Nullgen AI BlockerTrust Center
Architecture and data flow
Three components, one small backend, and a clear line between what stays on the device and what reaches Nullgen.
Components
Browser extension
Runs in Chrome, Edge, Firefox, and Safari. Classifies prompt fields on the device and blocks typing and pasting into them. Works with no account. When enrolled in Pro, it fetches your policies and sends access requests.
iPhone, iPad, and Android app
Blocks known AI apps and websites by answering their lookups on the device. Appears as a VPN configuration on iOS and a VPN connection on Android because that is how each system lets an app filter; no traffic is routed to Nullgen. Blocking works without an account; linking Pro adds your policies.
Dashboard and API
Where administrators manage people, devices, policies, and access requests. Runs on AWS in the United States and is the only part of Nullgen that stores customer data.
Data flow
What each segments of Nullgen sends and receives. Arrows point the way the data travels.
On the device
- Detection updates
- Policies and access requests
Nullgen cloud
- Known AI destinations
- Policies and access requests
- Account, policy, and device records
Never sent: prompt text, keystrokes, browsing history, DNS lookups
What leaves the device
| Component | What is sent | Why | Where it goes |
|---|---|---|---|
| Browser extension | A request for detection updates | Keep blocking current without a store update | Nullgen content delivery (cdn.nullgen.ai) |
| Browser extension (Pro) | Device identity, policy fetches, and access requests: the AI service, the duration, and an optional justification | Apply your policies and route requests to approvers | Nullgen API |
| Browser extension | Crash and error reports: stack traces, version, browser environment | Reliability | Sentry |
| iPhone, iPad, and Android app | A request for the list of known AI destinations and their logos | Keep blocking current | Nullgen API |
| iPhone, iPad, and Android app (Pro) | Device credentials, policy fetches, organization settings, and access requests | Apply your policies and route requests to approvers | Nullgen API |
| iPhone, iPad, and Android app | Crash and error reports: stack traces, version, operating system. On iOS the blocking component sends none; on Android it runs inside the app and its reports exclude lookups too | Reliability | Sentry |
| Dashboard | Administrator sign-in, organization details, people, device names, policies, and approvals | Operate your account | Nullgen API; Amazon Cognito for sign-in |
| Dashboard | Billing details you enter at checkout | Payment | Stripe, Apple, or Google Play; Nullgen receives identifiers only |
What Nullgen never receives
- The text anyone types or pastes into an AI prompt or any other field
- Keystrokes or field contents used for detection
- Browsing history or the addresses of pages visited
- DNS lookups or the names of destinations the device tried to reach
- The contents of blocked apps or websites
What Nullgen stores
| Data | Examples | Purpose | Kept until |
|---|---|---|---|
| Administrator accounts | Email address, name, sign-in method | Sign-in and account recovery | The account is deleted |
| Organizations | Display name, type, plan status, seat limit | Plan and seat management | The organization is deleted |
| Managed people | Name and, optionally, an email address for request notices | Assign devices and route approvals | Removed by an administrator, or the organization is deleted |
| Devices | Device name, platform, enrollment state, credential hashes | Enrollment and policy delivery | Deleted by an administrator; credentials also expire after 90 days without use |
| Policies | Allow or deny rules per AI service or hostname, with expiry | What each device blocks | Changed or deleted by an administrator |
| Access requests | AI service, requested duration, optional justification, decision | Approvals and their history | The organization is deleted |
| Error reports | Stack traces, versions, environment | Reliability | Sentry’s retention settings apply |
Hosting
Everything server-side runs on Amazon Web Services in the United States: managed compute, database, identity, and content delivery. Data is encrypted in transit with TLS and at rest with the services’ built-in encryption. Nullgen operates no servers of its own.