Watch it redact PII live, in your browser
Paste your own text, or pick an example below. This is a lightweight client-side preview of Tier 1 (regex) and Tier 2 (format-preserving synthesis) detection — the real engine adds a local ONNX NER model for free-text names and organizations, and uses genuine AES-256-GCM for the Stateless Crypto mode.
Not just chat. Your AI agents talk to each other too.
Most redaction tools only look at conversational text. But a growing share of GenAI traffic is agents calling tools, functions, and other agents behind the scenes — and that structured traffic carries sensitive data too. LLM-Shield-Proxy protects both, automatically, with no configuration required to tell them apart.
Human ↔ LLM (chat & prompts)
When a person is chatting with an AI assistant, you choose how sensitive data gets handled — swap it for a realistic-looking fake, replace it with a plain tag, destroy it outright, or encrypt it in place. You can change this per request, without restarting anything.
See the 4 masking modes →Machine ↔ Machine (agent tool calls)
When one AI system hands structured data to another — a tool call, a function argument, a JSON-RPC message — the proxy automatically finds sensitive values hidden inside that structure, swaps in realistic-looking fakes, and can safely restore the originals afterward. It never stores anything and it never breaks the format the receiving system expects, so your agents don't crash.
See the stateless agent firewall →A transparent proxy, not a black box
Point your SDK at the proxy
Change one base_url. No rewrites, no new SDKs — the proxy speaks the OpenAI API spec and translates to Anthropic, Gemini, and vLLM under the hood.
Detect, in your VPC
A 3-tier cascade — pre-compiled regex, Shannon-entropy secret scanning, and optional local ONNX NER — finds PII, PHI, and raw secrets before anything leaves your network.
Mask and forward
Sensitive values are swapped per your policy (synthetic, tagged, scrubbed, or encrypted) and the sanitized payload continues on to your LLM provider.
Stream back, rehydrated
As the response streams in over SSE, a sliding-window buffer catches tokens split across chunks and restores the original values in real time — with no visible delay.
Built for the parts of this problem that are actually hard
This isn't the only way to redact PII — it's built specifically for the constraints of real-time, self-hosted GenAI traffic. Here's where that focus shows up.
| Traditional DLP / cloud APIs | LLM-Shield-Proxy | |
|---|---|---|
| Streaming | Buffers the full response before scanning, adding multi-second stalls to a real-time chat UX. | Scans and rehydrates delta-by-delta as the SSE stream arrives — no perceptible added latency. |
| Where scanning happens | Cloud DLP APIs (AWS Comprehend, Google Cloud DLP, Azure AI Language) require sending raw data to their endpoint to be scanned. | Runs entirely inside your VPC. Unredacted data is never transmitted to a third party. |
| The efficiency trade-off | Contextual NLP detection usually means committing to a 1GB+ model runtime — deep analysis and a light footprint are treated as mutually exclusive. | Runs lean by default (<85 MB RSS, verified) and lets you opt into local ONNX NER for deep contextual detection without leaving lean territory. |
| Agent / tool-call traffic | Text-oriented tools don't reason about JSON structure — naive regex over raw JSON can corrupt syntax and crash agents. | Parses JSON-RPC / MCP payloads into an AST and masks only sensitive leaf values, guaranteeing valid output. |
| Data retention | Many gateways log or cache prompts for debugging, creating a new data liability. | Zero long-term storage by default — self-destructing TTL vaults or fully stateless in-band encryption. |
LLM-Shield-Proxy is not a model router or orchestration framework — it runs alongside LangChain, LiteLLM, Portkey, and similar tools, sanitizing traffic before it reaches them.
Drops in front of the stack you already run
Your GenAI traffic is already carrying PII. Keep it in your VPC.
Open source, Apache 2.0 licensed, one line to try: change your base_url.