People
Names, emails and phone numbers of colleagues, patients and customers.
Shadow
Free & open source · Apache-2.0 · Self-hostedThe open-source privacy layer for AI. Shadow swaps names, emails, customers and secrets for realistic, reversible fakes before a request leaves your machine, and restores them in the answer.
macOS and Linux. Windows, Cargo and Docker: see installation. Source on GitHub.
- Apache-2.0Free and open source
- Single binarymacOS, Linux, Windows
- No cloudNo account, no telemetry
- 15+ providersOpenAI, Anthropic, Gemini…
Shadow is an open-source privacy layer that sits between your apps and AI providers such as OpenAI, Anthropic and Google Gemini. It finds personal data, customer names, credentials and internal identifiers in every outbound prompt, replaces them with realistic, format-preserving fakes, and translates the fakes back in the response. It is PII redaction and AI data loss prevention that keeps ChatGPT-style assistants, Claude, coding agents and your own LLM apps useful. It runs as a local HTTPS proxy, a gateway base URL, a Docker sidecar or the shadow-core Rust library, and the mapping between real and fake values never leaves the machine.
The problem
Prompts carry far more than the question
People paste whatever makes the answer better. Policies say “don’t”, and people do it anyway, because the tool is useful. This is what ends up in a request to an AI provider:
Customer records
Customer lists, invoices with IBANs and cards, contracts with addresses.
Secrets
API keys, tokens and passwords pasted along with a config file or a stack trace.
Infrastructure
Internal hostnames, IP addresses and file paths that contain your username.
Company secrets
Your company name, clients and the codenames of unreleased projects.
Files
Uploaded spreadsheets, Word documents, slides and PDFs full of all of the above.
Once it leaves your machine, it can end up in
- Provider logs
- Abuse-monitoring queues
- Support tooling
- Training data
- A future breach
How it works
Translate, don’t block
Shadow sits between your tools and the model. The provider gets a coherent prompt about a company that does not exist. You get an answer about yours.
Your appSDK, agent, IDE, CLI
Shadowmask restoreencrypted vault
LLM providerOpenAI, Anthropic, Gemini…
You write
Draft a renewal reminder to Jane Doe (jane@acme.com) at Acme GmbH. Card on file: 4111 1111 1111 1111. Logs are in /Users/jdoe/billing.
The provider sees
Draft a renewal reminder to Hui Zhao (hui.zhao@zhilan.cn) at Zhilan Technology Co., Ltd.Card on file: 4837 2191 9471 3480. Logs are in /Users/huizhao/billing.
- Same shape. Emails stay emails, cards still pass Luhn, IBANs still pass mod-97.
- Consistent. The same real value always gets the same fake, so the model can reason about it.
- Reversible. The answer comes back with every fake swapped for the real value.
- 01
Intercept
Requests reach Shadow through
HTTPS_PROXY, a gateway base URL or the Rust API. Only known AI hosts are decrypted; everything else is tunnelled untouched. - 02
Detect
Checksummed patterns, emails, phones, secrets, hostnames, IPs and paths, your own dictionary of customers and codenames, and optional local NER or Presidio.
- 03
Translate
Each value gets a consistent, format-preserving fake from your machine’s persona, or a typed token for bulk reports. Secrets can be redacted outright.
- 04
Restore
Fakes in the answer are turned back into real values: full responses, streamed tokens and tool-call arguments, before your tool sees them.
Features
Everything between your data and the model
Detection is only the start. Shadow handles what sits around it, so AI tools keep working on masked data.
Realistic, reversible fakes
Every value maps to a stable fake of the same format from one persistent persona, so answers stay useful.
Encrypted local vault
The real-to-fake mapping lives in an encrypted vault on your machine and never leaves it.
Layered detection
Checksummed patterns, secrets, machine facts, your dictionary, plus optional NER or Presidio.
Streams and tool calls
Fakes split across SSE events are reassembled; tool-call arguments are restored before your tools run.
