Your AI reads everything.
Know where it came from.

BadApple is security for your AI's supply chain. It checks everything your AI reads, from prompts and documents to web pages and tool results, before the model sees it. It checks every answer before it leaves. And it proves which answers and which people a poisoned source reached.

Request a demo See how it works

Your security stack wasn't built to read

The attack moved from what users type to what the AI reads. Nobody has to break in. They only have to publish, email or upload text.

Control
Sees
Misses
Firewall and web gateway
Connections, URLs, files
The meaning of text inside allowed traffic
DLP
Sensitive data going out
Instructions coming in
EDR
Processes and files on endpoints
A document harmless to a computer and harmful to a model
Prompt filters
What a user types, one request at a time
Where a passage came from, and which other answers it reached
Model provider safety
The text it receives
Your corpus: which file is signed policy, which arrived last night

The missing control is provenance: knowing where every piece of AI input came from, and every answer it reached.

Inspect what your AI reads. Stop what's poisoned. Prove what happened.

One gateway between your AI and everything it reads, plus a scanner that cleans the repositories it reads from.

01

Inspect

Every document is scanned when it arrives and again on every change. Every prompt, retrieved passage, upload, web page and tool result is checked in the request path.

  • Repositories scanned before content is indexed
  • Prompts, passages, uploads, web pages and tool results checked before the model reads them
  • Native detection in Ukrainian, English and other Cyrillic-script languages
02

Stop

Attacks are blocked in real time with a clear reason. A poisoned passage is removed and the answer continues on clean sources. Sensitive data is caught on the way out.

  • Prompt injection and jailbreaks blocked before the model sees them
  • Poisoned passage removed, answer continues on clean sources
  • Answers checked for sensitive data: personal data, credentials and internal records, redacted or blocked per policy
  • Prevent or Detect mode per app. Fails closed: if a check can't finish, Prevent refuses instead of guessing
03

Prove

When something slips through, you get the list: every answer a document reached, every person who saw it, and a record an auditor can verify.

  • Every response that drew on the document, with the exact passage
  • Every user who received one, through your identity provider
  • Hash-chained log and a signed export: anyone can verify nothing was edited
  • Alerts in your SIEM, tickets in Jira or ServiceNow

One gateway between your AI and everything it reads

In the request path, every prompt and every piece of content is checked before the model sees it, and every answer before it leaves. Off the request path, BadApple scans the repositories your AI retrieves from and quarantines poisoned documents before anyone asks.

Your apps and agents

Customer chatbotEmployee assistantAI agents with toolsCoding assistants

BadApple gateway

Prompt checkContent check: passages, uploads, web, tool resultsAnswer check: sensitive dataPolicy: Prevent or Detect, per appRepository scanning and quarantine

Any model

OpenAI, Azure OpenAIAnthropic ClaudeGoogle GeminiSelf-hosted: Ollama, vLLM
Before it's read

Clean the sources

  • Scans every repository at onboarding and on every change
  • Quarantines poisoned documents for every app at once
  • Records each document's source, owner and first-seen time
While it's read

Check every request

  • Checks prompts, passages and tool results before the model reads them, and answers before they leave
  • Adds under 300 ms at p95 on a standard server
  • Fails closed: if a check can't finish, Prevent refuses instead of guessing
After it's read

Prove what happened

  • Lists every answer and person a bad document reached
  • Releases or removes content in one step, with a reason on record
  • Sends the incident and its evidence to your SIEM and ticketing

Works with your environment as it is

Sign-in through your identity provider. Alerts in the SIEM you run. Tickets where your team already works. Any model, any store, any source.

Identity

Microsoft Entra IDOktaPing IdentityGoogle WorkspaceKeycloak

SIEM

SplunkMicrosoft SentinelIBM QRadarElastic SecurityGoogle SecOps

Ticketing

JiraServiceNowLinear

Sources

SharePointConfluenceGoogle DriveAmazon S3Azure Blob StorageEmailWeb

Vector stores

PineconepgvectorWeaviateQdrantChroma

Models

OpenAIAzure OpenAIAnthropicGoogle GeminiOllamavLLM

Events in OCSF through Splunk HEC or CEF over TLS, no custom parser. OpenAI-compatible API, so hosted and self-hosted models work the same way.

Runs where your data is allowed to be

For banks and government

Sovereign

  • On your servers, in a private cloud, or fully offline
  • No data leaves your perimeter; outbound connections blocked by default
  • Add one GPU for high volume and large documents
Standard 8-vCPU server · no GPU required
Your cloud account

Private Cloud

  • In your AWS, Azure or GCP account
  • Kubernetes or a single VM
  • Your keys, your logs, your retention rules
Scales out by adding gateway instances
Managed, hosted in the EU

Cloud

  • Live in minutes: point your API address at BadApple
  • Your data isn't used for training
  • Store full text, metadata only, or nothing
EU hosting · no training on your data

Evidence for the frameworks you answer to

BadApple produces the evidence. Whether you comply stays your organization's assessment.

OWASP Top 10 for LLM Applications 2025LLM03 Supply chain · LLM01 Prompt injection · LLM04 Data and model poisoning · LLM08 Vector and embedding weaknesses
EU AI ActArticle 15: resilience against data poisoning and adversarial inputs · Article 12: automatic record-keeping
DORADetection, classification and reporting of ICT-related incidents, with evidence
NIST AI RMF · ISO/IEC 42001Monitoring of AI inputs, incident response and an audit trail for your AI management system
MITRE ATLASDetections mapped to prompt injection and retrieval poisoning techniques

Resources

Solution briefBadApple for RAG and document assistantsPDF to produce from the deck GuideRetrieval poisoning: the three questions after an incidentArticle to write from the problem slide DocumentationDeploy BadApple Sovereign in an afternoonDocs link

See it live in 15 minutes

A poisoned document, a traced answer, a blocked attack, a quarantine, and the record that proves who was affected.

Request a demo Contact sales
  1. 1
    OverviewWhat your AI did this week, and what needs attention
  2. 2
    A traced answerFrom the question to the exact source passage
  3. 3
    Blocked and removedAttacks stopped in the request, with the reason
  4. 4
    QuarantineA poisoned document pulled from every app at once
  5. 5
    A live incidentWho was affected, and the record that proves it