How Shadow works: detection, vault, personas and policy

Q: How is this different from redaction?

Redaction strips meaning with placeholders such as . Shadow's fakes keep the shape of the data, so the model can still reason about it, and they are reversible, so the answer comes back with your real values.

Shadow protects AI requests in four steps: it detects sensitive values, replaces them with realistic fakes from a persistent persona, records the pairs in an encrypted local vault, and restores the real values in the response. These pages explain what Shadow does to each request and why: how it finds sensitive values, how fakes stay consistent, and how they are restored in responses.

How it worksHow Shadow masks AI traffic end to end: interception, detection, intent policy, reversible translation and restoration of streamed responses.
PersonasPersonas give Shadow one coherent fake identity per machine (company, people, domain, hostnames) so masked prompts stay realistic and consistent.
The vaultHow Shadow's local vault stores the real-to-fake mapping: ChaCha20-Poly1305 encryption at rest, multi-process sharing, export and forgetting values.
DetectionHow Shadow detects PII and secrets: checksummed patterns, secrets, dictionary terms, local machine facts, an optional NER model and Microsoft Presidio.
Intent-aware policyShadow classifies each AI request as act, report, code or converse and picks a fake, token, real value or redaction for every sensitive value.
File maskingHow Shadow masks PII in files sent to LLMs: multipart uploads, base64 and data URIs in text, CSV, JSON, DOCX, XLSX, PPTX and PDF formats.
Tool calls and agentsHow Shadow keeps AI agents working on masked data: tool-call arguments are restored locally before tools run, and provider-hosted tools follow policy.
Activity dashboardShadow's dashboard, menu-bar app and shadow top show AI traffic checked, data masked and requests blocked, by data type, provider and app. Counts only.

Frequently asked questions

How does Shadow mask data for LLMs?

It detects sensitive values in each request, replaces them with realistic, format-preserving fakes from a persistent persona, records the pairs in an encrypted local vault, and restores the real values in the response.

How is this different from redaction?

Redaction strips meaning with placeholders such as <PERSON>. Shadow's fakes keep the shape of the data, so the model can still reason about it, and they are reversible, so the answer comes back with your real values.

What happens if detection misses something?

A value that is not detected is sent as is. Detection is best effort, so test with shadow scan, add your own terms, and enable the optional NER sidecar or Presidio for free-text names.