Shadow vs alternatives: the AI data-leak prevention landscape
Shadow is an open-source (Apache-2.0) privacy layer for AI traffic. It replaces names, emails, customers, secrets and IDs in prompts with realistic, reversible fakes before a request reaches OpenAI, Anthropic, Gemini or another provider, and restores the real values in the response, including streamed responses and tool calls. This page maps the other tools people use to stop sensitive data leaking into large language models, and links to a detailed, fair comparison with each one.
What kinds of tools prevent AI data leaks?
Section titled “What kinds of tools prevent AI data leaks?”Tools in this space fall into five groups. They overlap, and many teams combine two.
| Category | What it does | Typical action on sensitive data | Examples |
|---|---|---|---|
| Detector libraries and models | Find PII spans in text. You build the rest | Placeholder, mask or hash, usually one way | Presidio, GLiNER-PII, OpenAI Privacy Filter, DataFog, cloud PII APIs |
| Guardrail frameworks and AI gateways | Sit in front of model APIs, route traffic and run checks | Block, or redact with placeholders; a few restore | LLM Guard, NeMo Guardrails, LiteLLM, Portkey, Kong, Cloudflare, Bedrock Guardrails |
| Enterprise GenAI DLP | Watch employees’ use of AI apps in the browser, on the endpoint or in the SASE layer | Block, warn, coach, sometimes redact | Netskope, Zscaler, Palo Alto, Microsoft Purview, Nightfall, Harmonic, Prompt Security, Lasso, Strac |
| Privacy vaults and secure-AI platforms | Tokenise or pseudonymise data and re-identify under policy | Reversible tokens, usually as SaaS | Skyflow, Protecto, Private AI, Tonic Textual, Wald.ai |
| Local reversible proxies | Mask on the endpoint, restore in the response | Reversible placeholders or fakes | Shadow, Rehydra, a few small projects |
Shadow belongs to the last group. Its distinguishing choices are realistic, format-preserving fakes drawn from a persistent persona, restoration in streams and tool calls, an intent-aware policy, file masking for Office documents, and a local, single-binary deployment as an HTTPS proxy, a gateway or a Rust library.
The comparison table
Section titled “The comparison table”Legend: Block = request refused; Redact = [REDACTED] or <PERSON> placeholder; Token = vault-backed token; Fakes = realistic synthetic values; FPE = format-preserving encryption. “Not documented” means public docs do not mention it, not that the feature is missing.
| Tool | Open source / licence | Deployment | Protection method | Restores responses | Streaming | Tool calls | Files | Self-hosted | Price model |
|---|---|---|---|---|---|---|---|---|---|
| Shadow | Yes, Apache-2.0 | Endpoint proxy, gateway, Rust library | Reversible realistic fakes; typed tokens for reports; optional redact | Yes | Yes (SSE, NDJSON) | Yes, intent-aware | DOCX/XLSX/PPTX in place, PDF to text | Yes | Free |
| Presidio | Yes, MIT | Library, REST containers | Redact, mask, hash, encrypt, custom | Only encrypt → decrypt | No | No | Image redactor (OCR), DICOM | Yes | Free |
| LLM Guard | Yes, MIT | Library, API container | Placeholders, optional Faker values | Yes (Vault + Deanonymize) | Not documented | No | No | Yes | Free |
| NeMo Guardrails | Yes, Apache-2.0 | Guardrail framework | Block or label mask | No | Output rails, no unmask | Retrieval rails | No | Yes | Free |
| LiteLLM | Core MIT, enterprise features paid | Self-hosted gateway | Block or redact via Presidio and others | Placeholders (output_parse_pii) | Reported issues on some paths | No | No | Yes | Free core; Enterprise paid |
| Portkey | Gateway MIT; guardrails in cloud | SaaS, hybrid, OSS gateway | Redact via partner guardrails | No (docs: one way) | Not documented | No | No | Gateway only | SaaS tiers |
| Kong AI Gateway | Sanitizer is Enterprise-only | Self-hosted gateway plugin | Placeholders or synthetic values | Yes (restore) | Not documented | No | No | Yes | Enterprise licence |
| Cloudflare AI Gateway | No | SaaS gateway | Flag or block | No | Buffers response to scan | No | No | No | Plan-based |
| AWS Comprehend / Bedrock Guardrails | No | AWS service | Detect; block or {NAME} tags | No | Not verified | No | Async batch (Comprehend) | No | Usage-based |
| Azure AI Language PII | No | Azure service | Character mask, entity mask, synthetic (preview) | No | No | No | Document PII API | Containers (not verified) | Usage-based |
