AI privacy use cases: mask PII and secrets in LLM prompts with Shadow
These guides answer the questions people actually search for when they want to use LLMs without leaking data: how to stop customer data reaching ChatGPT, how to redact PII before the OpenAI API, how to keep API keys out of coding assistants. Each one starts with a direct answer, then gives the exact commands and configuration.
All of them use the same tool. Shadow is an open-source privacy layer that replaces sensitive values with realistic, reversible fakes before a request leaves your machine or server, and restores them in the answer.
Stop data leaking to AI tools
Section titled “Stop data leaking to AI tools”| Guide | Answers |
|---|---|
| How to stop employees pasting customer data into ChatGPT | Policy, blocking or translation; what works and what people route around |
| LLM data loss prevention (DLP) without blocking | How Shadow differs from and complements DLP products |
| Shadow AI governance | Managing unsanctioned AI tools by giving staff a safe approved path |
| Privacy for AI in customer support | Tickets, macros, support agents and ticket analytics |
Mask prompts for a specific provider or tool
Section titled “Mask prompts for a specific provider or tool”| Guide | Answers |
|---|---|
| Redact PII before sending prompts to the OpenAI API | One base-URL change for the OpenAI SDKs, Azure OpenAI and compatible APIs |
| Anonymise prompts before sending them to Claude | The Anthropic SDK, Claude Code, Bedrock and Vertex |
| Keep API keys and internal hosts out of AI coding assistants | Claude Code, Codex CLI, Aider, Continue, Cline; what is and is not covered |
| Self-hosted AI gateway with PII masking | Gateway routes, custom upstreams and sidecars for internal apps |
Build AI applications that handle personal data
Section titled “Build AI applications that handle personal data”| Guide | Answers |
|---|---|
| Mask PII in LLM agents without breaking tool calls | Restoring tool-call arguments locally; provider-hosted tools |
| Protect customer data in RAG pipelines | Where retrieval leaks, and where to put the masking |
| Redact PDFs, Word and Excel files before uploading them to AI | DOCX, XLSX and PPTX in place; PDF as text; images |
| Reversible pseudonymisation for LLMs | Surrogates, tokens and redaction; the vault; restoring answers |
Support regulatory requirements
Section titled “Support regulatory requirements”| Guide | Answers |
|---|---|
| Use LLMs in line with GDPR | Data minimisation, pseudonymisation, data protection by design |
| Use LLMs with patient data more safely under HIPAA | Minimum necessary, Safe Harbor identifiers, what Shadow does not cover |
For sector-specific guidance, see Shadow by industry.
The building blocks every guide uses
Section titled “The building blocks every guide uses”| Need | Shadow feature | Reference |
|---|---|---|
| Cover AI API tools on a laptop | HTTPS proxy with a local CA; only AI hosts are decrypted | Proxy mode |
| Cover an SDK or service | http://127.0.0.1:8877/gw/<provider>/ base URL | Gateway mode |
| Run next to an app in containers | Sidecar on localhost | Docker and Kubernetes |
| Protect your own vocabulary | organization, terms, internal_domains, shadow terms add | Detection |
| Different handling per request | act, report, code, converse intents | Intent-aware policy |
| See what would be masked | shadow scan <file> | CLI |
Try it before you read further
Section titled “Try it before you read further”shadow init --org "Acme GmbH"echo "Summarise: jane.doe@acme.example at Acme GmbH disputes a charge on card 4111 1111 1111 1111" | shadow maskThe output contains a fake email, the persona’s company name and a different card number that still passes the Luhn check. Pipe it into shadow unmask to get the original back. Nothing is sent anywhere. The full walkthrough is in the quick start, and the benchmarks show how detection performs on public datasets.
Frequently asked questions
What problem does Shadow solve?
It keeps the sensitive values it detects in prompts, files and tool results from reaching AI providers, without breaking the tools. Names, emails, IDs, card numbers, hostnames and secrets are replaced with realistic fakes before the request leaves and restored in the answer. When the goal is to write to or act on someone, that recipient is passed through as written so the model addresses the right person; recipients and the values a provider-hosted action needs are the only real values sent, and each one is logged.
How is this different from redacting PII with placeholders?
Placeholders such as <PERSON> destroy meaning, so answers get worse and actions cannot reach the real target. Shadow uses format-preserving fakes from one consistent persona and restores them in the response, including streams and tool calls. It uses typed tokens only where they work better, such as bulk reports.
Do I need to change my code?
Usually not. Point the SDK's base URL at Shadow's gateway, or set HTTPS_PROXY so the tool goes through Shadow's proxy. Rust applications can embed the library instead.
Is Shadow free?
Yes. It is open source under Apache-2.0, runs on your own machines and servers, and has no account, cloud service or telemetry.
Where should I start?
Run the five-minute quick start, then pick the guide below that matches your task. If you are rolling Shadow out to a team, read the company-size guides as well.