Shadow vs Protecto — open-source Protecto alternative for LLM data privacy

Protecto is a commercial AI data privacy platform that replaces sensitive values with consistent “semantic” tokens and unmasks them under policy, as SaaS or in your own cloud. Shadow is an open-source (Apache-2.0) privacy layer that replaces values with realistic, reversible fakes on the endpoint and restores them in responses, streams and tool calls. Choose Protecto when you want a governed, enterprise-wide tokenisation service. Choose Shadow when you want a free, local layer in front of AI providers.

TL;DR

Both tools pseudonymise reversibly, which keeps AI useful without exposing originals. Protecto emphasises cross-system token consistency, policy-controlled unmasking and database FPE. Shadow emphasises the traffic path: realistic persona-based fakes, automatic streaming and tool-call restoration, intent policy and Office file masking, all local and free.

At a glance

	Shadow	Protecto
Open source / licence	Yes, Apache-2.0	No, proprietary
Deployment	Endpoint HTTPS proxy, gateway (/gw/<provider>/), Rust library	SaaS or VPC deployment; GPTGuard secure chat
Protection method	Reversible realistic fakes from a persona; typed tokens for reports; optional redaction	Reversible semantic tokens; format-preserving encryption for databases
Restores responses	Yes, automatically	Yes, via unmask API under policy
Streaming	Yes, SSE and NDJSON with split-fake reassembly	Not documented in the docs we reviewed
Tool calls	Yes, arguments restored locally; intent-aware	Not documented
Files	DOCX, XLSX, PPTX masked in place; PDF to text; CSV, JSON, HTML	Not documented in the docs we reviewed
Self-hosted	Yes, single binary, no account	VPC option
Price model	Free	Quote

What Protecto does well

• Consistency across systems. Protecto’s tokens are designed to be the same for the same value across databases, pipelines and AI applications, which helps analytics and RAG over tokenised data.
• Policy-governed unmasking. Authorised users and services can unmask tokens; others see only tokens. That is a good fit for organisations with many consumers of the same data.
• Database protection too. Format-preserving encryption for databases extends the same approach beyond prompts.
• Published methodology. Protecto has published a benchmark white paper comparing its detection with Presidio and AWS Comprehend (vendor-run).
• Packaged product. GPTGuard gives teams a secure chat experience without building one.

Where Shadow is different

Is Shadow a free alternative to Protecto?

Yes. Shadow is Apache-2.0, runs as a single binary with no account and sends no telemetry. You can deploy it on a laptop in minutes or as a sidecar in Kubernetes.

Realistic fakes, not tokens, by default

Tokens are clear and safe but read as tokens to a model. Shadow’s default is a realistic, format-preserving fake from a persistent persona: names that fit a region, emails at a coherent fake domain, Luhn-valid cards, mod-97-valid IBANs. For bulk data, Shadow’s intent policy switches to typed tokens such as [PERSON_0007], so you get both styles where each works best.

Restoration is automatic

With Shadow you don’t call an unmask API. Fakes are restored in JSON responses, in streams even when split across events, and in tool-call arguments before your tools run.

Endpoint proxy

Shadow intercepts AI traffic as an HTTPS proxy for every tool on a machine, decrypting only known AI API hosts and tunnelling everything else untouched. See proxy mode. That covers desktop and CLI tools that can’t be rewritten to call an API.

Office files

Uploaded DOCX, XLSX and PPTX files are masked in place and remain valid documents. See file masking.

What Shadow lacks

Shadow has no central policy server, role-based unmasking or organisation-wide token service. Each machine or container has its own persona and vault, which can be shared by copying files.

When should you choose Protecto?

• You want a single tokenisation service across databases, data pipelines and AI apps.
• You need role-based, audited unmasking for many teams.
• You want a vendor-supported product with a managed chat interface.

When should you choose Shadow?

• You want masking on the endpoint, before anything leaves the machine, with no third-party service.
• You use streaming and agents and want restoration to just work.
• You want realistic fakes that keep answers natural.
• You need a free, open-source tool you can audit.

Using them together

If your data is already tokenised by Protecto upstream, Shadow can still run on developer machines and services to catch values that appear outside tokenised flows: pasted logs, config files with secrets, internal hostnames and file paths. The two layers don’t conflict.

Migrating LLM traffic from Protecto

1. Identify the LLM calls that mask and unmask through Protecto.
2. Run Shadow as a gateway and point those calls at http://127.0.0.1:8877/gw/<provider>/....
3. Remove the explicit mask and unmask calls.
4. Add organisation names and codenames as dictionary terms; enable the optional NER sidecar or Presidio for free-text names.
5. Validate with shadow scan before switching production traffic.

How do they compare on accuracy?

Protecto’s white paper compares it with Presidio and Comprehend; it is vendor-run, and we have not reproduced it. Shadow’s benchmark publishes code, datasets and label mappings so results are reproducible.

Sources

• Protecto
• How Protecto works (architecture)
• Protecto benchmark white paper (vendor-run, PDF)
• Shadow intent-aware policy

---

Last reviewed: 2026-10-31. Protecto and GPTGuard are trademarks of their owner; this comparison is based on public documentation as of the review date.

Frequently asked questions

Is Shadow an alternative to Protecto?

For masking AI traffic, yes. Both replace sensitive values reversibly before a model sees them. Protecto uses consistent semantic tokens and an unmask API, as SaaS or in your VPC; Shadow uses realistic fakes from a local persona and restores them automatically as a proxy, gateway or Rust library.

What are Protecto's semantic tokens?

Protecto replaces sensitive values with tokens that stay consistent across systems, so the same customer gets the same token everywhere, and authorised users can unmask them under policy. It also offers format-preserving encryption for databases.

How much does Protecto cost?

Protecto is priced by quote; public pages we reviewed do not list prices. Shadow is free and open source under Apache-2.0.

Can Protecto run on-premises?

Protecto offers SaaS and deployment in your own cloud (VPC). Shadow runs on any macOS, Linux or Windows host, server or container, with no hosted component.

Does Protecto restore values in streamed LLM responses?

Protecto offers an unmask API. Public docs we reviewed do not describe streaming (SSE) restoration or tool-call handling. Shadow restores both automatically.