OGuardAI
Operations

Performance Characteristics

Latency, throughput, and session blob size characteristics by detector mode and payload size

Transform Latency by Detector Mode

Modep50p95p99Notes
builtin (regex only)Under 1msUnder 2msUnder 5msFastest. No external dependencies.
both (builtin + NER healthy)10-50ms50-100ms100-200msNER adds network round-trip + model inference.
both (NER configured, unavailable)5s5s5sWaits for NER timeout (configurable, default 5s), then falls back to builtin.
advanced (NER only)10-50ms50-100ms200msAll detection via Python sidecar.

Rehydrate Latency

Sizep50p95p99
Small (under 100 chars)Under 0.1msUnder 0.5msUnder 1ms
Medium (1-5KB)Under 0.5msUnder 1msUnder 2ms
Large (10-100KB)Under 2msUnder 5msUnder 10ms

Rehydrate is typically fast -- it's a local string replacement operation with no external calls.

Session Seal/Unseal

OperationLatency
Seal (AES-256-GCM encrypt)Under 0.1ms
Unseal (decrypt + validate)Under 0.1ms

Session Blob Size

EntitiesBlob SizePer-Entity
1~400 bytes~400 bytes
10~2 KB~200 bytes
50~10 KB~200 bytes
100~20 KB~200 bytes
500~100 KB~200 bytes
1000~200 KB~200 bytes

Blob size grows linearly -- approximately 200 bytes per entity.

Throughput

ModeOps/sec (single core)
Builtin only>1000
Builtin + NER20-50 (limited by NER round-trip)

Recommendations

For lowest latency

detector:
  mode: builtin

Detects: email, phone, SSN, IBAN, credit card, IP, URL, order, customer ID, passport, health ID, address, DOB. Does NOT detect: person names, company names, locations (requires NER).

For best coverage

detector:
  mode: both
  advanced_url: http://localhost:9090

Detects all entity types including person, company, location via GLiNER/spaCy. Latency depends on NER sidecar performance.

If NER sidecar is sometimes unavailable

The system automatically falls back to builtin-only detection when the NER sidecar is unreachable (5-second timeout). Health endpoint shows current detector status.

To avoid the 5-second timeout penalty on each request when NER is down:

  1. Monitor health endpoint for detector status
  2. If NER is down, switch to mode: builtin until it recovers
  3. Or accept the 5s penalty per request (subsequent requests in the same connection are fast if using connection pooling)