| Google Sensitive Data Protection | No | GCP service | Mask, replace, FPE, deterministic encryption | Yes (reidentifyContent) | No | No | Images, storage jobs | No | Per GB |
| OpenAI Privacy Filter | Yes, Apache-2.0 (model) | Local model | Detector only | n/a | n/a | n/a | n/a | Yes | Free |
| GLiNER PII models | Apache-2.0 or NVIDIA Open Model License | Local model | Detector only | n/a | n/a | n/a | n/a | Yes | Free |
| DataFog | Yes, MIT | Library, LiteLLM guardrail, hook | Redact, replace, hash, block | Not documented | Not documented | No | Not documented | Yes | Free |
| LangChain PIIMiddleware | Yes, MIT | In-app agent middleware | Redact, mask, hash, block | No | n/a | Yes (tool results) | No | Yes | Free |
| Rehydra | Yes, MIT | SDK and local proxy (Node/Bun) | Reversible placeholders | Yes | Yes (sentence-buffered) | Yes | .env scrubbing | Yes | Free |
| Private AI | No | Container API, cloud | Placeholders, mask, synthetic | Yes (re-identify) | Not documented | Not documented | Many file types (vendor) | Yes (container) | Quote |
| Skyflow | No | Vault SaaS | Vault tokens | Yes (policy-governed) | Not documented | Not documented | Images, PDF, audio, Office | No | Quote |
| Protecto | No | SaaS or VPC | Reversible tokens, FPE for databases | Yes (unmask API) | Not documented | Not documented | Not documented | VPC option | Quote |
| Tonic Textual | No | SaaS or self-hosted | Redact or consistent synthesis | Not as a proxy | No | No | Files in original format | Yes (Docker, Helm) | Pay-as-you-go or quote |
| Wald.ai | No | SaaS chat and API | Contextual substitution | Yes | Not documented | Not documented | Not documented | No | Per user |
| Strac | No | SaaS and browser extension | Alert, block, redact, pseudonymise | Not documented | Not documented | No | SaaS stores | No | Quote |
| Nightfall | No | SaaS, browser extension, endpoint agent | Block or redact | No | n/a | No | Uploads | No | Quote |
| Lakera Guard | No | API (Check Point) | Detect and flag | No | Not documented | Agent security | No | Enterprise only | Free tier; Enterprise quote |
| Prompt Security | No | Extension and gateway (SentinelOne) | Block or filter | No | Not documented | Not documented | Not documented | Not documented | Quote |
| Harmonic Security | No | Browser extension | Warn, block, redirect; redact (vendor) | No | n/a | n/a | Uploads | No | Quote |
| Lasso Security | No | Extension and gateway | Mask or alert | Not documented | Not documented | Not documented | Not documented | Not documented | Quote |
| Netskope One | No | SASE inline | Block, coach, redact (mask, FPE, hash) | No | Not for SSE | Not for MCP | Not for file content | No | Quote |
| Zscaler | No | SASE inline | Block, isolate, allow, log | No | n/a | n/a | Uploads | No | Quote |
| Palo Alto AI Access | No | SASE and Prisma Browser | Block or allow | No | n/a | n/a | Not documented | No | Licence bundle |
| Microsoft Purview | No | Microsoft 365, Edge, endpoint DLP | Block, warn, audit | No | n/a | n/a | Cannot scan files uploaded into prompts | No | Microsoft 365 E5-class licensing |
The table is a summary. Each linked page explains the details and the caveats, including where the other tool is the better choice.
How do I choose an AI data-leak prevention tool?
Section titled “How do I choose an AI data-leak prevention tool?”Start from three questions: who sends the data, what must happen to it, and who has to run the tool.
- Employees pasting into ChatGPT, Gemini or Copilot in the browser, across a whole company? You need visibility, policy and coaching across many managed devices. Choose an enterprise GenAI DLP or SASE product (Netskope, Zscaler, Microsoft Purview, Nightfall, Harmonic). These mostly block or warn.
- Developers, agents and apps calling model APIs, where answers must stay useful? Blocking breaks the tool and plain redaction loses meaning. Choose a reversible layer that restores values in responses and tool calls: Shadow (local, open source), or a vault service such as Skyflow or Protecto if you prefer a managed service.
- Building your own pipeline and only need detection? Use a detector: Presidio, GLiNER, OpenAI Privacy Filter or a cloud PII API. Shadow can use Presidio and both open-weight models as additional detectors.
