The PII firewall for your AI pipeline.
One API call masks names, emails, and SSNs, plus what every other tool misses: API keys, JWTs, and session tokens. Reversible placeholders keep your workflow intact, and your users never notice.
You are wiring LLMs into support tickets, logs, and chat, and compliance is asking what happens to customer data inside those prompts. Regex is a leaky bucket, and self-hosting an NER stack is a project nobody has time to babysit.
curl https://api.shroudcloud.com/v1/shroud \
-H "Authorization: Bearer ***" \
-d '{"text": "Card on file for Maria Gonzalez, contact [email protected], session eyJhbGciOi..."}'{
"text": "Card on file for [PERSON_1], contact [EMAIL_1], session [JWT_1]",
"entities": 3,
"reversible": true
}What it catches
Standard PII
Names, emails, phone numbers, SSNs, addresses, dates of birth. The baseline every tool claims.
Identity artifacts
Bearer tokens, JWTs, OAuth codes, API keys, session cookies. The things an identity researcher knows leak.
Secrets
Private key blocks, AWS access keys, generic high-entropy API key patterns, with context-word scoring around each.
How it works
1. Shroud
Send text. Get back deterministic placeholders — [PERSON_1], [EMAIL_1], [JWT_1] — with a structured entity map.
2. Let the model work
The LLM reasons over placeholders, never real data. Context stays intact because replacements are deterministic.
3. Unshroud
On the response, swap placeholders back. Your end user sees real data; the model never did.
FAQ
Is this a self-hosted or managed service?
Managed API with zero retention: text is processed in memory and destroyed. Nothing is stored, logged, or used for training.
Does it work with streaming responses?
Yes. The shroud/unshroud mapping is stateless per request and works on streamed chunks.
What about pricing?
No pricing announced yet. Early access users set the roadmap and lock in founding terms.