Stop shadow AI at every client,
on the firewall you manage.
Each client gets its own block list address. Add it to SonicWall, FortiGate or Palo Alto one time, and the risky AI services stay out, with new ones added every day. Nothing to upload, nothing to install, nothing to repeat each month.
Block lists for every client · 1 full assessment a month included · cancel any time
Sample
Preview the sample report
11 pages, opens in your browser · PDF
Three shadow AI worries, one control you already operate
Owners hear about AI leaks and ask their IT provider what is being done. This is an answer you can switch on today.
“Is our data ending up in free AI apps?”
Staff copy client files into free services that keep, and sometimes learn from, what they receive.
The services that keep or learn from data are stopped at the firewall; the safe ones stay reachable.
See examples“There is a new AI app every week.”
A list you build by hand is out of date within days.
We screen 300,000 new domains every day. New risky services join each client’s list automatically.
How the updates work“What exactly are you doing about AI?”
Clients, insurers and auditors expect a clear answer from their IT provider.
A written sector policy per client with a reason for each stopped service, plus a full assessment a month to show what staff use.
See an assessmentWhat you pay, and what your clients get
Free preview
- A preview audit of one log export (up to 5,000 lines)
- The totals, and up to 10 of the AI tools found, with their risk
- Our branding on the report
Block AI tools for every client
- A block list for the client’s firewall: SonicWall (any firmware), FortiGate, Palo Alto, hosts, PAC, plus DNSFilter, Cisco Umbrella, Cloudflare and Microsoft Defender through a free sync script
- Built from one of 15 sector policies, with the tools that client approved kept open
- Updated every day; new risky AI tools are added automatically
- Report code to build a monthly AI report for each client from its own firewall logs (Python, PowerShell, JavaScript, Rust)
- No logs, no uploads, no monthly work
Client reports
- 25 white-label audit reports a month with your logo
- A monthly AI report and a compliance evidence pack per client (examples)
Pay with PayPal or credit / debit card. Cancel any time.
In practice, with 25 clients
| Free | MSP plan | MSP plan + reports | |
|---|---|---|---|
| Clients with AI tools blocked on their firewall | — | all 25 | all 25 |
| Logs you need from the client | one export | none | one export a month |
| Audit reports a month | preview only | 1 full report, our brand | 25, your brand |
| Monthly AI report and evidence pack per client | — | — | yes |
| Total per month | $0 | $249 | $398 |
Most MSPs start with the MSP plan: paste one URL into each client’s firewall and the blocking runs by itself. Use the included audit on one client to show them what their staff use.
More than 25 clients: +$99/month for every 25 more, added yourself in your dashboard. Annual MSP plan: $2,390/year (save 20%).
What your reports can look like
Clients want to see that their IT provider is handling AI. With the block list on the firewalls you manage, you can show each client which AI services its staff use and what changed from month to month. Two examples of what you can hand over under your own name:
Sample
Preview the sample report
11 pages, opens in your browser · PDF
Every AI service found in the client’s firewall log, who uses it, how risky it is, whether it learns from what staff type in, and an action plan.
Sample
Preview the monthly report
12 pages, opens in your browser · PDF
What moved since last month: new services in use, risky ones, what the block list stopped, and your advice for the next review.
Monthly reports straight from each client’s firewall
The MSP plan includes ready-made code that produces the monthly usage report for every client from the firewall or DNS filter you already look after. You give it that device’s API key and the logs stay on your own machine; only the domain names are looked up with us, so each AI service gets its name, its risk and the client’s policy.
Pick
The client’s firewall or filter, and Python, PowerShell, JavaScript or Rust.
Connect
Put the device’s API key (or its syslog) and your plan key in one settings file.
Collect
Schedule it daily with Task Scheduler, cron or your RMM. Only domain names leave your network.
Report
Once a month: one report per client, with your name, logo and colours.
For SonicWall, FortiGate, Palo Alto, Cisco ASA and Secure Firewall, Cisco Meraki, Cisco Umbrella, DNSFilter, Cloudflare Zero Trust, Microsoft Defender for Endpoint and WatchGuard, plus exported logs from any other device.
Four protected clients pay for the plan. From the fifth, it is margin.
For a 25-person client, adding $3 per user a month for AI protection to your security package.
Block lists for up to 25 clients, no per-seat fees.
Left over with 10 such clients, with no monthly work.
Figures are illustrations. Your own client prices decide the margin.
