ThemissingcontrollayerforproductionAI.
What Vault did for secrets, OGuardAI does for AI data. Detect, tokenize, transform, restore, revoke, every step controlled. Your LLMs work normally. Your data stays safe.
Not another model. Not another redaction script. Not another compliance checkbox. OGuardAI is the runtime layer every LLM stack is missing: own the runtime, not the model, and the values your policy protects never reach a model raw.
Apache-2.0 · Self-hosted · Provider-neutral
The Data Flow
If your AI sees raw PII, you have already lost control. Watch how OGuardAI keeps detected PII inside the trust boundary at every stage.
Swipe to see all stages
Works Everywhere in Your Stack
RAG Pipelines
Documents ingested with tokens only. Queries and context protected end-to-end.
Agentic Workflows
Each tool call sanitized independently. Per-step policy enforcement.
Chat & Support
German formal replies with gender-aware restoration. Multi-language ready.
Source-available core. Apache-2.0 SDKs. Self-hosted.
How It Works
Your App Sends Text
User input containing sensitive data enters the pipeline.
OGuardAI Detects + Tokenizes
PII is identified and replaced with semantic tokens.
LLM Receives Only Tokens
The language model sees tokens in place of the protected values, never the raw ones.
LLM Responds with Tokens
The model generates output preserving token placeholders.
OGuardAI Restores Originals
Tokens are deterministically replaced with real values.
Detection Technology
Detection Technology
Multi-layered detection combining Rust-native performance with state-of-the-art NLP
Rust Regex Engine
- Regex patterns covering 13 builtin entity types plus German tax ID and social security
- Low single-digit ms detection on the builtin path (indicative, hardware-dependent)
- Zero external dependencies
- Deterministic: same input = same output
NER / NLP Models
- Person, company, location detection (NER mode, slower than builtin)
- GLiNER zero-shot NER model
- spaCy pipeline (optional alternative)
- ~30 metadata enrichers; 9 languages with full detection and restoration
- Confidence scoring with 0.65 threshold
Post-Processing
- 3-stage token repair (strict > repair > fuzzy)
- Output guard second-pass detection
- Entity linking (sentence-level + JSON structural)
- Overlap resolution and address merging
Built with
Features
Semantic Tokens
Typed tokens like {{email:e_001:9cf4f72d6910}} carry context so LLMs generate correct output.
6 Restore Modes
Full, partial, masked, formatted, abstract, or none, per entity type and channel.
Policy Engine
YAML-driven policies control which entities are masked, passed through, or blocked.
Output Guard
Second-pass scan re-runs detection on the LLM response, catching newly generated PII the detectors recognize.
Token Repair
Three-stage repair (strict, repair, fuzzy) handles malformed tokens from any LLM.
Streaming (SSE)
Transform and rehydrate in real-time over server-sent events for chat UIs.
Entity Revocation
Revoke specific tokens mid-session so restored values are never returned again.
RAG Pipeline
Sanitize document ingestion and query-time context for retrieval-augmented generation.
Multi-Language
Detect and protect PII across languages with gender and formality awareness.
Document & Image OCR
Extract and protect PII from scanned documents and images with a built-in Tesseract OCR path (transform or redact).
Roles & Access Control
Policy-defined caller roles gate how much each identity restores, so the same session reveals different values per role and channel.
Custom Entities
Define any domain identifier with a regex custom_pattern (MRN, Steuernummer, MSISDN, matter id), detected and tokenized with no code.
Observability
OpenTelemetry-ready tracing, structured logs with request and trace IDs, and a full audit trail, with raw PII never written to a log line.
Performance
Invisible to your users
A typical LLM call takes hundreds of milliseconds to seconds. On the builtin path OGuardAI completes in a fraction of that, so the overhead is negligible. Figures below are indicative and hardware-dependent; NER mode adds model inference and runs tens to hundreds of milliseconds.
Where latency actually lives
The LLM provider is where latency lives: network round-trip, queue wait, model inference. OGuardAI sits on both sides doing fast string operations.
Compiled Rust core
Transform, tokenization, session encryption, and rehydration all run as native compiled code, not through a Python runtime or JVM.
String ops on the builtin path
On the builtin path the pipeline is regex matching, span-based replacement, and AES-256-GCM encryption with no neural network in the hot path. NER mode adds model inference and is slower.
Stateless by design
No database lookup, no session store query, no network hop. The encrypted session blob travels with the request.
Streaming-native
SSE delivery runs the full transform or rehydrate first, then streams the finished text in token-boundary-aware chunks so a {{type:id}} token is never split across two frames. It is chunked delivery of the completed result, not token-by-token model passthrough.
Proxy mode: one line change, same performance
Your existing OpenAI / Anthropic code stays the same. The proxy handles transform on the way in, rehydrate on the way out.
Not another redaction tool
Most tools stop at detection. OGuardAI controls the full lifecycle.
PII detection is solved. What's missing is a runtime layer that protects data flowing to and from LLMs, with reversible tokens, policy enforcement, and identity-level control.
