People will tell your AI they are not safe.
Make sure it answers well.
A customer tells your bank's chatbot that their partner controls the money. Another tells your telco's assistant that someone is tracking their phone. Harmwise Guardrail does three things: it tells your AI how to reply, it points the person to a real service that can help, and it keeps a record you can show anyone who asks.
You add it with two API calls.
It never blocks, changes or slows a reply. By default it keeps no conversation text: only what was used, what was found and a fingerprint of the exchange.
Customer assistant · 21:14 Sunday
Why it matters
If people can type to it, some will tell it they are being hurt. Your AI will get these messages whether it was built for them or not.
“My husband controls the account and I can't get money out.”
“The plan is in his name and he can see where I am.”
“I can't pay the bill. He takes my wages.”
Illustrative examples.
Without the right instructions, AI usually gets it wrong in one of three ways.
A referral that leads nowhere is worse than none. The person has already found the courage to ask.
- Sympathy and nothing else: It says sorry, then offers no next step.
- A refusal: It will not engage, and the person is left with nowhere to go.
- A closed door: It names a service that closed hours ago.
What it does
Three jobs. Each one is useful on its own.
Respond
Safety instructions for your AI
You add our safety instructions to your AI's system prompt. They tell it to recognise what the person has said, believe them, be honest about what your product can and cannot do, and always give the emergency number. We then check the reply your AI actually sent.
Refer
The right service, likely to be open
Your AI gets services that match what the person needs and where they live, with their languages and opening hours. If the best match is probably closed, a 24/7 service is added. If your AI offers only the closed one, we record it.
Prove
A record you can show anyone
Every checked reply is saved in a sealed record: what was detected, which instructions were used, what went wrong and where the person was sent. If anything is changed later, the seal breaks. The record also shows what we could not check, and why.
How to use it
Two API calls. Your AI keeps working the way it does now.
1. Get a key
Sign up free in the console. A test key lets you try everything without touching your live record.
2. Add the instructions
Fetch the safety instructions and put them in your AI's system prompt. They are versioned and kept up to date, so your AI always works from the current version.
3. Check each reply
After your AI has sent its reply, send us a copy. We check it (we call this grading), seal the result and show any problems in your console.
Beside your AI, not in front of it
Harmwise Guardrail never stands between the person and the reply they get. It gives your AI its instructions before the reply, and checks the reply after it has gone. If our service is down, your product keeps working, and checking starts again when we are back.
This is how it is built, not a setting someone can change.
// 1. The current safety instructions into your prompt
const p = await fetch("/v1/policy/block?jurisdiction=AU", auth)
system = [p.block, ...yourPrompt, p.session_block]
// 2. After the reply is sent, never before
await fetch("/v1/grade", { ...auth, body: { candidate: reply, turns, policy_hash: p.hash } })Versioned, and always up to date
The safety instructions are not written once and left. We release new versions as what people say to AI, and how they use it, changes. Each version has its own number and fingerprint, so it sits cleanly in your prompt cache. Every fetch returns the current version, and our SDKs check for a new one on every call at no cost, so your AI stays on the current instructions without anyone on your team having to remember. The record shows which version shaped each reply, and flags any reply built on an out-of-date one.
What you get
Something for everyone who has a stake in that conversation.
| Who | What they get |
|---|---|
| The person asking for help | A reply that believes them, an emergency number that is right for their country, and a real service to call, even at 9pm on a Sunday. |
| Your product team | Two API calls. Your AI runs exactly as it does now, and nothing is slowed down, edited or blocked. |
| Risk and compliance | Evidence of how your AI handled each of these conversations, with every problem listed for review, to sit alongside the industry codes you already follow. |
| Board, regulators and insurers | A sealed record and a 30 day report you can hand over when someone asks what your AI did, and how you know. |
Modules
Start with the safety basics. Add modules for the harms your customers raise.
