Enterprise PII Guardrails Studio | Zero-Leak AI Privacy Gateway

Live Architecture Simulation

Zero-Leak Proxy Pipeline in Motion

Your AI Client App

Origin

LangChain / Python / Node

Sends prompt with SSN & name.

Status: Active

POST /mask

PII Gateway

<25ms

Sub-25ms Privacy Engine

SQLCipher AES-256

LRU Auth

Waiting

30+ Recognizers

Waiting

AES-256

Standby

Zero-Leak Payload

Cloud AI

Public Internet

OpenAI / Claude / Gemini

Sees irreversible tokens (<PERSON_1>).

Compliance: Zero Exposure

PHASE 1 OF 5 T = 0.0ms

Client Ingress: Dispatching Sensitive Request

The client application initiates an API call to the gateway containing a sensitive patient name and SSN.

ENDPOINT POST /mask

BOUNDARY On-Prem VPC

PII RISK Raw Unsanitized

HTTP Request Payload (POST /mask) application/json

{
  "text": "Patient Alice Walker (SSN: 987-65-4321) prescribed Amoxicillin."
}

Interactive Engine Sandbox

Experience Real-Time PII Scrubbing

Test live detection right now. Pick an enterprise preset or type sensitive text to see tokenization pills and bi-directional unmasking in action.

Looking for the full Enterprise Studio Dashboard? Launch Live Demo

piiguardrail-sandbox

Engine Live · Sub-25ms

Raw Sensitive Prompt (Before Gateway) 138 chars

Simulate sub-25ms gateway interception

Sanitized Payload (Safe LLM Prompt)

Latency 16.4 ms

Detected 3 Entities

Vault Security AES-256

Modern Management Portal

The Studio in Action

Inspect telemetry, manage hardware-locked licenses, audit decrypted reversible vaults, and configure entity policies with sub-25ms response time.

Studio UI Showcase • 10 Interactive Enterprise Views

SLIDE 1 / 10

Core Data Protection & Compliance 5 Essential Views

SecOps, Intelligence & Governance 5 Advanced Views

http://localhost:8000/ui/index.html

Live Playground View 200 OK

💡 Visual badge pills pinpoint exactly what the engine detected before it ever leaves your network.

100% Local VPC UI • Sub-25ms

Exclusive Innovation • Zero-Regex Training

Visual Corpus Builder & Smart Exclusion Engine

The only enterprise PII gateway featuring an in-browser dual-pane JSON analysis environment. Ingest complex enterprise data schemas, automatically discover candidate regexes, and synthesize negative lookahead exclusions with 0 lines of backend code.

Visual Corpus Studio • ServiceNow Ingestion Demo

JSON EDITOR • UTF-8

⚡ Format ✔ Valid

01
02
03
04
05
06
07
08
09
10
11
12

{
  "incident_id": "INC009182",
  "caller_name": "Jonathan Drake",
  "customer_pan": "ABCDE1234F",
  "cmdb_ci": "SRV-ORACLE-DB01",
  "customer_aadhaar": "2341-5678-9012",
  "salary_band": "$125,000",
  "source_ip": "10.240.12.9",
  "sys_guid": "SYS-8841-A92"
}

Schema Validated • 8 Keys 284 bytes

DISCOVERED CORPUS GRID • Real-time Key Extraction

🔍 Filter (8/8) 3 Allowlists Active

Field Key	Sample Value	Synthesized Regex	Entity Action Mode
incident_id	"INC009182"	(?!(?:INC)-)\w+	🛡️ EXCLUDE (ALLOWLIST)
caller_name	"Jonathan Drake"	[A-Z][a-z]+\s[A-Z]...	🔒 MASK <PERSON_1>
customer_pan	"ABCDE1234F"	[A-Z]{5}\d{4}[A-Z]	🇮🇳 MASK <PAN_1>
cmdb_ci	"SRV-ORACLE-01"	(?!(?:SRV)-)\w+	🛡️ EXCLUDE (ALLOWLIST)
customer_aadhaar	"2341-5678-9012"	\d{4}[-\s]\d{4}[-\s]...	🇮🇳 PARTIAL (XXXX-XXXX-9012)
salary_band	"$125,000"	\$\d+(?:,\d+)*	🎲 NOISE (±5% Fuzz)

📦

Corpus hot-deployed to SQLCipher! Negative lookahead active.

Left Pane: Syntax-highlighted schema editor. Right Pane: Auto-extracted keys, synthesized negative lookaheads, and 1-click Exclude toggle.

Zero Backend Regex Training Required

1-Click JSON Ingest

Instant Schema Ingestion

Paste live production JSON payloads from ServiceNow, Jira, Salesforce, SAP, or electronic health record (EHR) systems directly into the built-in syntax-highlighted editor with instant formatting and validation.

