What Vault did for secrets, OGuardAI does for AI data. Detect, tokenize, transform, restore, revoke, every step under policy. Your LLMs work normally. Detected values your policy protects stay inside your boundary.
Self-hosted · Self-hosted · Provider-neutral
If your AI sees raw PII, you have already lost control. Watch how OGuardAI keeps detected PII inside the trust boundary at every stage.
Swipe to see all stages
Proof points
No customer logos and no figures without a run behind them. Each point links to the document or code that backs it.
structured data protected in every language; NER and restore extend to any language, no code
Email, phone, IBAN and other structured identifiers are matched by format regardless of language. Person, company and location names and restore templates ship broad coverage today (around 30 languages) and are extended per locale as data (a language pack or a restore-template overlay) with no source change.
Source: Language guide →Healthcare, banking, legal, HR, government, insurance, tax, telecom, education, retail, CRM and social media, each with its entities, roles, channels and restore rules in YAML.
Source: Policy authoring →LangChain, LlamaIndex, Haystack, CrewAI, OpenAI Agents, Vercel AI and Mastra, for the Python and TypeScript SDKs; SDKs are also available for Go and Java, plus a REST API and an MCP server.
Source: SDK guide →self-hosted, air-gapped if you want
No phone-home, no licence server. Detected values your policy protects are tokenized before anything leaves the runtime you operate.
Source: Licensing →no model rewrites anything
Restored values come only from the AES-256-GCM sealed session that travels with the request. A full restore is byte-identical to the original, and nothing trains on your data.
Source: Security guarantees →revoke once, never restored again through the runtime
Revocation stores HMAC-SHA-256 digests, never raw values, and audit events carry entity types and counts only. Raw PII is never written to a log line.
Source: Data retention →Proprietary core, Apache-2.0 SDKs. Self-hosted, no licence key.
What are you building
Pick what you are building. The proof and the quickstart below adapt to it. The primitive never changes: transform at a boundary your code owns, restore under a channel your policy allows.
The same value becomes the same token in every document and query of a corpus, raw values never enter your embeddings, and the answer is restored at the end.
A corpus_id derives a deterministic, corpus-scoped id and cap, so the same value maps to the same token across documents and queries.
Source: API reference →Ingest returns a per-chunk chunk_session_state stored beside the chunk, and context merges admitted chunks fail closed.
Source: RAG pipeline →/v1/rag/delete revokes every value in a RAG session; revocation stores HMAC digests, never raw values.
Source: Data retention →curl -X POST http://localhost:3000/v1/rag/ingest \
-H 'X-API-Key: $GUARDAI_API_KEY' \
-H 'content-type: application/json' \
-d '{"corpus_id":"support-kb","text":"Ticket from Erika Mustermann ..."}'Boundary: It cannot delete a value from your vector store. A runtime version upgrade invalidates sealed blobs and forces a re-ingest.
Build the graph on tokenized text: one entity, one node id per corpus, and the raw name never enters the graph store.
The same value maps to the same token across documents and queries, so edges from two documents meet at one node.
Source: API reference →Tokens carry the type, so a person node stays a person node without ever holding the name.
Source: Token protocol →Person, company and location need the NER sidecar; the format floor runs without it.
Source: Trust boundary →# Extract entities and relations on the tokenized text, not the raw text.
# The node id is the token itself, stable per corpus.
safe = client.rag_ingest(corpus_id="kb", text=doc).safe_text
graph.add_node(token) # {{person:p_001:...}}Boundary: No graph-store connector ships. OGuardAI transforms the text your extractor reads and restores the answer; it cannot delete a node from your graph.
Every step sees tokens; your host code restores once, after the loop ends.
Chat messages go in and one session spans the steps, so a token minted in step one still resolves in step three.
Source: Agent integration →CrewAI hooks protect the tool result and memory; the OpenAI Agents adapter covers text in and out.
Source: CrewAI integration →In MCP, guardai_rehydrate is called by the host, never by the model, and the admin and revoke tools are gated.
Source: MCP integration →# One session across the whole loop; restore once in host code.
session = client.transform(chat_messages=history).session_state
# ... run the tool loop on the safe text ...
final = client.rehydrate(session_state=session, text=answer, output_channel="tool_payload")Boundary: tool_payload restores what the policy stamps; only log_safe and export carry an automatic ceiling. Tool arguments are outside the text adapters' scope.
Two HTTP steps around your model step; the sealed session travels as a field in your item.
Plain JSON REST with an Idempotency-Key on mutating routes, so a workflow retry never executes twice.
Source: API explorer →An OpenAI-compatible model step can instead point its base URL at the proxy on port 8081 with the X-GuardAI-API-Key header.
Source: OpenAI proxy →A required detector that did not run fails the request closed, never raw.