- Already standardised on an AI gateway? Check its PII features first: LiteLLM, Kong, Portkey, Cloudflare. Shadow can sit in front of a gateway as a sidecar, so masking happens before traffic leaves the host.
- Need de-identified datasets for training or analytics, not live traffic? Use a batch tool such as Tonic Textual or Google Sensitive Data Protection.
- Must the protection tool itself run inside your network, and be auditable? Prefer open-source, self-hosted tools: Shadow, Presidio, LLM Guard, LiteLLM, NeMo Guardrails, Rehydra.
What Shadow does not do
Section titled “What Shadow does not do”Being honest about the gaps helps you choose:
- No central fleet console. There is no admin dashboard, SIEM export or user coaching. Configuration is a file per machine or container.
- No OCR. Text inside images and scanned PDFs is not detected. See file masking.
- Only AI API traffic. Proxy mode intercepts a list of AI API hosts (plus any you add). It does not see what people type into chatgpt.com, claude.ai or gemini.google.com in a browser, phone apps, Microsoft 365 Copilot or GitHub Copilot.
- Detection is best effort. Regex, checksums, dictionaries and optional NER models miss things: the built-in rules leak 3.08% of sensitive values on the held-out benchmark, 0.08% with the open-weight NER sidecar.
- Recipients and provider-hosted actions see real targets. When you ask the model to write to or act on someone, Shadow passes that recipient through as written so the model addresses the right person; when the provider itself runs a tool (a hosted MCP server, web search), it keeps real the contact details the action needs. Both are defaults, configurable, and each keep is logged. See intent policy.
- It protects content, not identity. Providers still see your IP address and the account behind your API key. See the security model.
Category guides
Section titled “Category guides”All comparisons
Section titled “All comparisons”Detector libraries and models: Presidio · OpenAI Privacy Filter · GLiNER PII · DataFog · AWS Comprehend and Bedrock Guardrails · Azure AI Language PII · Google Sensitive Data Protection
Guardrails and gateways: LLM Guard · NeMo Guardrails · LangChain PIIMiddleware · LiteLLM · Portkey · Kong AI Gateway · Cloudflare AI Gateway · Lakera Guard
Enterprise GenAI DLP: Netskope · Zscaler · Palo Alto AI Access · Microsoft Purview · Nightfall · Harmonic Security · Prompt Security · Lasso Security · Strac
Privacy vaults and secure-AI platforms: Skyflow · Protecto · Private AI · Tonic Textual · Wald.ai
Local reversible proxies: Rehydra
Try Shadow
Section titled “Try Shadow”Last reviewed: 2026-10-31. All product names are trademarks of their respective owners. These comparisons are based on public documentation as of the review date. If something is out of date, please open an issue.
Frequently asked questions
What is the best tool to stop sensitive data leaking into ChatGPT or Claude?
It depends on where the data flows. To block or warn users in web chat UIs across a company, enterprise GenAI DLP (Netskope, Zscaler, Purview, Nightfall, Harmonic) fits. To mask data in API and agent traffic while keeping answers useful, a reversible pseudonymisation layer such as Shadow, Skyflow or Protecto fits. To build your own pipeline, detector libraries such as Presidio, GLiNER or OpenAI Privacy Filter are the building blocks.
What is the difference between redaction, tokenisation and reversible pseudonymisation?
Redaction replaces a value with [REDACTED] or <PERSON> and cannot be undone. Tokenisation replaces it with an opaque token that a vault can map back. Reversible pseudonymisation, which Shadow uses by default, replaces it with a realistic fake of the same format (a valid email, a Luhn-valid card) and maps it back in the response, so the model can still reason about the data.
Is Shadow free and open source?
Yes. Shadow is licensed under Apache-2.0, runs on your own machines or servers, needs no account and sends no telemetry.
Does Shadow replace a DLP platform?
Not entirely. Shadow protects the content of AI API traffic on the machines where it runs. It does not offer a central admin console, user coaching, SIEM export or coverage of devices it is not installed on. Many teams run it alongside a DLP or SASE product.
Does Shadow make us GDPR or HIPAA compliant?
No tool makes you compliant by itself. Shadow helps meet data-minimisation and confidentiality requirements by replacing detected personal data with fakes before requests reach AI providers, but compliance depends on your whole programme.
How accurate is Shadow compared with these tools?
Detection accuracy depends heavily on dataset and label mapping. Shadow publishes its methodology and results on the benchmarks page rather than quoting single numbers here.