Cyberrunner
Inspect every prompt before it reaches the model.
Cyberrunner is EQUA's security server for Claude Enterprise inference hooks — ESAS, the EQUA Security Server. Anthropic sends each prompt to it before inference; it inspects the content and returns an allow or deny verdict within the organisation's verdict timeout (5 seconds by default). A denied prompt is not sent to the model.
Anthropic sends the transcript to your hook before inference. A deny stops the prompt ever reaching Claude — and no raw values are stored.
Watch
A short overview.
How it works
How a prompt is checked before inference.
Before a prompt reaches inference, Anthropic forwards the transcript to your hook. It verifies the request, classifies the content, and answers allow or deny — all inside your organisation's verdict timeout.
Cyberrunner (ESAS) implements Anthropic's inference-hooks contract. See Anthropic's documentation: Inference hooks and Develop an integration.
-
01
A prompt is written
Someone pastes a customer record — a card number, a CPR — into Claude Enterprise.
-
02
Held before inference
Before the model runs, Anthropic sends the transcript to your hook — ESAS, the EQUA Security Server.
-
03
ESAS inspects it
≤ 5s verdict- Verify signature. Standard Webhooks — proof the request came from Anthropic.
- Classify. 20+ sensitive-data categories, checksum and context detectors.
- Verdict. Allow or deny, in under your 5-second budget.
The model runs
Clean prompts continue to Claude, untouched — no change to how your people work.
Blocked before inference
A prompt carrying sensitive data never reaches the model. Nothing to claw back, nothing to leak.
Deny before inference
A block happens ahead of the model. There is no partial completion to claw back and no output to leak.
Inside your latency budget
Verdicts return within the organisation's 5-second timeout — typically well under — with fail-safe behaviour on timeout.
Nothing to leak later
Raw transcripts are never stored — only redacted, aggregated findings, encrypted at rest with 30-day retention.
Two ways to run it
Managed by EQUA, or self-hosted.
The same detection engine and verdict contract, deployed the way your risk profile requires.
Hosted & managed by EQUA
We run it on Microsoft Azure in Europe. You point Claude at it and go.
- Per-customer isolated instance — no shared tenancy
- Custom domain and managed TLS
- Monitoring, upgrades and SLA handled for you
- EU data residency, Azure Europe regions
Your infrastructure, your control
One Docker image, activated with a code. A small Linux VM is enough.
- Single container — runs on a modest Linux VM
- Fully offline / air-gapped activation supported
- No prompt data ever leaves your network
- Built for defence and highly regulated environments
What it catches
20+ detectors across two precision tiers.
High-precision detectors validate structure with real checksums and known-token matchers. Context detectors read keywords and their surroundings. Both run on every prompt.
High-precision
Keyword & context
Operators can add custom rules for organisation-specific terms, code names and identifiers — and forward serious findings to Jira.
Security & compliance
How EQUA handles your data.
A data-loss control has to be trustworthy with data itself. Here is exactly how EQUA handles yours.
EU data residency
Runs in Microsoft Azure European regions. Your data stays in Europe.
GDPR + signed DPA
GDPR-aligned processing under a Data Processing Agreement.
Redacted findings only
No raw values are persisted — findings record the category and location, not the secret.
Encryption at rest
Stored secrets and prompts are encrypted at rest.
30-day rolling retention
Aggregated findings expire on a 30-day rolling window, with export.
Signature-verified webhooks
Standard Webhooks signatures confirm every request originates from Anthropic.
Fail-safe behaviour
Configurable handling on timeout or error so the control never fails silently.
Admin SSO via Entra
Cloud admin access through Microsoft Entra (EasyAuth).
SOC 2 / ISO 27001 Roadmap
Formal certifications are on the roadmap; ask us for current status.
Pricing
Plans and pricing.
Priced per month by prompt volume. Every plan runs EU-hosted with the full detector set — you scale governance as adoption grows.
| Plan | Starter For a first pilot on a single Claude Enterprise organisation. | Business Most popular For teams putting Claude into daily, sensitive workflows. | Enterprise For large-scale, regulated and air-gapped environments. |
|---|---|---|---|
| Price | DKK 2,500per month | DKK 15,000per month | DKK 100,000per month |
| Included prompts / month | 10,000 | 100,000 | 1M |
| Typical scale | ~100–200 users, moderate adoption | ~1,000 employees at normal adoption | ~10,000 employees |
| Overage (per extra prompt) | DKK 0.20 / prompt | DKK 0.12 / prompt | DKK 0.08 / prompt |
| EU-hosted (Azure Europe) | Included | Included | Included |
| All 20+ detectors | Included | Included | Included |
| Monitoring, audit & governance | Basic monitoring | Full audit & logging | Advanced governance |
| Policy enforcement | Not included | Included | Included |
| Analytics | Not included | Included | Included |
| API & integrations | Not included | Included | Custom integrations |
| SSO / SCIM | Not included | Not included | Included |
| SLA | Not included | Not included | Included |
| Support | Standard support | Standard support | Dedicated support |
| Get started | Get started | Talk to us |
Business at DKK 15,000/mo is ~DKK 15 per employee per month for 1,000 employees — governance across your organisation's Claude usage.
Prices in DKK, excl. VAT.
Get started
Create your EQUA account.
Tell us where Claude runs and how you want to deploy. We will verify your domain and set up your instance.
- Your plan is binding once you sign the order form and we provision your instance.
- We verify your domain by email before provisioning.
- Choose EQUA Cloud or download the self-host image.
FAQ
Questions security teams ask us.
What data does EQUA actually store?
Never the raw transcript. When a detector fires, EQUA persists a redacted, aggregated finding — the category, severity and where it occurred — not the sensitive value itself. Stored secrets and prompts are encrypted at rest, and findings expire on a 30-day rolling retention window. You can export before they age out.
Will it slow down my users?
The hook returns a verdict inside your organisation's timeout, which is 5 seconds — and in practice classification completes well under that. Behaviour on timeout or error is configurable (fail-open or fail-closed), so the control degrades the way your policy requires rather than blocking work silently.
Cloud or self-host — which should we choose?
EQUA Cloud is the fastest path: we host and manage a per-customer isolated instance on Azure in Europe, with custom domain, monitoring, SLA and upgrades handled for you. Self-host is a single Docker image you run on your own infrastructure when data must never leave your network — including fully air-gapped sites. The detection engine and verdict contract are identical either way.
Can it run air-gapped or offline?
Yes. The self-host image supports fully offline activation with an activation code, so it can run in disconnected and air-gapped networks. This is the deployment defence and highly regulated customers use.
What happens if our licence lapses?
Protection stays on. A running hook keeps inspecting traffic and returning verdicts — data-loss protection is never switched off over a billing issue. What locks is the admin console: you cannot change configuration until the licence is renewed. Enforcement continues; administration pauses.
How do we connect it to Claude?
Point your Claude Enterprise organisation at your EQUA hook endpoint. Before inference, Anthropic sends the transcript to that endpoint; EQUA verifies the request signature, classifies the content, and returns allow or deny within the verdict budget. No change to how your users work.
How do you verify a request really came from Anthropic?
Every inbound webhook is signature-verified using the Standard Webhooks scheme before EQUA acts on it. An unsigned or badly-signed request is rejected — the classifier never runs on unverified input.
Where is our data processed?
On EQUA Cloud, in Microsoft Azure European regions — EU data residency, under GDPR and a signed Data Processing Agreement. On self-host, wherever you run the container; nothing leaves your network.