Skip to main content
Open-source · Self-hosted · Zero-egress

Stop PII from ever leaving your VPC — even mid-stream

Ultra-Low Latency Generative AI Sanitization for Highly Regulated Enterprise Infrastructure. LLM-Shield-Proxy redacts PII, PHI, and secrets from LLM traffic in real time — including token-by-token streams and machine-to-machine agent traffic — with <85 MB RAM and microsecond overhead.

Apache 2.0 · U.S. Patent Pending · No code rewrites — change one base_url

Engineered around technical safeguards for

These are technical controls mapped to each framework's requirements — see how in the docs. Deploying this proxy is one control among many a full compliance program requires; it is not a certification.

<85 MB
Resident memory (verified RSS)
<5 µs
Added latency per SSE chunk
170+
Automated tests in CI, and growing
0
Bytes of PII persisted to disk
Try it yourself

Watch it redact PII live, in your browser

Paste your own text, or pick an example below. This is a lightweight client-side preview of Tier 1 (regex) and Tier 2 (format-preserving synthesis) detection — the real engine adds a local ONNX NER model for free-text names and organizations, and uses genuine AES-256-GCM for the Stateless Crypto mode.

Before
After — sanitized before it leaves your VPC
Patient intake note: Maya Torres called about her upcoming visit. DOB confirmed, SSN on file is 286-68-1609, contact email user.8771@acmehealth.com, callback number 242-306-5894. Please pull her chart before the 3pm appointment.
PERSON × 1SSN × 1EMAIL × 1PHONE × 1
Two kinds of traffic, one proxy

Not just chat. Your AI agents talk to each other too.

Most redaction tools only look at conversational text. But a growing share of GenAI traffic is agents calling tools, functions, and other agents behind the scenes — and that structured traffic carries sensitive data too. LLM-Shield-Proxy protects both, automatically, with no configuration required to tell them apart.

💬

Human ↔ LLM (chat & prompts)

When a person is chatting with an AI assistant, you choose how sensitive data gets handled — swap it for a realistic-looking fake, replace it with a plain tag, destroy it outright, or encrypt it in place. You can change this per request, without restarting anything.

See the 4 masking modes →
🤖

Machine ↔ Machine (agent tool calls)

When one AI system hands structured data to another — a tool call, a function argument, a JSON-RPC message — the proxy automatically finds sensitive values hidden inside that structure, swaps in realistic-looking fakes, and can safely restore the originals afterward. It never stores anything and it never breaks the format the receiving system expects, so your agents don't crash.

See the stateless agent firewall →
How it works

A transparent proxy, not a black box

01

Point your SDK at the proxy

Change one base_url. No rewrites, no new SDKs — the proxy speaks the OpenAI API spec and translates to Anthropic, Gemini, and vLLM under the hood.

02

Detect, in your VPC

A 3-tier cascade — pre-compiled regex, Shannon-entropy secret scanning, and optional local ONNX NER — finds PII, PHI, and raw secrets before anything leaves your network.

03

Mask and forward

Sensitive values are swapped per your policy (synthetic, tagged, scrubbed, or encrypted) and the sanitized payload continues on to your LLM provider.

04

Stream back, rehydrated

As the response streams in over SSE, a sliding-window buffer catches tokens split across chunks and restores the original values in real time — with no visible delay.

Why not just use what you already have

Built for the parts of this problem that are actually hard

This isn't the only way to redact PII — it's built specifically for the constraints of real-time, self-hosted GenAI traffic. Here's where that focus shows up.

Traditional DLP / cloud APIsLLM-Shield-Proxy
StreamingBuffers the full response before scanning, adding multi-second stalls to a real-time chat UX.Scans and rehydrates delta-by-delta as the SSE stream arrives — no perceptible added latency.
Where scanning happensCloud DLP APIs (AWS Comprehend, Google Cloud DLP, Azure AI Language) require sending raw data to their endpoint to be scanned.Runs entirely inside your VPC. Unredacted data is never transmitted to a third party.
The efficiency trade-offContextual NLP detection usually means committing to a 1GB+ model runtime — deep analysis and a light footprint are treated as mutually exclusive.Runs lean by default (<85 MB RSS, verified) and lets you opt into local ONNX NER for deep contextual detection without leaving lean territory.
Agent / tool-call trafficText-oriented tools don't reason about JSON structure — naive regex over raw JSON can corrupt syntax and crash agents.Parses JSON-RPC / MCP payloads into an AST and masks only sensitive leaf values, guaranteeing valid output.
Data retentionMany gateways log or cache prompts for debugging, creating a new data liability.Zero long-term storage by default — self-destructing TTL vaults or fully stateless in-band encryption.

LLM-Shield-Proxy is not a model router or orchestration framework — it runs alongside LangChain, LiteLLM, Portkey, and similar tools, sanitizing traffic before it reaches them.

Drops in front of the stack you already run

Orchestration
LangChainLlamaIndexSemantic KernelAutoGenCrewAI
AI Gateways
LiteLLMPortkeyKong AI GatewayCloudflare AI Gateway
Inference
vLLMOllamaNVIDIA NIMHugging Face TGI
Providers
OpenAIAnthropicGoogle GeminiDeepSeekMistral

Your GenAI traffic is already carrying PII. Keep it in your VPC.

Open source, Apache 2.0 licensed, one line to try: change your base_url.