never leave your network — including fully air-gapped sites. The detection engine and verdict contract are identical either way.
Can it run air-gapped or offline?
Yes. The self-host image supports fully offline activation with an activation code, so it can run in disconnected and air-gapped networks. This is the deployment defence and highly regulated customers use.
What happens if our licence lapses?
Protection stays on. A running hook keeps inspecting traffic and returning verdicts — data-loss protection is never switched off over a billing issue. What locks is the admin console: you cannot change configuration until the licence is renewed. Enforcement continues; administration pauses.
How do we connect it to Claude?
Point your Claude Enterprise organisation at your EQUA hook endpoint. Before inference, Anthropic sends the transcript to that endpoint; EQUA verifies the request signature, classifies the content, and returns allow or deny within the verdict budget. No change to how your users work.
How do you verify a request really came from Anthropic?
Every inbound webhook is signature-verified using the Standard Webhooks scheme before EQUA acts on it. An unsigned or badly-signed request is rejected — the classifier never runs on unverified input.
Where is our data processed?
On EQUA Cloud, in Microsoft Azure European regions — EU data residency, under GDPR and a signed Data Processing Agreement. On self-host, wherever you run the container; nothing leaves your network.
Ready to stop leaks before inference?
Start a free trial on EQUA Cloud, or download the self-host image and activate it offline.