Each module is a set of instructions with a version number. We update modules as what people say to AI, and how they use it, changes, and your AI always gets the current version. The record shows which version was used for every reply. Modules can be licensed one at a time or together.
| Module | Covers | Status | What it does |
|---|---|---|---|
| core | Safety basics | Available (pre-release) | What every system gets: recognise what the person said, believe them, stay within what your product can do, and always give the emergency number. |
| tia | Trauma informed response | Available (pre-release) | The guidance from our published framework, taken word for word from the safety module in our own products for survivors. We check the parts a rule can check today; the evaluation page says which. |
| cald | Culturally and linguistically diverse communities | In development | Language, community and settlement context, for people poorly served by a reply written in English first. |
| crisis | Suicide and self harm | In development | Recognises the risk and hands the person to a human service. The AI's job ends at recognising and connecting. It never tries to manage the crisis itself. |
Harmwise Guardrail helps your AI recognise harm and connect the person with help. It is not a counselling service. When someone needs a trained person, its job is to get them to one.
Referrals
Real local services, not just one hotline.
Someone whose partner controls the money may need a financial counsellor more than a helpline. Someone who cannot leave without their pets may need a safe place for them. Our directory is built around needs like these. Services are ranked on fit: the right kind of help, likely to be open, willing to help this person, and clear about what happens when they call.
- Real opening hours: hours come from each service's own published times, with the date a person last checked them. Unchecked entries are marked. If the hours cannot be read reliably, a service is never described as open.
- Never a closed door on its own: when a service is probably closed, a 24/7 service is added. A reply that offers only the closed one is recorded as a problem.
- No favourites: services run by the Digital Safeguard Centre are marked and never ranked higher. How often our own services are offered appears in every report, and an annual independent audit is planned.
In the directory now
431
services across 73 countries
- checked by a person and current
- 419
- checked, due for a recheck
- 0
- waiting for a first check
- 12
People at the Digital Safeguard Centre add, check and retire every service. None is written by AI. Each one shows when a person last confirmed it, and is rechecked within a year (sooner for national crisis lines). The directory updates every hour, and these numbers are live.
Types of service in the directory
Coverage is strongest in Australia and New Zealand, with emergency numbers for about 70 countries. Where there is no checked local service, the referral gives the emergency number and says plainly that it will not guess.
The record
What did your AI say that night? Can you prove it?
Regulators, insurers, large customers and your own board will all ask. They will want evidence, not promises. Every checked reply creates a record, sealed into a chain for that system. If anyone changes or deletes a record later, the chain breaks, and you can see exactly where.
In the console, your team can check the whole chain, review every problem found and download a 30 day report (an attestation) of what happened. That report is your organisation's own statement. Harmwise Guardrail certifies nothing. It gives you the evidence to back what you say.
No conversation text by default
We keep what was used and what was found, plus a fingerprint (a hash) of the conversation. Not the words.
Honest about what it missed
Replies we could not check, instructions that were not used, and our own errors are all recorded, with the cause and who was responsible.
Changes show up
Each system has its own chain, which you can recheck from the start at any time. Every check returns a signed receipt. Each day we publish a signed summary of every chain at /heads, and you can get proof that yours is in it.
Yours to keep
The full record belongs to your organisation. A tool to check it without our services is in development.
The console
One place for your team to see what happened.
Overview
What people raised, the problems found and how serious they were, and where people were referred. Across all your systems, and only yours.
Findings
Every checked reply, the rule it broke and the instructions it used. If you choose to keep quotes, you also see the words that caused the problem.
Referrals
Which services exist where your customers are, which ones were offered, and where the gaps are. Gaps are shown, never filled with guesses.
Record and keys
Check the record chain, download reports, manage live and test keys, and see which instructions version is current.
Your team signs in with your own Microsoft account, and each organisation sees only its own data. Our staff see totals and metadata, not conversations. They keep the directory up to date and approve new module versions, and their own actions are logged. To see any of your content, a staff member needs a stated reason and a second person's approval. That access lasts four hours and shows up in your own audit log.
