Transforming Business with AI
Semantic data protection runtime for AI systems. Policy engine, PII detection and reversible tokenization between your application and any LLM.
Production LLM systems share a failure class: PII leaking into prompts and outputs, hallucinated data reaching customers, and generated text violating communication policies. Ad-hoc filters solve one incident and break on the next edge case. GDPR makes this an architecture problem, not a patching problem.
OGuardAI runs as a synchronous filter in the LLM request and response path. Three validation layers: content policy classification against hot-reloadable YAML rule sets, PII detection combining pattern matching with named entity recognition, and semantic tokenization that swaps sensitive values for reversible tokens so the model never sees raw data. Restoration happens per output channel policy.
System Architecture: LLM Response, OGuardAI, Policy Check, Pass, Deliver to User, Violation, Content Classifier, PII Found?, Yes, Redact / Tokenize, No, Block + Reason, Upstream Retry
OGuardAI is the AI protection layer itself: a Rust runtime that sits between an application and any LLM, detecting sensitive data, replacing it with typed semantic tokens the model can still reason over, and restoring the originals in the response under policy.
A regex floor written in Rust always runs and finds format-based data (email, phone, IBAN, credit card, passport, tax and social-security numbers, and more) in text of any language. A Python sidecar adds named-entity recognition (GLiNER and spaCy) for people, organizations, locations and addresses across roughly twenty languages. Overlapping matches are merged by confidence, and a required entity that is not found fails the request closed.
Detected values are replaced with typed semantic tokens, so a name becomes a name token and an IBAN becomes an IBAN token. The model keeps the context it needs instead of seeing blanks. Tokens are deduplicated and entity-linked, with two identity schemes (random per session or deterministic per corpus), and only the safe, tokenized text is ever forwarded to the LLM.
Policies are declarative YAML with inheritance. They decide, per entity type, whether to tokenize, redact, block or allow, and per output channel how much to restore. The kernel resolves the effective policy on every request, so the same runtime can enforce different rules for a chat reply, an email or an internal log.
On the way back, a three-stage token repair (strict, repair and fuzzy) restores each token to its original across six restore modes and rejects tokens the model hallucinated. Restoration is deterministic and idempotent, and any value that has been revoked always comes back as deleted.
Sessions are sealed with AES-256-GCM or backed by Redis, with replay rejection, per-tenant binding and a revocation table. A prompt-security pass scans input for extraction attempts and injects a hardened system preamble, and an optional output guard runs a second detection pass on the model's answer to catch personal data the model itself generated.
The same protection covers retrieval-augmented generation (ingest, query, context and answer, with corpus-scoped token identity and access-level filtering), document ingestion with OCR and visual redaction for images and PDFs, and streaming responses with token-boundary buffering so a token is never split across chunks.
AI Layer: App request, Detect: regex floor + NER sidecar, Policy per entity, block or required missing, Fail closed, tokenize, Semantic tokens, safe text, Any LLM provider, Token repair: strict, repair, fuzzy, Rehydrate under output-channel policy, Output guard: catch model-generated PII, App response, PII-safe audit and metrics
OGuardAI is self-hosted and provider-neutral, so sensitive data never leaves the customer's boundary. It ships as Docker images and runs anywhere from a single container to a multi-replica cluster.
The Rust core runs as an axum HTTP server, a transparent provider proxy that drops in front of an existing LLM API, and an oguardai command-line tool, all built on one protection kernel. A separate Python service serves the NER models. It is distributed as Docker images with a full Docker Compose stack.
Sessions, replay rejection and revocation run in memory for a single instance or in shared Redis across replicas, so the runtime scales horizontally. Sessions are encrypted at rest with AES-256-GCM, and TLS terminates at the server.
Authentication supports dev, API key, JWT and OIDC modes with per-route scope enforcement. The server-to-detector hop is protected by a shared secret, and the metrics endpoint requires an admin scope while the health probes stay open.
Prometheus metrics (transform, rehydrate, detect, entities detected and blocked, output-guard and prompt-security triggers, and latency histograms) are PII-free by construction. OpenTelemetry tracing correlates a request across detect, LLM and rehydrate with a fingerprinted, non-identifying trace id.
Client SDKs ship for TypeScript, Python, Go and Java, alongside a TypeScript MCP server and framework adapters, so applications adopt the protection layer without touching the core.
Infrastructure and deployment: Client SDKs: TS, Python, Go, Java, Rust server or proxy, MCP server, Python NER sidecar: GLiNER + spaCy, Redis: sessions, replay, revocation, Any LLM provider, Prometheus + OpenTelemetry
Guardrails only work if they run before the model sees data and before output reaches a user. OGuardAI sits inline rather than as an after-the-fact audit, accepting a small, bounded latency cost for enforcement that cannot be skipped.
Redaction destroys the context a model needs to answer well. OGuardAI swaps sensitive values for structure-preserving tokens, so the model reasons over coherent text and never sees raw data. Restoration happens per output-channel policy, which makes the token vault the asset to secure.
Communication and data rules change faster than release cycles. Policies are YAML that reloads without a restart, so operations can tighten or relax rules live instead of waiting for a deploy.
Regular expressions catch known formats; named-entity recognition catches contextual PII a pattern misses. Running both raises detection recall instead of betting on one technique.
A reusable, framework-agnostic guardrail layer that turns GDPR-aware AI from per-project firefighting into infrastructure. A proprietary Oronts product, self-hosted and provider-neutral, with the architecture documented in our data-leakage guide.
OGuardAI drops into a client's AI stack as the layer between the application and any model provider.