What deployment modes does HoundShield offer?

HoundShield offers three modes. Cloud mode is hosted for fast demos and non-CUI workloads. Self-hosted Docker mode runs entirely inside your network and is CUI-safe for defense workloads. Air-gapped mode supports IL-5+ environments with no outbound connectivity, so even isolated networks get full AI compliance scanning.

Which HoundShield mode is CUI-safe for defense contractors?

The self-hosted Docker mode is CUI-safe because all scanning happens inside your control boundary and no prompt content leaves your network. For the strictest environments, air-gapped mode runs with zero outbound connectivity. Cloud mode is for demos and non-CUI workloads only, never for Controlled Unclassified Information.

Do employees need to install anything to use HoundShield?

No per-machine agent is required. HoundShield works at the network proxy layer, so employees simply change one base URL in their AI tool to point at your HoundShield endpoint. Administrators deploy the gateway once with Docker, and every user is protected immediately without local installs.

How It Works — AI Compliance Firewall in 4 Steps

How it works

Local-first compliance. Zero data exposure.

HoundShield sits between your team and every AI provider. Everything is scanned on your hardware — not ours. That's the only way to guarantee your CUI never becomes a DFARS 7012 spill.

Change one URL

Point any OpenAI-compatible client (ChatGPT, Copilot, Claude, Cursor) at your HoundShield proxy URL. No agents. No installs. Live in under five minutes.

Every prompt scanned locally

HoundShield intercepts each request on your own hardware. Sixteen CUI/PII/PHI engines run in under 10ms before the prompt reaches any AI provider. Your data never touches our servers.

Block, quarantine or pass

Clean prompts pass through untouched. Risky prompts are blocked or held for human-in-the-loop review — with the exact match (CAGE code, MRN, secret) highlighted.

Sign the evidence

Every decision is written to a SHA-256 tamper-evident audit log. Export a C3PAO-ready PDF mapped to all 110 NIST 800-171 controls whenever your assessor asks.

Get started free

FAQ

Deployment questions, answered

Still have questions? Talk to a compliance engineer — we respond within 4 business hours.