The rules already apply
Industry codes were written with staff in mind. Using AI does not switch them off.
Each code below already expects businesses to recognise and respond well to customers affected by family violence, financial abuse or other hardship. Harmwise Guardrail adds no new obligations. It gives you a clear, repeatable record of how your AI handled these conversations, to sit alongside what is already expected of your staff.
Banking
Banking Code of Practice: extra care for customers experiencing vulnerability, including financial abuse and family violence
Insurance
General Insurance Code of Practice 2020, Part 9: a published family violence policy
Energy
National Energy Retail Rules: family violence protections, in force since May 2023
Telecommunications
Domestic, Family and Sexual Violence Consumer Protections Industry Standard 2025
Financial services (UK)
FCA Consumer Duty and FG21/1: fair treatment of vulnerable customers
Pricing
Free to start. The safety instructions and referrals are free on every plan.
- Safety is never switched off: the safety instructions and referrals work on every plan, at any volume, even after a subscription ends. Plans change only how many replies we check, reports, seats and support.
- Grow as you go: start free, move to Pro when you go live, to Scale as volume grows, and to Team for high volume across several systems, with 5,000,000 checked replies a month. Enterprise volume is set in its contract.
- Top up when you need more: past your monthly allowance, keep checking on prepaid credit. It costs US$4, US$3, US$2 and US$1 per 1,000 checked replies on Developer, Pro, Scale and Team, and US$60 per 1,000 replies scored by the model judge beyond its allowance (10,000 a month on Team). Top up in the console, or automatically with a monthly limit you set. Every charge is invoiced by email.
- Simple terms: prices are in US dollars, excluding tax (GST is added for Australian customers). Pro, Scale and Team are monthly or yearly (two months free). Cancel any time; it takes effect at the end of the paid period.
Start here
Developer
Free
- ✓Safety basics on every request
- ✓1,000 checked replies a month
- ✓One live system, one seat
- ✓API, plus TypeScript and Python SDKs
- ✓Referral directory
Live products
Pro
US$49
a month
- ✓Safety basics plus the trauma informed module
- ✓25,000 checked replies a month
- ✓The sealed record, signed receipts and reports
- ✓One live system, three seats
- ✓Email support; US$490 a year
Growing products
Scale
US$299
a month
- ✓Safety basics plus the trauma informed module
- ✓250,000 checked replies a month
- ✓The sealed record, signed receipts and reports
- ✓Two live systems, ten seats
- ✓Email support; US$2,990 a year
Organisations at scale
Team
US$990
a month
- ✓5,000,000 checked replies a month
- ✓Three live systems; more at US$290 a month
- ✓Webhooks, email alerts and tools for your team to work through problems
- ✓Business hours support; 99.9 per cent availability target
- ✓US$9,900 a year
Regulated organisations
Enterprise
From
US$4,500
a month
- ✓All modules, unlimited systems and seats
- ✓Single sign on, roles and audit export
- ✓99.95 per cent availability under contract, with service credits
- ✓Annual contract, invoiced
- ✓Run the checker on your own servers, and platform connectors (in development)
Who is behind it
Built from casework with victim-survivors.
Harmwise Guardrail is built by The Digital Safeguard Centre. Out of our casework we wrote and published the Trauma Informed AI Safety Benchmark and Assurance Framework (TIAB): a public description of what a safe reply looks like. Harmwise Guardrail applies it to your AI.
Thousands
of victim-survivors supported through our work since 2022
165
domestic and family violence agencies across three countries trust our work
454
test cases across 33 types of situation, 267 of them in victim-survivors' own words
18
trauma informed principles, each written so it can be scored
Find out what your AI is already hearing.
A Baseline checks a sample of your past conversations. It shows how many people raised harm, how your AI replied, and the worst replies in your product's own words. It also states plainly what the check cannot see. Run it yourself with a free test key or, if your transcripts cannot leave your organisation, we run it with you on transcripts you redact first. It is the first step in any work with us.
Request a Baseline