Competitor columns summarize each tool's documented primary focus from public sources, not an exhaustive feature audit. Tools evolve and may add capabilities. Corrections are welcome via the project repository.
Others detect data. OGuardAI controls how data flows through AI systems, source-available, self-hosted, built for production.
View on GitHubBuilt for every regulated workflow
One runtime, a policy per industry. Each vertical gets the entities, restore rules, roles, and channels it needs, defined in YAML with no code.
Healthcare
policy: healthcare-clinicalredacts hard identifiers, tokenizes clinical names, de-identifies for research export, role-gated restore, patient/do...
Patient Anna Müller, MRN 4471982, KVNR A123456789, Dx ICD-10 E11.9, seen by Dr. Weber (NPI 1093817264).
Patient {{person:p_001:147917db9b96}}, MRN {{mrn:x_001:1c012bbda756}}, KVNR {{kvnr:x_002:1ef29e5099fa}}, Dx {{icd10:x_003:33fb20c5b4c6}}, seen by {{person:p_002:3a1f75775a3c}} (NPI {{npi:x_004:3d1aa7c56d16}}).
Works in your language
Structured PII (email, phone, IBAN, cards, order and customer IDs) is detected by format in every language. Person, company, and location names are detected by the GLiNER NER model across Latin, Cyrillic, Arabic, and CJK scripts.
Names and structured PII
Both protected out of the box
Structured PII, names improving
Regex PII fully protected; very short CJK names still filtered by the length floor
Any language
Email, phone, IBAN, cards, IDs matched by format with 34 built-in regex patterns, independent of language
Where a specific name form is missed, a policy custom_pattern anchors it on titles or honorifics. Honest by design: this reflects what the tested backend protects today.
Enterprise-Grade Compliance
GDPR by Architecture
Art 17 right to erasure built into the runtime, not bolted on as an afterthought.
HIPAA Ready
PHI protection with audit trails and granular access controls built in.
SOC 2 Aligned
AES encryption with access controls and continuous monitoring support.
Self-Hosted
Your infrastructure, your data. Zero third-party dependency required.
Key Guarantees
- Detected, non-whitelisted PII is tokenized or removed before the model sees it
- AES-256-GCM encrypted sessions
- HMAC-SHA-256 revocation (no PII stored)
- Full audit trail with trace IDs
- Fail-secure: failures return clean errors, never detected, non-whitelisted values in the clear
- Self-hostable in your own EU VPC or air-gapped network; the whole trust boundary runs on your infrastructure
Built for the regulatory reality
Hosting your AI in the EU with a DPA does not remove the section 203 StGB confidentiality duty, and it does not neutralize the US CLOUD Act. When the raw identifier never reaches the provider, there is less to disclose and less third-country-transfer exposure to assess. OGuardAI is one technical data-minimization control, not a compliance product.
Section 203 StGB professional secrecy
Doctors, lawyers, and tax advisers keep control of protected data. The model sees tokens, not the secret.
CLOUD Act and third-country transfers
Raw PII stays inside a runtime you operate, so an EU data center plus a contract is not the only safeguard.
EU AI Act Article 10 data governance
Data minimization at the input boundary is one measure inside the assessment you still own.
Background, not legal advice. OGuardAI does not make a deployment compliant on its own.
Extend it without forking
Add your own detectors, entity types, and event sinks through explicit config and API seams. Every seam is additive and fail-closed: an extension can only add or tighten detection, never widen the trust boundary. Event sinks receive PII-free events only; a webhook detector is a detection service you operate inside the boundary.
Custom patterns, no code
Define entity types and regex detectors in policy YAML, or pass custom_patterns on a single request. Context-gated patterns extend detection to any language or locale with no hardcoded ceiling. Validated on use, merged additively, never persisted.
External HTTP detector
Register your own detector under detector.webhook. The runtime POSTs the text and merges the returned spans additively, fail-closed when the detector is required.
Push-webhook notifications
Stream PII-free audit events (entity types and counts, fingerprinted ids) to your SIEM or observability pipeline. Fire-and-forget, so an outage never blocks a request.
The trust boundary holds
No in-process native plugin loader by design: a dropped-in binary must never run inside the runtime with raw-PII access. Extensions integrate over config and HTTP, not the trusted zone.
See the configuration reference for detector.webhook and notifications.
Drop-In Integration
from openai import OpenAI
client = OpenAI(
base_url="http://localhost:8081/v1"
)
# Standard OpenAI usage. OGuardAI masks PII automatically.|One line change. No code rewrite needed.
Or embed it anywhere
SDK middleware
Wrap your LLM calls in-process with the TypeScript or Python SDK.
Proxy sidecar
A drop-in HTTP hop in front of any provider or gateway such as Langdock, Kong, or Portkey.
MCP server
Expose protection as MCP tools to Claude, Cursor, or any MCP client.
Self-hosted or VPC
Run in your own EU VPC or air-gapped network; the whole trust boundary stays on your infrastructure.
Built by Oronts
OGuardAI is developed by Oronts, a technology company specializing in AI infrastructure and data protection systems for enterprises and government organizations.
Ready to protect your AI pipeline?
Get running in seconds with a single command.
$ |