Intent-aware policy
Act, report, code or converse: each request gets the right treatment, from fakes to typed tokens.
Files too
Text, CSV, JSON, DOCX, XLSX, PPTX and PDF uploads are masked, and Office files stay valid.
Single binary, no cloud
One Rust binary for macOS, Linux and Windows. No account, no hosted component, no telemetry.
Works with any tool
HTTPS proxy for every app, a gateway base URL for SDKs, a Docker sidecar, or a Rust library.
Open source
Apache-2.0, free to use and audit. Methodology and benchmarks are published and reproducible.
Activity dashboard
See what’s leaking
Find out what your AI tools actually send before anything leaves the machine: how much traffic goes to which model, what Shadow masked, and what it blocked.
- Traffic monitoredEvery AI request on the machine, by destination and by the app that sent it.
- Sensitive data maskedWhat was swapped for fakes, broken down by data type: people, emails, keys, IBANs.
- Requests blockedWhat your policy refused to send at all, and why.
Menu bar
A status icon on Mac and Windows with live counts and a quick pause.
Web dashboard
Trends over time by data type, destination such as ChatGPT or Claude, and source app.
shadow top
The same live view in your terminal, over SSH and on servers.
Benchmarks
Leaks less than standalone detectors
Measured on a held-out test set with a reproducible benchmark: the share of sensitive values that still reached the model. Lower is better.
| Tool | Leaked |
|---|---|
| Shadow + open-weight NER sidecar | |
| Shadow + Presidio detector | |
| Shadow, built-in rules only | |
| OpenAI Privacy Filter | |
| GLiNER | |
| Microsoft Presidio | |
| LLM Guard |
- 3.08%of sensitive values leaked with built-in rules alone
- ~7.5 msper document with built-in rules
- 0%public names changed by mistake
- 100%exact round trip back to the original text
Integrations
Plugs into what you already use
No code changes for most tools: point them at Shadow with one environment variable or a base URL.
ProxyEvery tool on a machine
HTTPS_PROXY=http://127.0.0.1:8877GatewayAnything with a base URLOPENAI_BASE_URL=http://127.0.0.1:8877/gw/openai/v1SidecarServices in Docker or Kuberneteslocalhost:8877 next to your serviceLibraryRust servicesshadow-core, masking in-processModel providers
- OpenAI
- Anthropic
- Google Gemini
- Vertex AI
- Azure OpenAI
- AWS Bedrock
- Mistral
- OpenRouter
- Groq
- DeepSeek
- xAI
- Cohere
- Self-hosted APIs
SDKs and frameworks
- OpenAI SDK
- Anthropic SDK
- LangChain
- LlamaIndex
- Vercel AI SDK
- LiteLLM
Tools and agents
- Claude Code
- VS Code extensions
- JetBrains IDEs
- Terminal assistants
- Your own agents
Runs on
- macOS
- Linux
- Windows
- Docker
- Kubernetes
Compare
Why not just block or redact?
Blocking breaks the tool, so people route around it. Placeholders keep requests flowing but destroy meaning. Shadow translates.
| Capability | Blocktypical DLP gateway | Redactplaceholders | Shadowreversible fakes |
|---|---|---|---|
| Request still reaches the model | No | Yes | Yes |
| Model sees coherent, realistic data | — | No, <PERSON> tags | Yes, format-valid fakes |
| Answer refers to your real data | — | No | Yes, restored locally |
| Streaming and tool calls | Blocked | Placeholders leak into arguments | Restored on the fly |
| Where it runs | Network edge or cloud | Library or service | On the endpoint, or in-process |
Shadow vs Presidio, LLM Guard, LiteLLM, Nightfall and 30 more
Who it’s for
From one laptop to a regulated fleet
Developers, security and privacy teams, and platform teams building LLM features use the same binary.
FAQ
Frequently asked questions
Short answers to what people ask first.
