Over the past year, nearly every enterprise engineering team has attempted to build with frontier models like OpenAI, Claude, or Azure OpenAI.
Yet, a staggering number of these projects never make it to production. Why?
Compliance.
The moment customer names, Social Security Numbers, credit card numbers, or protected health information (PHI) enter the prompt pipeline, legal and compliance teams hit the emergency brakes:
"Under HIPAA, GDPR, and SOC 2, we are strictly prohibited from transmitting unmasked customer data outside our private network perimeter."
Many commercial "AI privacy solutions" attempt to solve this by asking you to route your raw data through their cloud proxy. But replacing one third-party risk with another isn't real enterprise security.
In this article, I will break down the architecture and implementation of PII Guardrail Studio — a 100% local, air-gapped reverse privacy proxy and encrypted token vault designed to run entirely inside your private VPC.
When designing a privacy gateway for production LLM pipelines, three constraints are non-negotiable:
The gateway must operate without phoning home to any external license server, analytics endpoint, or cloud dependency. If deployed in an isolated Kubernetes pod with network_mode: none, it must function with zero degradation.
Running heavy NLP models locally often introduces hundreds of milliseconds of overhead. By leveraging a C-optimized, regex-compiled boundary engine with 30+ entity recognizers, detection and substitution run in under 25ms on standard commodity hardware.
Masking PII is only half the battle. If a user asks:
"What medication should be prescribed to Patient Robert Vance?"
The model cannot answer accurately if the patient's identity is completely stripped. Instead, the proxy performs cryptographic token substitution:
[Raw Sensitive Prompt]
│
▼
[Local Privacy Gateway (<25ms)]
│ (Scrubbed with <PERSON_1>, <SSN_1>)
▼
[External LLM API (OpenAI/Claude)]
│ (Response contains <PERSON_1>)
▼
[Local Gateway Token Vault]
│ (Restores <PERSON_1> ➔ "Robert Vance")
▼
[Final User Response]
When the gateway maps "Robert Vance" to , where is that mapping stored?
In PII Guardrail Studio, mappings are never held in plain text. They are committed to a local SQLCipher database encrypted at rest with AES-256, verified via SHA-256 digests, and bound offline using Ed25519 node-locking.
Even if a malicious actor accesses the physical disk or container volume, the mapping table is unreadable without the node key.
The gateway can be deployed in two primary ways:
pip install piiguardrails
piiguardrails
This immediately initializes the encrypted vault and launches the interactive dashboard at http://localhost:8000.
docker run -d -p 8000:8000 \
-v $(pwd)/data:/app/data \
--name pii-guardrail-studio \
piiguardrails/enterprise-pii-guardrail:latest
Once the gateway is running at localhost:8000, you can integrate it into any existing Python pipeline using standard httpx or requests:
import httpx
raw_prompt = """
Patient Sarah Lin (DOB: 1984-06-12, SSN: 394-20-8192) was admitted to St. Jude Memorial.
Contact her at slin@stjude-health.org regarding medical charts.
"""
mask_response = httpx.post("http://localhost:8000/mask", json={
"text": raw_prompt
})
masked_data = mask_response.json()
print("Masked Prompt for OpenAI/Claude:")
print(masked_data["masked_text"])
Patient <PERSON_1> (DOB: <DOB_1>, SSN: <SSN_1>) was admitted to <HOSPITAL_1>.
Contact her at <EMAIL_1> regarding medical charts.
When the model returns its completion containing , simply pass it back to the local unmask endpoint:
llm_reply = "Follow up with <PERSON_1> regarding dietary restrictions."
unmask_response = httpx.post("http://localhost:8000/unmask", json={
"text": llm_reply
})
print("Restored Response:")
print(unmask_response.json()["unmasked_text"])
To celebrate the v2.0 release, you can grab a Free 6-Month Enterprise Evaluation Key (valid through March 31, 2027) directly on the homepage. It unlocks unlimited request throughput, unrestricted payload size, and all 30+ entity recognizers.
If you are building privacy-sensitive LLM applications, try running it locally and let me know your thoughts on the detection engine and roadmap!