# Subrosa Documentation Welcome to the Subrosa Documentation! ### What is Subrosa? Subrosa is a data security platform for safe AI use, the key features it offers your oragnisation are: * The ability to visualise AI use across your fleet, including sanctioned and unsanctioned (Shadow AI) usage. * The ability to detect AI use regardless of the application in use, not just in web browsers. * The ability to define policies around what data can be sent to an AI provider. * The ability to enforce controls when policies are violated. * Blocking, Masking, Alerting or Allowing the given request * Rich reporting of policy compliance and overall usage trends. ### Why should I use Subrosa? By using Subrosa you will: * Gain visibility into AI use in your organisation, particularly shadow use you may not be aware of currently. * Have a framework to define how you want AI tools to see your data. * Enable your staff to more safely use AI while protecting your data boundaries by enforcing guardrails, making data loss less likely. * Provide straightforward reporting on use that can assist with compliance and other security reporting/visibility objectives. ### How to start a Subrosa Trial? Thinking about protecting your business data? [Book a 15-min demo](https://calendly.com/use-ai-securely/subrosa-demo?month=2024-08) with Subrosa team. ### What's New? TBA # Step 1 - Install Device Agent How to provision the agent on your machine ## Creating Device Agent In the Subrosa web application: 1. Click on `Device Agent` in the sidebar 2. Click `Create Device Agent` 3. Provide the required information and click `Confirm` ## Downloading the Device Agent Follow the download links on the `Device Agent` page for your Operating System. {% hint style="warning" %} Having trouble downloading the Device Agent? Contact us at {% endhint %} ## Install the Device Agent Once you have downloaded the file 1. Unzip the installer 1. Double click the downloaded file and follow your Operating Systems instructions to extract the contents 2. Run the installer {% hint style="warning" %} If you find you do not have permission to run new programs on your organisation managed device you will need to contact your technical support or IT team for assistance. {% endhint %} ## Authenticate the Device Agent 1. Open a Terminal on your machine 1. Guide for [Windows](https://learn.microsoft.com/en-us/windows/terminal/) Terminal 2. Guide for [Mac](https://support.apple.com/en-au/guide/terminal/trmlb20c7888/mac) Terminal 3. Linux (use your preferred Terminal Emulator) 2. Copy the command line from the `Create Device Agent` page, enter it into the terminal and press \. 1. Alternatively, you can also find the agent from the list on the `Device Agent` page, and click on option menu to retrieve authentication command line. 3. You will see a success message after authentication in your Terminal, once you see it you can close the Terminal Subrosa is now installed and protecting your machine! {% hint style="warning" %} Having trouble? Contact us at {% endhint %} ## Update the Device Agent We send an email to all customers when a new version of the agent is released, to update to the new version repeat the installation steps above. The installer will see and keep your existing settings so you won't need to authenticate again. # Step 2 - Setup Policy Define AI usage policies for your organisation ## What is a Policy? A policy represents a type of data (such as a credit card number) and an action to be performed when data matching that policy is sent to an AI provider. You can find all Policies at `Policy` page. ## How to use Subrosa provided Policies Subrosa provides a list of common PII and PCI policies. You can customise the action that is taken. {% hint style="info" %} All Subrosa Policies are enabled in detect mode by default. You can also disable one or more of the Subrosa Policies. {% endhint %} ## How to define a Custom Policy 1. Click `Policy` in the side menu 2. Click `Create Policy` 3. Supply the required information and the pattern to match on 4. Select an action to be applied when the pattern matches 5. Click `Confirm` # Step 3 - Monitor AI Usage Monitor your organisation's AI usage and activity with Subrosa ## Dashboard When you log into Subrosa you will already be on the `Dashboard` Here you will find high level summaries for your Organisation's AI usage and risk posture in a selected period of time. ## Traffic Log In the sidebar you can click on `Traffic Log` to view a detailed summary of traffic from all your Device Agents. All traffic to AI providers are monitored. Detected leaks and protected traffic are highlighted under `Traffic Log`. You will be able to drill down on AI usage per policy actions. # Manage Device Agent ## What is the Device Agent? The Device Agent is a program that runs on your computer and applies the policies defined in Subrosa to protect you while using AI tools. It can see your traffic to AI providers (but only AI providers) and applies the defined policies and their corresponding actions transparently, you won't know it is there unless it takes an action. The agent is built to be privacy respecting, it only looks at traffic to a defined set of [AI providers](/ai-provider/ai-provider-support) and never sends data off your device. It is also very light on system resources. ## Create a Device Agent You can create a Device Agent from the `Device Agent` page. A valid device contact email needs to be provided at this step. ## Downloading the Device Agent Follow the download links on the `Device Agent` page for your Operating System. {% hint style="warning" %} Having trouble downloading the Device Agent? Contact us at {% endhint %} ## Install the Device Agent See [Installation Steps.](#install-the-device-agent) ## Authenticate the Device Agent See [Authentication Steps.](#authenticate-the-device-agent) ## Update the Device Agent See [Updating the agent.](#update-the-device-agent) ## Delete Device Agent You can delete a `Device Agent` from the `Device Agent List` through the option menu next to a `Device Agent` item. This will remove it from Subrosa, it will no longer be able to send data. To remove it from your local machine: 1. Open a Terminal ([see here](#authenticate-the-device-agent) if you do not know how) 2. Type `sr-agent uninstall` and hit \ 3. Follow the prompts ## Stop the Device Agent Process on Device If you want to stop the agent on your local device without unlinking it {% hint style="info" %} The agent integrates with the process managers of the operating systems we support, so you will be interacting with these to control its lifecycle * On Windows that is the Windows Service Manager and its frontend `sc` * On Mac that is `launchd` and its frontend `launchctl` * On Linux that is `systemd` and its frontend `systemctl` {% endhint %} 1. Windows 1. Open a Terminal as an Administrator 1. Press the Windows Start button at the bottom left 2. Type in "Command Prompt" 3. Right click on Command Prompt and click "Run as administrator" 4. Click Yes if the Windows 10 User Account Control prompt is displayed 2. Type `sc stop SubrosaService` and hit \ 1. It can be restarted with `sc start SubrosaService` 2. Mac 1. Open a Terminal 2. Type `sudo launchctl stop ai.subrosa.service` and hit \ 1. It can be restarted with `sudo launchctl start ai.subrosa.service` 3. Linux 1. Open a Terminal 2. Type `sudo systemctl stop subrosa` and hit \ 1. It can be restarted with `sudo systemctl start subrosa` # Organisation Dashboard With Organisation Dashboard, you can view AI activity and security posture report in one place TBA # Visibility and Shadow AI Guardrails ## Visibility Subrosa provides visibility into all AI activity in your environment. Traffics related to AI interactions are captured and recorded, and displayed under `Traffic Log` for usage trend analysis, reporting and investigation purpose. ## What's Shadow AI AI interactions to unsanctioned AI softwares is known as Shadow AI. Shadow AI can accelerate risks of breaches and sensitive data leaks. In addition to the security risk, the use of unapproved AI tools can lead to a wasteful duplication of efforts across teams and unnecessary expenditures ## Subrosa Shadow AI Guardrails {% hint style="info" %} This feature is under canary release. If you're interested, please reach out to for more information {% endhint %} Subrosa monitors all AI traffic including sanctioned and unsanctioned AI software in your environment; meanwhile, providing guardrails on shadow AI traffic via detecting and protecting outgoing data with Policy ([read more](/policy/manage-policy)) . \ \ The platform also offers traffic-level visibility and trends of Shadow AI usage in your organisation. # Manage Policy ## What is a Policy? A policy represents a type of data (such as a credit card number) and an action to be performed when data matching that policy is sent to an AI provider. Subrosa provides a list of common PII and PCI policies. You can also define Custom Policies. You can view all Policies from `Policy` page. {% hint style="info" %} Currently, Subrosa only supports detection in text prompts. We're working on supporting file content detection, stay tuned. {% endhint %} ## Policy status A policy is able to be enabled or disabled. You can view policy status from Policy page. ### Disable a Policy 1. Go to Policy Page by clicking 2. Click on a Policy from `Policy` page 3. Toggle `Enable Policy` on `Policy Information` section on the `Configure Policy` page. 4. Click `Confirm` ## Policy Action You can use `Policy Action` to define the action taken when detecting data is going to be sent to an AI provider. | Policy Action | Control | | ---------------- | -------------------------------------------------------------------------------------- | | Detect (Default) | Detect data in traffic, no action is taken. The traffic will be flagged as suspicious. | | Block | Block traffic to an AI provider when the policy matches. | | Mask | Mask the data in traffic to an AI provider when the policy matches. | ## Subrosa Machine Learning Policy Subrosa provides a list of common PII and PCI policies enabled via machine learning technology. By default, all Subrosa Policies are enabled in `Detect` mode, though you can customise the action that is taken. {% hint style="info" %} You can disable one or more of the Subrosa default Policies. {% endhint %} ## Custom Policy You can create one or more Custom Policies based on your own data, by describing that data in our policy language and defining the action to be taken when a match occurs. ### Create a Custom Policy 1. Click `Policy` in the side menu 2. Click `Create Policy` 3. Supply the required information and the pattern to match on 4. Select an action to be applied when the pattern matches 5. Click `Confirm` ### Update a Custom Policy * Click `Policy` in the side menu * Click on a Policy * Update Policy information and action * Click `Confirm` ### Delete a Custom Policy * Click `Policy` in the side menu * Click on a Policy * Click `Delete` at the bottom and confirm your action # AI Provider Support ## What is an AI Provider? An AI Provider offers cloud-based software solutions that leverage artificial intelligence to deliver various services and applications to users. These services are commonly accessed via web browsers, but are sometimes embedded into desktop