How do I stop employees pasting customer data into ChatGPT?
Give people an AI tool that is safe to paste into instead of one they have to avoid. Route your API-based AI clients (internal chat apps, SDK-based tools, coding assistants, agents) through Shadow, and customer names, emails, IDs and secrets are replaced with fakes before the request leaves the machine, while the answer still comes back with the real values. Shadow intercepts provider APIs such as api.openai.com and api.anthropic.com, not consumer web apps like chatgpt.com, so pair it with a policy that points staff at an approved API-backed client. See use cases.
Is Shadow a Presidio alternative?
It is a complement more than a replacement. Microsoft Presidio is a detector and anonymizer library that replaces values with placeholders or hashes. Shadow adds what sits around detection: consistent, format-preserving fakes from one persona, an encrypted mapping, restoration of responses, streams and tool calls, and a ready-made HTTPS proxy and gateway. Shadow can call Presidio as an extra detector. See Shadow vs Presidio.
Does Shadow work with Claude Code, Cursor or GitHub Copilot?
Claude Code and other tools that accept a base URL (ANTHROPIC_BASE_URL, OPENAI_BASE_URL) or honour HTTPS_PROXY work through gateway mode or proxy mode, and the code intent keeps identifiers readable. Cursor and GitHub Copilot send traffic to their vendors' own backends, which are not on Shadow's built-in host list; you can add hosts with extra_hosts, but check the request log before relying on it, and clients that pin certificates cannot be intercepted. See integrating any endpoint.
Is Shadow GDPR or HIPAA compliant?
No tool makes an organisation compliant on its own. Shadow helps you meet data-minimisation, confidentiality and transfer requirements under GDPR and HIPAA by keeping personal data and PHI out of requests to AI providers, and its mapping never leaves your machine. Whether you are compliant still depends on your whole programme: contracts, policies, access control and what else you send. See industries.
Does Shadow work offline and self-hosted?
Yes. Shadow is a single binary that runs on your laptops, servers or containers, with no cloud service, account or telemetry. Detection, the persona and the encrypted vault are all local, and optional detectors (a NER model, Presidio) run on addresses you choose. The only outbound traffic is the masked request you were already sending, and you can point it at a self-hosted model endpoint instead of a cloud provider.
Can Shadow unmask responses and tool calls?
Yes. Every fake in the response is turned back into the real value, including streamed SSE and NDJSON responses where a fake is split across events. Tool-call arguments are restored on your machine before your tools run, so an agent's email reaches the real address. Tools hosted in the provider's cloud are handled by an explicit policy. See tool calls and agents.
What does Shadow cost?
Nothing. Shadow is free and open source under the Apache-2.0 licence, with no account, licence key or usage fees. You keep paying your AI provider as before.
How accurate is Shadow's PII detection?
Detection combines checksummed patterns (cards, IBANs, national IDs), secrets and machine identifiers, your own dictionary of names and codenames, and an optional local NER model or Presidio for free-text names. Results depend on your data, so Shadow publishes its methodology and measurements on the benchmarks page, and shadow scan shows what would be masked in your own files before you rely on it.
Will masking make the AI's answers worse?
Usually not, because the model still sees coherent data: a fake email is still an email, two different people stay two different people, and a fake card still passes Luhn. That is the main difference from placeholder redaction, which breaks the model's ability to reason about the values. For bulk reports Shadow switches to typed tokens such as [PERSON_0001], which are restored in the answer.
Which AI providers does Shadow support?
OpenAI, Anthropic, Google Gemini and Vertex AI, Azure OpenAI, AWS Bedrock, OpenRouter, Mistral, Groq, Together AI, DeepSeek, xAI, Cohere, Perplexity and more, plus any custom or self-hosted HTTPS model API you add. See supported providers.
Keep using AI. Keep your data.
Free and open source under Apache-2.0. One binary, no account, nothing to sign up for.