Source: Fail-closed behavior →# Step 1: protect. Keep session_state on the item.
POST /v1/transform {"text": "{{item.body}}"}
# Step 2: your model step runs on safe_text.
# Step 3: restore.
POST /v1/rehydrate {"session_state": "{{item.session}}", "text": "{{model.output}}"}Boundary: No workflow node ships for any automation tool; use the HTTP step. The session_state blob is the only thing your workflow carries between the two calls.
A base URL change for OpenAI or Anthropic SDKs, or a few lines with the SDK, and one session across turns.
The proxy serves chat completions, messages and embeddings, and nothing else.
Source: OpenAI proxy →SSE delivery never splits a token across frames, so a streamed reply restores cleanly.
Source: Features →The output guard re-scans the reply for values the model may have generated.
Source: Security guarantees →from openai import OpenAI
client = OpenAI(
base_url="http://localhost:8081/v1",
default_headers={"X-GuardAI-API-Key": GUARDAI_KEY},
)
client.chat.completions.create(model="gpt-4o", messages=history)Boundary: Proxy mode covers chat, messages and embeddings; inline images are OCR-scanned or refused. Everything else goes through the SDK or REST.
Call the same transform before you write. Nothing here is a log shipper or a database plugin.
input_type json tokenizes every string value and object key and preserves the shape.
Source: API reference →log_safe clamps to none and export to masked before any channel rule applies.
Source: Policy authoring →A token without its sealed session is not restorable, and revocation stores digests, never values.
Source: Data retention →curl -X POST http://localhost:3000/v1/transform \
-H 'X-API-Key: $GUARDAI_API_KEY' \
-H 'content-type: application/json' \
-d '{"input_type":"json","data":{"user":"e.mustermann@example.de","note":"..."},"output_channel":"log_safe"}'Boundary: It cannot delete a value from your database or log sink. An upgrade invalidates sealed blobs.
Roles, channels, audit and revocation on infrastructure you operate; the runtime is the same in every edition.
caller_role binds to the API key or JWT and is re-authorised at rehydrate; a request-supplied role is ignored outside dev.
Source: Policy authoring →The Helm chart runs the server with Redis for distributed sessions and revocation.
Source: Installation →Audit events carry entity types and counts only; raw values never reach a log line.
Source: Deployment →helm install oguardai oci://ghcr.io/oronts/charts/oguardai --version 0.1.0 \
--set redis.enabled=true \
--set ner.enabled=trueBoundary: Not itself certified or audited; it supports HIPAA and SOC 2 programmes. Runbooks cover key rotation, policy rollback, incident triage and version upgrade.
One container, a ready-made policy per industry, no licence key. Self-host to evaluate; the runtime is proprietary and licensed by Oronts.
The Developer edition is the complete runtime, self-hosted to evaluate.
Source: Editions →Industry policy files ship ready to load per vertical.
Source: Policy authoring →The MCP server works with Claude Desktop, Claude Code, Cursor and Windsurf.
Source: MCP integration →docker run -p 3000:3000 \
-e GUARDAI_HOST=0.0.0.0 \
-e GUARDAI_ALLOW_DEV_NON_LOOPBACK=1 \
ghcr.io/oronts/oguardai/server:latestBoundary: The single container protects structured values by format; person, company and location need the NER sidecar.
OGuardAI runs where you call it. It does not reach into a database, a vector store or a log sink on its own, and it cannot delete a value from one. The transform happens at the boundary your code owns.
OGuardAI is a self-hostable AI data protection runtime that sits between your applications and the model providers you use. It detects sensitive values, tokenizes them under policy, restores them deterministically, and keeps an audit and revocation trail. Three questions come up in almost every first conversation; here are the direct answers.
“So this is an LLM proxy?”
The transparent proxy is one integration mode among several, there for teams that cannot touch application code.
A gateway rewrites traffic. OGuardAI governs data.
“Is this the same as an AI workplace platform?”
Workplace platforms give employees a chat UI on top of hosted models, with a contract as the privacy story.
A platform can embed OGuardAI. It does not compete with one.
“So a small model rewrites my text?”
The runtime is deterministic Rust: format detectors find structured identifiers, policies decide, tokens replace exact spans, and restored values come only from the encrypted session.
Nothing generates text, and nothing trains on your data.
One sentence for your security review: OGuardAI is a self-hosted data protection runtime between your applications and the model provider you choose. Detected, non-whitelisted values your policy protects are tokenized or removed before a request leaves your boundary.
Detection
A deterministic format floor always runs. Named-entity models, your own patterns, your own detectors and per-language routing build on top of it, and the policy engine around them never changes.
Two paths, one policy: a format floor that always runs, and named-entity models where names matter.
Add detection in data and config, never in a fork. Every seam can only add or tighten.
Every knob moves toward more protection by default, and each one is a config value, not code.
