PII redaction
PII stops at the boundary. Not at the provider.
Detectors for SSNs, emails, card numbers, and phone numbers rewrite the payload inline — before the request egresses to OpenAI, Anthropic, or any other upstream. The provider receives [REDACTED_PII]; the signed record shows exactly which spans were redacted and why.
The mechanisms
Redaction that happens where it counts
Redacting in your logging pipeline protects your logs. Redacting at the gate protects the data — because the rewrite happens before anything leaves.
Redaction before egress, not after logging
The rewrite happens in the proxy pipeline, ahead of the provider forward. What leaves your network has already been redacted — there is no window where raw PII sits in an upstream provider’s logs.
Luhn-validated, not regex-hopeful
Card numbers are validated with the Luhn check before they’re treated as PII, cutting false positives on invoice numbers and IDs. SSN, email, and phone detectors run alongside — all inside the enforcement latency budget.
Responses and streams too
Egress is only half the problem: model output is scanned as well, including streamed responses — token by token, without buffering the stream to completion.
On the record
Every redaction lands on the signed decision event — the PII types found and the span count, not the raw values. Your auditor sees that two spans of email and us_ssn were redacted; nobody sees the values themselves.
Before and after
What your provider sees, and what your ledger keeps
The provider gets the placeholder. The signed record gets the fact of the redaction — which detector fired and how many spans — and nobody gets a second copy of the value. Evidence of protection shouldn’t itself become the leak.
In the box
What ships today
- Detectors: SSN, email, card number, phone number
- Luhn validation on card numbers to cut false positives
- Rewrite happens before egress to any provider
- Model responses scanned, not just requests
- Streamed output scanned without buffering the stream
- Redaction spans recorded on the signed decision event
- Raw values never leave your network — self-hosted by design
- Pluggable classifier hook defined for ML-based detection
- Runs inside the CI-gated enforcement latency budget
As shipped in AnchorGate v0.1 — every line above is checkable against the repository.
- 4
- built-in detector classes: SSN · email · card (Luhn) · phone
- <50ms
- total inline enforcement budget, redaction included
- 0
- raw prompts or PII leaving your VPC — there is no AnchorGate cloud
Detector set and budgets as shipped in AnchorGate v0.1.
Works with the rest of the gate
Policy Enforcement
A deterministic policy DSL — IF condition THEN redact, alert, or block — compiled, human-approved, and evaluated before a request leaves. No LLM judging LLMs: the same input always gets the same verdict.
Learn more →
Signed Evidence
Every decision signed with ECDSA P-256 over RFC 8785 canonical JSON, appended to an immutable ledger, graded L1–L5. An auditor can replay who acted, what was touched, and which policy fired.
Learn more →
Shadow-AI Discovery
Feed it DNS and HTTP egress logs and it inventories calls to 16+ AI provider domains — surfacing the copilots and scripts nobody registered. You can’t govern traffic you can’t see.
Learn more →
FAQ
PII redaction questions
- What does the model provider actually receive?
- The request with each detected span replaced by a [REDACTED_PII] placeholder. The rewrite happens in the proxy before the provider forward, so the upstream never sees the original value — not in the request, not in its own logs.
- Does redaction work when the response is streamed?
- Yes. Streamed output is scanned as it flows, without buffering the stream to completion first — the stream stays a stream. Non-streamed responses are scanned the same way requests are.
- Can I add my own detectors?
- The built-in set covers SSNs, emails, Luhn-validated card numbers, and phone numbers, and a pluggable classifier hook is defined for ML-based detection. It’s v0.1: the hook is a defined extension point, not a marketplace — if you have a detector you need, that’s exactly the conversation the design-partner program exists for.
- Are the redacted values stored anywhere?
- No. The signed decision event records which PII types were found and where — email, us_ssn, span counts — but not the values. The evidence proves redaction happened without becoming a second copy of the data you were protecting.
The cheapest data breach is the one that never egressed.
One base-URL change puts inline redaction in front of every workload you route through the gate. Self-hosted, open source, in your VPC.
Deploy the stackor email hello@anchorgate.ai