Introduction

Shadow is an endpoint privacy layer for AI traffic. It sits between your apps and AI providers such as OpenAI, Anthropic, Google Gemini, Azure OpenAI, OpenRouter, Mistral and Groq. On the way out, it finds sensitive values in each request and replaces them with realistic, format-preserving fakes. On the way back, it turns the fakes into the real values again, streamed responses and tool calls included.

you      ── "Summarise this thread: jane@acme.com asks when Project Falcon ships to Acme GmbH" ──▶  Shadow
Shadow   ── "Summarise this thread: hui.zhao@zhilan.cn asks when Velora Quilent ships to Zhilan Technology Co., Ltd." ──▶  provider
provider ── "hui.zhao@zhilan.cn wants a ship date for Velora Quilent…" ──▶  Shadow
Shadow   ── "jane@acme.com wants a ship date for Project Falcon…" ──▶  you

The provider gets a coherent prompt about a company that does not exist. You get an answer about yours. When the goal is to write to or act on someone (“Draft a reply to jane@acme.com about Project Falcon”), Shadow passes the recipient through as written, so the model greets and addresses the right person, and logs the keep; Project Falcon and everything else that is not the recipient are still masked. Set [policy.act] targets = "surrogate" if the recipient must stay hidden from the provider too. See intent-aware policy.

The problem

Prompts carry far more than the question:

• names, emails and phone numbers of colleagues and customers;
• customer lists, invoices with IBANs, contracts with addresses;
• internal hostnames, IPs and file paths that contain your username;
• API keys and tokens pasted along with a config file;
• the name of your company and its unreleased projects.

Once a request reaches a provider, that content can end up in logs, abuse-monitoring queues, support tooling, training sets or a breach. Policies tell people not to paste sensitive data, and people paste it anyway, because the tool is useful.

The approach: translate, don’t block

Most data-loss-prevention gateways block a request when they see something sensitive. Blocking breaks the tool, so people route around it. Plain redaction replaces values with [REDACTED] or <PERSON>, which loses meaning: the model can no longer tell two people apart, write an email to the right address, or keep a table consistent.

Shadow translates. Every sensitive value maps to a stable fake of the same shape, drawn from a persistent fake identity for your machine called the persona:

Real	What the provider sees	Property kept
jane@acme.com	hui.zhao@zhilan.cn	valid email, persona domain
4111 1111 1111 1111	4837 2191 9471 3480	16 digits, valid Luhn check
DE89 3704 0044 0532 0130 00	another German IBAN	passes mod-97
Acme GmbH (your organisation)	Zhilan Technology Co., Ltd.	a company name
/Users/jdoe/src/app	/Users/huizhao/src/app	a path that still works in code

The same real value always gets the same fake, and no two real values share a fake, so the reverse translation is unambiguous. Restoration works on whole fakes, and on a fake person’s first or last name on its own (“Dear Hui,” becomes “Dear Jane,”). Other fragments, such as the last four digits of a card or the domain of an email, stay fake. The mapping lives in an encrypted vault on your machine and never leaves it.

What Shadow is not

• Not an anonymiser. Providers still see your IP address and the account behind your API key. Shadow protects the content of requests. See the security model.
• Not a perfect detector. Detection combines regular expressions, checksums, a dictionary of your own terms, local machine facts and optional NER or Presidio. It is best effort, and you can test it with shadow scan.
• Not a cloud service. There is no account, no hosted component and no telemetry.
• Not a browser or SaaS filter. Shadow covers apps that call AI provider APIs such as api.openai.com and api.anthropic.com (see supported providers). It does not see what people type into chatgpt.com, claude.ai or gemini.google.com, or into AI features built into other SaaS products.

See what your AI tools send

The activity dashboard shows how much traffic went to which provider (OpenAI, Anthropic, Gemini and others), what was masked by data type, what was blocked, and which app sent it. The same view is available from the menu-bar app on Mac and Windows and as shadow top in the terminal.

127.0.0.1:8877 · Shadow activity

The activity dashboard: traffic monitored, sensitive data masked and requests blocked.

Three ways to run it

Mode	Use it when	Setup
Proxy	You want every tool on a machine that calls a supported AI API covered	HTTPS_PROXY=http://127.0.0.1:8877 and trust a local CA
Gateway	The tool lets you set a base URL	base_url=http://127.0.0.1:8877/gw/openai/v1, no CA
Library	You build a Rust service that calls models	shadow-core crate, masking in-process

Meridian, a compliance platform, embeds shadow-core so every model call it makes is masked in-process.

Next steps

• Quick start: protect your first request in five minutes.
• How it works: the request and response lifecycle.
• Intent-aware policy: how actions, reports and agents are handled.