Parser Speed: <5ms client-side

Deterministic Allowlists

Smart Exclusion Allowlists

Prevent over-masking forever. Protect proprietary incident numbers (INC009182), internal tracking codes, and harmless GUIDs by flagging them as Exclusions. The engine synthesizes negative lookaheads ((?!(?:...))) under the hood.

Exclusion Mode: Strict Allowlist Bypass

Hot-Reload Database

Named Business Corpuses

Organize custom regex rules into modular business domains (ServiceNow__Incidents, HR__EmployeeIDs, Fintech__LedgerKeys). Persisted into encrypted SQLite with zero gateway restart required.

Storage Persistence: SQLCipher AES-256

Full-Spectrum Entity Action Strategies

Configure custom profiles and corpus entities with mathematical compliance strategies tailored to each data sensitivity tier.

6 Turnkey Execution Modes

REDACT Terminal Deletion

Permanently replaces sensitive strings with static labels. Zero reverse lookup capability.

Result: [REDACTED]

MASK Reversible Token

Generates deterministic context-preserving tokens mapped in encrypted vault for reversible unmasking.

Result: <CUSTOMER_ID_1>

HASH Cryptographic Digest

Computes keyed SHA-256 / HMAC digests allowing analytical cross-joins without PII exposure.

Result: e3b0c44298fc1c14...

PARTIAL (LAST 4) Statutory Format

Preserves first or last characters as mandated by banking (PCI-DSS) & UIDAI Aadhaar regulations.

Result: XXXX-XXXX-9012

NOISE / FUZZ Differential Privacy

Injects Laplace/Gaussian bounded statistical perturbations into numerical & salary metrics.

Result: $82,410 ± 5%

EXCLUDE Allowlist Bypass

Exempts verified domain tokens from all downstream recognizers using negative lookaheads.

Result: INC009182 (Unchanged)

Developer Quickstart • 2-Minute Quick Setup

Up & Running in 2 Simple Steps

Deploy the local air-gapped gateway, then connect your application SDK or low-code n8n workflow in minutes.

Spin Up Privacy Gateway Server Air-Gapped / Offline

Launches high-performance reverse privacy proxy on http://localhost:8000.

bash - pip distribution

BASH

Studio dashboard initializes at → http://localhost:8000/ui/

Integrate Privacy Endpoints (Mask & Unmask) <25ms Bi-Directional

Scrub PII before sending to Cloud LLMs (POST /mask), then restore tokens (POST /unmask).

python - openai / cloud llm integration

PYTHON

Model Ecosystem: — Select provider for drop-in sample code:

Interactive Swagger REST docs → http://localhost:8000/docs

Official n8n Integration Verified on n8n Cloud Zero-Leak Gateway Ready

Build Zero-Leakage AI Pipelines in n8n

Protect sensitive customer PII across automated CRM tickets, Slack alerts, and email workflows without writing code. Deterministic masking, entity categorization, and token restoration operate directly as native drag-and-drop nodes on your n8n canvas.

Read Visual Guide

Official Workflow Pipeline #19658 • Sub-25ms deterministic latency

Open in n8n Cloud

Manual / Webhook

Raw User Input

Contains PII / PHI

Set Prompt

Prompt Extractor

Field Mapping

🛡️

PII Guardrails: Mask

Reversible Tokenizer

<25ms • Scrubbed

OpenAI (gpt-4o)

Cloud LLM Inference

Zero Real PII

🛡️

PII Guardrails: Restore

Original Entity Vault

Local Unmasking

Zero Cloud Telemetry SQLCipher AES-256 Vault Sub-25ms Latency

Ready for n8n Cloud & Self-Hosted

01 Step 1

1-Click Launch or Search

Search Enterprise PII Guardrails in your n8n node panel, or launch the official template:

⭐ Open Template #19658

02 Step 2

Add API Credential

Select Enterprise PII Guardrails API and configure your gateway URL:

Sandbox: demo.piiguardrails.com

Local Docker: host.docker.internal:8000

03 Step 3

Import Verified Templates

Open n8n canvas menu (...) > Import from URL for instant zero-leak execution:

⭐ Official n8n Hub #19658 Open on n8n.io ↗

n8n.io/workflows/19658

⚡ OpenAI Live Demo (gpt-4o-mini)

Local_PII_Safe_LLM_Pipeline_OpenAI_demo.json

🔒 Offline Pipeline (No API Key)

Local_PII_Safe_LLM_Pipeline.json

⭐ Official n8n Workflow #19658 📘 Comprehensive n8n Integration Guide

Download Templates: OpenAI Live Demo (JSON) Offline Pipeline (JSON)

Cryptographic Privacy Pipeline

Zero-Trust Gateway Architecture

Raw sensitive customer records never leave your network boundary. Here is how our bi-directional privacy proxy secures your LLM prompts:

Client / App Input

App sends prompt containing names, SSNs, credit cards, or internal IP addresses to POST /mask.

