Shadow vs Tonic Textual — open-source Tonic Textual alternative for live LLM traffic

Tonic Textual is a commercial platform for redacting and synthesising sensitive data in unstructured text and files, built mainly for preparing datasets for training, RAG and analytics. Shadow is an open-source (Apache-2.0) privacy layer that masks live AI traffic with realistic, reversible fakes and restores them in responses, streams and tool calls. If you are de-identifying a document corpus, Tonic Textual is built for that. If you are protecting prompts on their way to OpenAI, Anthropic or Gemini, Shadow is built for that.

At a glance

	Shadow	Tonic Textual
Open source / licence	Yes, Apache-2.0	No, proprietary
Deployment	Endpoint HTTPS proxy, gateway (`/gw/<provider>/`), Rust library	SaaS or self-hosted (Docker, Helm); SDK and API
Protection method	Reversible realistic fakes from a persona; typed tokens for reports; optional redaction	Redaction or consistent synthesis
Restores responses	Yes, automatically	Not as a proxy
Streaming	Yes, SSE and NDJSON with split-fake reassembly	No
Tool calls	Yes, arguments restored locally; intent-aware	No
Files	DOCX, XLSX, PPTX masked in place; PDF to text; CSV, JSON, HTML	Files redacted in their original format; PDF and images
Self-hosted	Yes, single binary, no account	Yes (Docker, Helm)
Price model	Free	Pay-as-you-go cloud or quote

What Tonic Textual does well

Detection quality with published numbers. Tonic’s benchmark (vendor-run, October 2025, legal, medical and call-transcript data) reports Textual ahead of AWS Comprehend and Presidio on the same data.
Consistent synthesis. Textual can replace values with realistic synthetic ones and keep them consistent across documents, so a de-identified dataset still reads naturally.
Measuring replacement quality. Tonic released PrivacyBench, a public benchmark (CC-BY-4.0) that scores not only detection but replacement quality and cross-document consistency. That is a useful contribution to the whole field.
Files in original format. Documents are redacted in place, including PDFs and images, which matters for dataset pipelines.
Flexible deployment. Cloud or self-hosted with Docker or Helm.

Where Shadow is different

Is Shadow a free alternative to Tonic Textual?

For live AI traffic, yes. Shadow is Apache-2.0, needs no account, and runs as one binary on macOS, Linux or Windows. It is not a dataset de-identification platform.

Reversible by design

Tonic’s synthesis is designed to produce a de-identified copy. Shadow’s fakes are designed to come back: every real-to-fake pair is stored in an encrypted local vault, and the model’s answer is translated back to real values before you see it.

Live traffic, streams and agents

Shadow intercepts requests as an HTTPS proxy or gateway, restores streamed responses as they arrive and restores tool-call arguments before your tools run. Tonic Textual is called on content, not placed in the request path.

Persistent persona

Shadow’s fakes come from one persistent persona per machine, so the same customer has the same fake across days and sessions, and fakes are coherent with each other (names, domains, phone dial codes from the same region).

Intent-aware policy

Shadow classifies requests as act, report, code or converse and chooses fakes, typed tokens, a logged keep or redaction per value. See intent-aware policy.

Where Tonic is ahead

Tonic handles images and scanned PDFs; Shadow has no OCR and converts PDFs to masked text. Tonic also publishes detection results; Shadow’s are on its benchmark page.

When should you choose Tonic Textual?

You need de-identified datasets for model training, fine-tuning, RAG indexes or analytics.
You need files, PDFs and images redacted in their original format.
You want a vendor-supported platform with published accuracy figures.

When should you choose Shadow?

You want prompts to AI providers masked and responses restored, in real time.
You use streaming, tool calls and agents.
You need a free, open-source, local component.

Using them together

A natural split: use Tonic Textual to de-identify the corpus you index for RAG or use for fine-tuning, and run Shadow on the request path so that whatever users paste in at query time, and whatever the retriever pulls in, is also masked before it reaches the provider.

How do they compare on accuracy?

Tonic’s numbers are vendor-run on Tonic-selected data, and Tonic Textual is not in Shadow’s benchmark. On that benchmark’s held-out set, Shadow’s built-in rules leaked 3.08% of sensitive values (0.08% with the open-weight NER sidecar) and round-tripped 100% of documents exactly.

Sources

Last reviewed: 2026-10-31. Tonic, Tonic Textual and PrivacyBench are trademarks of their owner; this comparison is based on public documentation as of the review date.

Frequently asked questions

Is Shadow an alternative to Tonic Textual?

For live AI traffic, yes; for building de-identified datasets, usually not. Tonic Textual redacts or synthesises sensitive data in documents and datasets, often for training and RAG. Shadow sits in front of AI providers and translates live requests into realistic fakes, then restores the response.

Does Tonic Textual restore original values?

Tonic Textual's focus is one-way de-identification and consistent synthesis for datasets. It is not documented as a request-and-response proxy that restores values in LLM answers. Shadow restores values automatically, including in streams and tool calls.

How much does Tonic Textual cost?

Tonic Textual offers pay-as-you-go cloud usage and quoted enterprise plans, including self-hosting. Shadow is free and open source under Apache-2.0.

How accurate is Tonic Textual?

Tonic publishes a vendor-run benchmark (October 2025) on legal, medical and call-transcript data in which Textual scores highest. Tonic Textual is not in Shadow's benchmark; Shadow publishes its own methodology and results on the benchmarks page.

Can Tonic Textual run on-premises?

Yes. Tonic Textual is available as SaaS or self-hosted with Docker or Helm. Shadow is self-hosted only, as a single binary or container.