Vault AI
Redact PII before it reaches any model
A transparent privacy proxy that strips PII, PHI and financial data out of every AI request in milliseconds — then re-injects the real values into the response, so your users see full data and the model never does.
- Docker
- Windows
- Linux
- x86-64
- ARM64
Why Vault AI
The model never sees real data
SSNs, cards, emails, health data and more are masked before they ever leave your network.
Invisible to your app
Your application receives the original values, re-injected on the way back — no code changes.
Compliance built in
HIPAA, GDPR, PCI-DSS, SOC 2 and PDPA coverage with a full audit trail.
Per-project policies
Tune exactly what gets redacted for each application or team.
You own the whole stack
- BYOKBring Your Own Key
Use your own AI provider keys; Vault sits transparently in front of them.
- BYOMBring Your Own Model
Works the same with local models — nothing about your setup changes.
- BYODBring Your Own Data
Original values are re-injected locally and never stored in plaintext.
- BYOIBring Your Own Infrastructure
A single Docker container between your app and any AI provider.
- BYOXBring Your Own eXecution
Compliance-grade privacy that you host and control entirely.
Capabilities
- ✓15+ PII entity types with 7 masking strategies
- ✓Session-based re-injection of original values
- ✓Per-project redaction policies
- ✓Reversible tokens per request, held in memory only
- ✓Audit log of every redaction (originals never stored)
- ✓OpenAI- and Anthropic-compatible proxy
- ✓SIEM forwarding of privacy events
Own Vault AI for life
One lifetime licence. Runs on your own servers — cloud, on-premise or air-gapped. Your keys, your data.