Rolling out AI privacy by company size: Shadow from one laptop to a fleet
Shadow is the same binary for a freelancer and for a bank. What changes with size is how you install it, how you keep its configuration consistent, and what evidence you need to show that it works. These guides cover each stage, with a recommended deployment, a rollout checklist and an honest list of what is not there yet.
Choose your size
Section titled “Choose your size”| Guide | Typical setup | Main concern |
|---|---|---|
| Solo developers and freelancers | One laptop, coding assistants, client work | Client confidentiality, your own secrets |
| Startups | A handful of laptops, one product with AI features | Speed, security questionnaires, SOC 2 readiness |
| Small businesses | Up to ~100 people, little or no IT team | Simple setup, customer data in everyday AI use |
| Mid-market | Hundreds of devices, MDM, internal apps | Consistent configuration, pilot and rollout |
| Enterprise | Thousands of devices, platform teams, existing DLP | Coverage gaps, scale, fit with the security stack |
| Regulated enterprise | Banks, insurers, health systems, public bodies | Evidence, change control, risk assessments |
What changes with size
Section titled “What changes with size”| Solo / startup | Small business | Mid-market | Enterprise | |
|---|---|---|---|---|
| Install | Install script, shadow install --apply | Same, done by whoever runs IT | MDM script per user | MDM plus your own signed build |
| Configuration | Local shadow.toml | One shared file copied to each laptop | Managed shadow.toml pushed into each data directory | Managed file, versioned and reviewed |
| Servers and apps | Gateway in .env | Rarely needed | systemd service or sidecar | Sidecar per workload, NetworkPolicy egress |
| Detection | Built-ins plus terms | Built-ins plus terms | Plus Presidio or the NER sidecar where needed | Tuned per workload, tested with shadow scan |
| Evidence | None needed | Written policy | Config in version control, rollout logs | Risk assessment, change records, test results |
What every size gets
Section titled “What every size gets”- No licence and no account. Apache-2.0, nothing to buy, nothing to sign in to.
- No telemetry. Shadow sends only the masked requests you were already sending, to the providers you already use.
- Local mapping. The real-to-fake mapping lives in an encrypted vault on each machine or volume.
- Three integration modes. Proxy, gateway and the Rust library, mixable on one machine.
What is not there yet, at any size
Section titled “What is not there yet, at any size”Related
Section titled “Related”- Shadow by industry for sector-specific risks and regulations
- Use cases for step-by-step guides
- How Shadow compares with DLP products, gateways and privacy vaults
Frequently asked questions
How long does it take to set up Shadow?
About five minutes on one machine: install, run shadow init, then point a tool at the gateway or run shadow install --apply for proxy mode. A team rollout takes longer because you decide on shared terms, policy and how to distribute the configuration.
Is there a central admin console?
No. Shadow is configured with a shadow.toml file on each machine or container. Teams distribute that file with their existing device or configuration management. A local audit log and shared team identities are on the roadmap.
Does Shadow need SSO or user accounts?
No. There are no accounts, logins or licences. That keeps setup simple, but it also means Shadow has no per-user identity or central reporting of its own.
What does Shadow cost at scale?
The software is free under Apache-2.0 at any size. The costs are rollout time, support for your own users, and optional detector infrastructure such as Presidio containers.
Can Shadow run in Kubernetes?
Yes, as a sidecar container next to each application, reached on localhost in gateway mode. You build the image from the repository's Dockerfile; a published image is on the roadmap.