# HeimWall — Observability for the agentic workforce

HeimWall is a macOS app. It reads what your engineers type into Cursor, Claude
Code, Copilot and ChatGPT Desktop, masks secrets and PII on the laptop before
anything is recorded, and writes a tamper-evident log your team can audit.

The prompt still goes where the engineer sent it. We detect and warn. We do not
sit in the send path.

## The problem

The fastest enterprise tool adoption in history shipped without a control
plane. Cursor, Claude Code, Copilot and Windsurf became the default stack in
under 24 months. Nobody sees what goes into the prompt: not the engineer in
the moment, and not the leader accountable for the whole team. HeimWall gives
you that visibility on-device. Managers see categories and counts, never the
text.

- Samsung 2023 quietly repeats every day: engineers paste API keys, customer
  records and proprietary code into AI tools by accident.
- Classic DLP breaks the engineer workflow: block rules kill velocity, so they
  get turned off.
- Native controls only see their own tool: nobody owns the cross-tool signal.
  HeimWall watches all of them from one on-device agent.

## The DevGPT scan

27,075 real prompts. 1.12% had something in them. We ran our detector over a
public corpus of developer conversations with ChatGPT. 303 prompts contained
something that should not have left a laptop, including three API-key-formatted
secrets and 49 personal email addresses.
Full write-up: https://heimwall.ai/blog/we-scanned-27075-developer-prompts

## The pipeline: Detect. Mask. Record.

- **Detect — on the laptop, as you type.** The agent reads the composer out of
  each tool's window through the macOS Accessibility API and watches the
  clipboard. A broad permission, and a read-only one: it observes what you
  type, it never sits between you and the tool.
- **Mask — before anything is written.** The mask goes on the record, not on
  your prompt. When a rule fires, the evidence is stored as a hashed
  placeholder, so the live secret never reaches our database.
- **Record — where it cannot be edited.** Every org gets its own hash chain,
  on a table that rejects updates and deletes.

## What the manager sees

A category. Never the text. Rows carry time, engineer, tool, category,
severity and a count of masked values.

## Engine

47 hand-written rules with real validators. Deterministic, on your machine, no
network call and no model. Nothing sits in the send path, so there is nothing
to break, nothing to slow down, and nothing to bypass.

- Free app: https://heimwall.ai/api/download (4.1 MB DMG, signed and notarized)
- Teams: https://heimwall.ai/#waitlist