Five minutes per client, then it runs itself
Set up the client in your dashboard
Pick a sector policy: law firm, healthcare, finance, school, defense supplier, or the general MSP rules. List services the client may always use, extra ones to stop, and tick strict mode if needed. Change it any time.
Add the client’s address once
The address never changes, even when you change the rules. Paste it into SonicWall as a dynamic list, into FortiGate as a threat feed or into Palo Alto as an EDL. DNSFilter takes an import file instead, which you re-import to update.
The list keeps itself current
The firewall downloads fresh rules on its own schedule. You do nothing each month, and nothing leaves the client’s network.
A reason behind every decision
Taken from the MSP default policy. When someone asks why a service is stopped, the answer is written down. Each policy decides differently: the General business policy used in the sample reports lets Midjourney through on a business plan.
| AI service | Decision | Why |
|---|---|---|
| Kimi kimi.com | Stopped | Rated high risk; user data may be stored abroad |
| DeepSwap deepswap.ai | Stopped | Built for deepfakes |
| Midjourney midjourney.com | Stopped | Learns from uploads and offers no plan that prevents it |
| Claude claude.ai | Only the paid version | Learns from chats unless switched off; the business plan does not |
| Otter.ai otter.ai | Only the paid version | Joins meetings; allowed on a plan with no-training terms |
What “Only the paid version” means. Services like ChatGPT, Claude or DeepL come in a free version, which may keep what people type and learn from it, and a paid business version whose contract rules that out. Both use the same web address, so a firewall cannot tell them apart. In normal mode they therefore stay reachable and the client is advised to use the paid version; in strict mode they are stopped too. For medical, legal, financial and defence clients, turn on strict mode with one tick in your dashboard.
A full assessment every month is included
Use it where you want to open the AI conversation. If your clients share their logs every month, the client reports option adds reports under your own brand. The samples below show what you can prepare for your clients.
White-label assessment
Sample
Preview the sample report
13 pages, opens in your browser · PDF
The full picture: every AI service, its risk and data terms, who uses it, and your plan.
Monthly usage report
Sample
Preview the monthly report
12 pages, opens in your browser · PDF
Eleven pages on what moved: new services, risky ones, usage changes and your advice.
Compliance register
Sample
Preview the sample
10 pages, opens in your browser · PDF
Vendor register, dated history and the requirement each part supports.
What MSPs ask first
Want to see it block first? Point a firewall at the free test feed in the setup guide.
Contact usDo my clients have to share their logs?
No. The client’s firewall downloads its list from us, and nothing from the client network is sent back. Logs are only needed for an assessment report.
Which equipment is supported?
SonicWall on any firmware, FortiGate and Palo Alto (as an EDL), which fetch the list daily by themselves; anything that can read a hosts, EDL or PAC list; and DNSFilter, Cisco Umbrella, Cloudflare Zero Trust and Microsoft Defender through a free sync script that updates them every day. Setup steps.
Does it cover people working from home?
Yes when the client uses a DNS filter with a roaming agent, such as DNSFilter or Cisco Umbrella, kept current by our sync script. With an office firewall only, it covers the office network.
A client relies on a service that is stopped. What then?
Open the client in your dashboard and add the service to its always-allowed list. The firewall follows at its next daily download, with the same address. Your other clients are unaffected.
How many clients are included?
Up to 25 client organisations and 5,000 endpoints for $249 a month. Every further 25 clients add $99 a month; you add them yourself in your dashboard.
Can my PSA, RMM or automation tools manage clients?
Not with a ready-made connector yet (ConnectWise, Datto, NinjaOne, Rewst). What works today: each client’s block list has a fixed address, so an RMM script or automation workflow can set it in a new client’s firewall. On request, an API lets your tools create clients, change their rules and fetch their addresses. Tell us which tool you use; the first MSPs who ask decide which connector comes first.
Will it block the automation tools we sell, like Rewst or Zapier?
No. Workflow platforms such as Rewst, Zapier, n8n and Make stay open; only autonomous AI agents are blocked. Any tool can be allowed per client.
Can I test it before paying?
You can check that your firewall accepts the list with the free test feed: 20 well-known AI domains for SonicWall, FortiGate, Palo Alto and DNS filters. The plan itself is monthly and you can cancel any time. You can also run a free preview of an assessment on any log.
Protect your first client today.
Five minutes per client, and no monthly work after that. Monthly billing, no lock-in.
Questions? Email [email protected].