"Alice SSN 123-45..."

LRU Auth Cache

X-API-Key verified in-memory in under 0.1ms with zero database lock contention.

Auth verified <0.1ms

Multi-Tier Recognizer

30+ entity recognizers + custom regex scrub data. Reversible tokens saved asynchronously to SQLCipher AES-256.

SQLCipher AES-256 Vault

External LLM Query

OpenAI, Claude, or Gemini receives only sanitized pseudonymized tokens (<PERSON_1>).

Zero Sensitive PII Leak

Authorized Unmask

POST /unmask seamlessly restores tokens in model completion back to real values for authorized staff.

Original Values Restored

Defense-in-Depth

Engineered for Strict Enterprise Compliance

Built from the ground up for healthcare, fintech, insurance, and defense organizations where cloud phone-home is strictly prohibited.

Sub-25ms Live Masking

In-memory LRU authorization cache and asynchronous non-blocking SQLite worker thread guarantee minimal latency impact on production streaming pipelines.

SQLCipher AES-256 Storage

Zero data at rest is left unencrypted. Database file, reversible token maps, API keys, and audit logs are encrypted using 256-bit AES-CBC encryption.

30+ Entity Recognizers

Pre-configured for SSN, credit cards, IBAN, passports, medical IDs, phone numbers, IP/MAC addresses, API keys, JWTs, and custom enterprise regex patterns.

Ed25519 Node-Locked Licensing

Commercial licenses are cryptographically locked to host Server Hardware IDs via Ed25519 asymmetric signatures, operating 100% offline with zero cloud phone-home.

Real-Time Threat Intelligence

Integrated firewall blocking malicious IP addresses, phishing domains, and credential leaks before prompt evaluation, protecting internal LLMs from poison vectors.

Bi-Directional Unmasking

Effortlessly restore LLM completions back to original values for authorized human agents, ensuring end users receive normal responses while AI models see zero PII.

SIEM & External Logging Hub

Native log stream forwarders with automated Splunk Event wrapping, Datadog Intake API integration, and real-time radiating emerald status beacons for zero-blindspot SOC monitoring.

Forensic Audit Trail & Telemetry

Immutable SQLCipher AES-256 audit logs recording all masking operations, policy intercepts, and administrative actions with full-text search, filters, and 1-click CSV/JSON export.

100% Encapsulated Air-Gapped Binary

Zero Python, zero pip, and zero static files on disk. Frontend UI, context-aware entity recognition engine, and cryptographic vault are 100% encapsulated inside a hardened native ELF/EXE binary.

🎁 Community Launch Special

6 Months Free Enterprise Evaluation

To celebrate our v2.0 release, activate a full Enterprise Tier key with unlimited requests, unrestricted payload length, and all 30+ entity recognizers, valid through March 31, 2027.

1. Launch Studio Open dashboard at http://localhost:8000.

2. Open Settings Navigate to Settings → License & Quota tab.

3. Paste & Activate Paste product key and enjoy 6 months unlimited.

Enterprise Tier Feature Matrix

Transparent capabilities across trial, standard, and enterprise deployments.

← Swipe horizontally to view all tiers →

Capability	Trial Tier	Community Promo	Standard Tier	Enterprise Tier
Masking Latency	< 25ms	< 25ms	< 25ms	< 25ms
Entity Recognizers	30+ Included	30+ Included	30+ Included	30+ Included
Custom Regex Engine	1 Pattern	Unlimited	5 Patterns	Unlimited
Max Payload Length	5,000 chars	Unrestricted	50,000 chars	Unrestricted
Monthly Quota	1,000 reqs	Unlimited	20,000 reqs	Unlimited
Storage Security	SQLCipher AES-256	SQLCipher AES-256	SQLCipher AES-256	SQLCipher AES-256
Offline Node-Locking	Standard Floating	Standard Floating	Standard Floating	Ed25519 HWID Lock
Visual Corpus Builder	View Only	Unlimited Allowlists	3 Corpuses	Unlimited Corpuses & Allowlists
SIEM Integrations	Disabled	Splunk + Datadog + Webhook	Webhooks Only	Splunk HEC + Datadog + Webhooks
License Term	Permanent Free	6 Months Free	Commercial Key	Perpetual Node-Locked