Whichever detection you choose, the rest is identical: the same policy engine, semantic tokens, restoration, output guard, audit trail and trust boundary. GET /v1/capabilities lists what your deployment detects, with the source of every type.
No in-process plugin loader by design: a dropped-in binary never runs inside the runtime with raw-PII access. Extensions integrate over config and HTTP as services you operate inside your boundary, never as code loaded into the runtime process.
A deployment that brings its own detection can run with no third-party model at all, so none of our model licences apply to it.
Performance
We publish no latency figure without a named benchmark run behind it, and there is no such run yet. What we can state is the shape of the work: on the builtin path every stage is in-process regex, span replacement and encryption, with no model inference and no network hop. Enabling NER adds a round-trip to the detector sidecar plus a model forward pass, and that dominates the request.
Measure it on your own hardware and workload; the benchmarks page has the method and scope. Read the benchmarks page for method and scope
The provider hop carries a network round-trip, queue wait and model inference. OGuardAI sits on both sides of it doing in-process string work.
One runtime, a policy per industry. Each vertical gets the entities, restore rules, roles and channels it needs, defined in YAML with no code. Every example below is the shipped policy of that name.
policy: healthcare-clinicalSSN, health ids, passports, cards, IBANs, KVNR and DEA numbers refuse the request; MRN, NPI, encounter and diagnosis codes and patient and clinician names are tokenized, with restore gated by care-team role. German and English.
Patient Erika Mustermann, MRN 4471982, Fallnummer F-88231, Dx code E11.9, seen by Dr. Mustermann, NPI 1093817264.
Patient {{person:p_001:147917db9b96}}, {{custom:mrn:x_001:1c012bbda756}}, Fallnummer {{custom:encounter_id:x_002:1ef29e5099fa}}, Dx code {{custom:icd10:x_003:33fb20c5b4c6}}, seen by Dr. {{person:p_002:3a1f75775a3c}}, {{custom:npi:x_004:3d1aa7c56d16}}.
Structured values (email, phone, IBAN, cards, order and customer IDs) are matched by format, so they are protected in any language with no configuration. Names are a separate layer: they depend on the NER model, and that coverage is not uniform.
Treat name detection as a data-minimization control, not an absolute guarantee: a span the model does not return cannot be tokenized. Coverage is extensible per language without touching source code.
Architectural controls that support your compliance program. OGuardAI runs on your own infrastructure and is not itself certified or audited; certification remains your responsibility.
Hosting your AI in the EU with a DPA does not remove the section 203 StGB confidentiality duty, and it does not neutralize the US CLOUD Act. When the raw identifier never reaches the provider, there is less to disclose and less third-country-transfer exposure to assess. OGuardAI is one technical data-minimization control, not a compliance product.
Doctors, lawyers, and tax advisers keep control of protected data. The model sees tokens, not the secret.
Raw PII stays inside a runtime you operate, so an EU data center plus a contract is not the only safeguard.
Data minimization at the input boundary is one measure inside the assessment you still own.
Background, not legal advice. OGuardAI does not make a deployment compliant on its own.
from openai import OpenAI
client = OpenAI(
base_url="http://localhost:8081/v1"
)
# Standard OpenAI usage. OGuardAI masks PII automatically.Proxy mode is a base URL change. SDK and API modes are a few lines at your model call.
Or embed it anywhere
Wrap your LLM calls in-process with the TypeScript, Python or Go SDK.
A drop-in HTTP hop in front of OpenAI-compatible endpoints (including named support for Azure OpenAI, Google Vertex AI, and Mistral) and Anthropic-compatible endpoints.
Expose protection as MCP tools to Claude, Cursor, or any MCP client.
Run in your own EU VPC or air-gapped network; the whole trust boundary stays on your infrastructure.
The runtime is the same in every edition. What differs is the commercial relationship around it: support, response commitments, and negotiated terms.
Self-hosting, including air-gapped, needs no licence key and no phone-home. The runtime is proprietary: every deployment, including an evaluation, runs under a written agreement with Oronts.
A demo, a licence enquiry, or a meeting. We reply from office@oronts.com.
Run OGuardAI on your own infrastructure, including air-gapped, with no phone-home and no licence server. The runtime is proprietary; its use is licensed by Oronts under a written agreement.
Support with an SLA, plus help through security and compliance review for a production deployment.
Embedding OGuardAI in a product you distribute is covered by an OEM agreement with Oronts: distribution rights, support commitments, indemnities, and terms for your use case.
Not offered today: OGuardAI is self-hosted only. Join the waitlist if you would want a hosted evaluation later.
OGuardAI is developed by Oronts, a technology company specializing in AI infrastructure and data protection systems for enterprises and government organizations.
Evaluation access is granted under a written agreement. Once granted, the runtime starts with one command; until then, request access or read the docs.