Use AI freely. Never expose what matters.
On-device detection masks sensitive data before it reaches any AI assistant — then restores originals in the response. Nothing leaves your browser.
Works on Claude · ChatGPT · Gemini · Perplexity · GitHub Copilot
Three steps. Zero configuration.
Detect
An on-device GLiNER model scans every prompt before you hit send. Cards, SSNs, emails, phone numbers, names — all caught locally, no server involved.
My SSN is 532-83-2948Mask
Each value is replaced with a format-preserving surrogate. The AI sees a realistic placeholder — preserving context without the real data.
My SSN is [SSN_a3f2]Restore
When the response streams back, surrogates are swapped for originals. You read real data. The AI never saw it.
SSN 532-83-2948 is valid.You don't have to take our word for it.
Most privacy tools ask you to trust a server — even a “local” proxy is a place your data flows to. PII Guardrail runs detection in your browser, so there's nothing to trust. And you can verify it three ways.
See everything it sends
The extension's popup shows a live ledger of its only two outbound requests — the one-time detection model and (if you opt in) PII-free usage counts. Your detected data: 0 bytes, always.
Your browser enforces it
A Content Security Policy of connect-src 'self' means the browser physically blocks the extension from connecting to your AI provider with raw data. Not a policy — a platform guarantee.
Check it yourself
Open your browser's Network tab, send a prompt, and look: your data isn't in any request. The installed extension's manifest, the model, and the license verification key are all yours to inspect — no trust required. Read the full security architecture →
connect-src 'self' models.trustevo.aiMost tools redact. We mask — and give it back.
One-way redaction destroys your data: the model sees ███ and you lose context. PII Guardrail swaps in a realistic, format-preserving surrogate, then restores the real value in the response — so the AI reasons correctly and you read your actual data.
One-way redaction
Other tools blank the value out. The model loses the shape and meaning, answers worse, and the original is gone for good.
Charge card ████ — goneReversible surrogate
A format-preserving token keeps the data’s shape, so the AI still understands it’s a card — and the vault restores the real number in the answer.
[PAN_7c1d] → 4111 1111 …Consistent & on-device
The same value always maps to the same surrogate within a session, so the model’s reasoning about “the same person” holds. The value↔token map lives only in your browser’s memory and is wiped when the tab closes — never persisted.
Built for teams that handle sensitive data.
Zero egress — enforced by the platform
Detection, masking, and restoration run entirely in your browser. The extension's Content Security Policy sets connect-src 'self' — even if a dependency tried to phone home, the browser blocks it at the platform level. Not a policy. A technical guarantee.
connect-src 'self' models.trustevo.aiOn-device model
GLiNER small v2.1 — loaded once from our CDN, cached locally. No API calls on the detection path. Works offline after first load.
Format-preserving tokens
Surrogates like [PAN_7c1d] preserve structure. The AI understands the data shape and gives useful answers.
Compliance-ready
Helps keep AI usage aligned with GDPR, HIPAA, and CCPA by stopping PII at the source — before it reaches any third-party model.
Three tiers of protection.
Free covers Tier 1. Pro and Team unlock all tiers.
4111 1111 ···532-83-···GB29 ···j··@···.com+1 (···) ···J·· S···Your codebase leaks through two channels. Guard both.
Coding assistants pull data in through MCP tools — databases, file readers, ticketing — and send it out through their own model calls. PII Guardrail tokenizes both on your machine before the model sees anything, and restores surrogates only at trusted boundaries. One command wires it in.
npx @trustevo/pii-guardrail install cursorPreToolUse / PostToolUse hookswraps your MCP serverswraps your MCP serversstdio MCP proxyOpenAI-compatible egress proxyOpenAI / Anthropic wire formatsSame on-device engine as the browser extension — detection runs locally and your data is never sent to us. --trust tiers let you choose block, tokenize-only, or full round-trip restore.
One deliberate difference from the browser: because Claude Code hooks run as one-shot processes, the session's token map is written to ~/.pii-guardrail/sessions/ (owner-only, deleted when the session ends) so surrogates can be restored across invocations. It never leaves your machine.
Free forever for Tier 1.
Pro unlocks everything.
No card required for the free plan. Install the extension and your data stays yours.