applications too. ## Supported AI Providers | AI Provider | Visibility | Data Leak Detection and Protection | | ----------------------- | -------------------- | ---------------------------------- | | ChatGPT (Web) | :white\_check\_mark: | :white\_check\_mark: | | ChatGPT (Desktop) | :white\_check\_mark: | :white\_check\_mark: | | Azure OpenAI | :white\_check\_mark: | :soon: | | GitHub CoPilot (VSCode) | :white\_check\_mark: | :white\_check\_mark: | | GitHub CoPilot (Web) | :white\_check\_mark: | :soon: | | Anthropic Claude (Web) | :white\_check\_mark: | :white\_check\_mark: | | Perplexity (Web) | :white\_check\_mark: | :soon: | | Google Gemini (Web) | :white\_check\_mark: | :soon: | | Notion AI | :white\_check\_mark: | :soon: | | Amazon Bedrock | :white\_check\_mark: | :soon: | {% hint style="info" %} Don't see the AI provider you are using? Get in touch with us via and we would be happy to see what we can do to support your use-case {% endhint %} # About Traffic Log Discover suspicious AI activity and shadow AI usage detected by Subrosa ### Traffic Log Overview Traffic log are a list of traffic detected by Subrosa from the installed Device Agent. A single traffic log contains AI activity details, including: * **Status**: the security status about the traffic sent to an AI provider * Traffic Status is associated with data contained in the traffic and an protection action taken by Subrosa ([read more](#traffic-status-table)) . * **Action**: the policy that was triggered by the traffic being sent. * **AI Provider**: the destination of the traffic. * **Device Contact**: the email contact of the device which sent the traffic. * **Timestamp**: the date and time when the traffic was sent. ### Traffic Status Table | Traffic Log Status | Subrosa Policy Action | | ------------------- | -------------------------------------------------------------------------------------------------------- | | **Auto Remediated** | Matched sensitive data is detected and protected | | **Action Required** | Matched data is detected by Subrosa that requires manual investigation and follow-up remediation action. | | **Monitored** | No matched data is detected by Subrosa, traffic is recorded for investigation | # Inspect Traffic Log TBA # Manage Organisation ## Invite team members Subrosa allows you to invite collaborators to your organisation. To invite your team members, please contact . ## Terminate your account You can terminate your Subrosa account at any time, this action will also delete all data we have stored for your organisation. To terminate your account, please contact # Security Subrosa considers security a core requirement of our product, the following will give you an idea of what this means and how we protect your data and privacy. ## Data Architecture All data we store is encrypted in-flight and at-rest and is correlated via cryptographic IDs, which enables us to easily process deletion requests should we receive them. ## Source Code * Two-person code review is mandatory before any code is deployed. * Third party libraries are used as minimally as possible (to reduce supply chain risks) and any that are used are carefully vetted. * Automation is in place to detect any vulnerabilities in libraries and source code is scanned for security issues. * Penetration testing is performed when required. ## Agent While our agent is not open source, we are happy to explain how it works and what the it does on your endpoints - we fully understand the significance and privilege of running on your devices and want you to feel confident and informed. * To function, the agent intercepts traffic on your host, this interception happens on-device. * A new Certificate Authority (CA) is generated on your device on first run (this is unique to each device so if it was ever compromised \[eg: by malware on the device] the CA would not be useful to attack the traffic of any other machine). * The agent intercepts requests to the defined set of AI endpoints and no others. * See [AI Provider](/ai-provider/ai-provider-support) Please contact us via [security@subrosa.ai](mailto:security@subrosa.ao) if more information is required. ## Infrastructure ### **Identity** * Our identity infrastructure leverages Auth0. * The tenant is hosted in Australia. ### **Cloud** * All our infrastructure is deployed on AWS and aligns to the [Well Architected Framework](https://aws.amazon.com/architecture/well-architected/). * Data sovereignty is respected with all infrastructure being deployed in Australia * Architectural and network segmentation exists between the application tier, services tier and data storage tier. * The data storage tier is never exposed to the internet directly. ### Backups * Backups are regular and automated. ### Encryption * Any storage we use is encrypted-at-rest (servers, backups, etc). * All traffic between the agent and server is encrypted on-the-wire via HTTPS (TLS1.2 or above). ### **Monitoring** * Monitoring is present throughout the environment along with automated alerting. ### Internal Security Procedure * All administrative access is logged and monitored. * System configurations are deployed consistently throughout the environment via automation. ## Reporting issues * If you experience any bugs or issues when using Subrosa, please contact us on [help@subrosa.ai](mailto:help@subrosa.ia) with your inquiry. * If your issue is security related please contact and we will reply urgently. ## What to know more about our security practices? Feel free to contact our security team at # Status The operational status of our back end services Coming soon... # Change Log Release logs for our agent and new features we launch Coming soon...