DEV Community

李成斐
李成斐

Posted on • Originally published at github.com

AI Privacy Gateway — strip PII from AI prompts before they leave your machine

#ai #security #privacy #opensource

Every AI coding assistant (Cursor, Claude Code, Copilot) sends your code to third-party servers. Every time you paste customer data into ChatGPT, that data leaves your machine. Every DeepSeek prompt crosses an international border.

I wanted a dead-simple fix: a local proxy that strips PII from AI API calls before they leave my machine. No SaaS dependency. No "sign up for enterprise." Just docker run and forget it.

AI Privacy Gateway is a transparent HTTP reverse proxy that does exactly that:

  • 30-second deploy: docker run -d -p 9999:9999 ghcr.io/gunxueqiu6/ai-privacy-gateway:lite — then change your AI client's base URL to http://localhost:9999
  • 26 entity types auto-detected (v2.0.3): phone numbers, email addresses, China ID cards (18-digit), bank cards (Luhn-validated), API keys (20+ known formats: OpenAI sk-, AWS AKIA, GitHub ghp_, Stripe sk_live_, etc.), China Unified Social Credit Codes, passports and HK/Macau/Taiwan permits, IPs, URLs, dates, amounts, postcodes, plate numbers, coordinates, MACs, person names (Chinese + English via optional spaCy NER), and custom regex patterns
  • <1ms latency overhead (self-measured): a compiled union regex pattern makes one pass per request; optional NER fallback adds ~2–5ms for fuzzy entities
  • SSE streaming support: sliding-window buffer resolves entity boundaries across chunk boundaries — no buffering delay, no missed PII
  • AES-256-GCM encrypted vault: optional persistent mapping storage for round-trip reconstruction; stateless mode available
  • Works with any OpenAI-compatible API: ChatGPT, Claude, DeepSeek, Cursor, Copilot, Open WebUI — anything that can change its base URL
  • PolyForm Shield: free for noncommercial use, source available, zero telemetry, fully local

Why I built it:

I work with customer data — phone numbers, emails, transaction records. Every week I'd catch myself pasting something containing PII into an AI tool. The existing options were all wrong for my use case:

  • LLM Guard (MIT): Python SDK with transformer deps — slow install, ~5ms latency, no SSE streaming
  • Presidio (MIT): Microsoft's analyzer — Docker Compose + NLP models + PostgreSQL, no Chinese NER out of the box, no proxy mode
  • Nightfall / Private AI (commercial): cloud-hosted, enterprise-priced, your data hits their servers
  • PasteGuard (MIT): browser extension only — misses API tools like Cursor or Claude Code

None of them let me change one URL and be done.

Architecture (simplified):

[AI Client] --raw request--> [Privacy Gateway :9999] --masked request--> [AI API]
                              |
                              +-- [Regex Engine: 26 patterns, <1ms]
                              +-- [spaCy NER: names, locations, orgs (optional)]
                              +-- [AES-256-GCM Vault: optional mapping storage]
                              +-- [Audit Log: JSON/Syslog]
Enter fullscreen mode Exit fullscreen mode

The proxy intercepts requests to /v1/chat/completions, scans the JSON body for PII patterns, replaces matches with typed placeholders ([PHONE_abc123], [EMAIL_xyz789]), then forwards the sanitized request upstream. The AI provider gets semantic context — but never raw sensitive values.

Tech stack: Python 3.11+ / FastAPI, compiled regex engine, spaCy (zh_core_web_sm + en_core_web_sm), SQLite encrypted vault (AES-256-GCM), SSE sliding-window buffer, pub/sub audit bus, optional load balancer for multiple upstreams.

Current status: v2.0.3. Tests with adversarial fuzzing; benchmark suite in CI (self-measured on our test corpus).

Honest limitations:

  1. Regex misses unconventional PII formats — transparent about ~95% recall for structured types on our test corpus, not 100%
  2. NER recall for Chinese names is imperfect — catches common names, misses uncommon ones
  3. False positives on things like long order numbers triggering bank-card patterns — a --strict flag helps
  4. Single-process Python server — scale behind nginx for high throughput
  5. Masking is not a silver bullet: if the model already knows a person from context, placeholders can still be connected — redaction mode ([REDACTED], irreversible) exists for higher-stakes data

What I want feedback on:

  • Does the proxy-vs-SDK tradeoff make sense for your team?
  • Which PII types are missing for your use case?
  • Would you use a managed enterprise version (self-hosted, RBAC, audit export, SLA)?

GitHub: https://github.com/gunxueqiu6/ai-privacy-gateway
Website/Demo: https://privacygw.pages.dev

Happy to answer technical questions about the regex engine, streaming buffer, or vault design.

Top comments (0)