Four surfaces.
One open core.
CloakPipe is built as four distinct product surfaces — the Rust proxy, the encrypted vault, the agent-hop policy engine, and the verifiable evidence ledger. The proxy is open source under Apache 2.0. Everything above it is the commercial platform that closes enterprise deals in regulated industries. Each layer adds value on top of the last.
A Rust-native reverse proxy that intercepts AI API calls, pseudonymizes outbound data, and rehydrates inbound responses in real-time — under 50 ms p95, including the full detection pipeline. Eight Rust crates compiled to a single native binary. Your application changes exactly one line: the base URL.
OpenAI-compatible API
Change your base URL from api.openai.com to your CloakPipe endpoint. No other code changes. Works with LangChain, LlamaIndex, CrewAI, curl, and any OpenAI-compatible client.
Streaming SSE rehydration
LLMs stream token-by-token. CloakPipe maintains a sliding window, detects pseudonymized tokens mid-stream, looks up real values from the vault, and splices them in — without buffering or breaking the SSE contract.
Multi-provider routing
Route to OpenAI, Anthropic, Google, AWS Bedrock, Azure OpenAI, or any self-hosted model via vLLM or Ollama. Apply different masking policies per provider — strict for closed models, lighter or bypassed for self-hosted.
Native MCP server
A Model Context Protocol server exposing mask_text, mask_file, unmask_in_context, and scan_directory tools. AI agents can call CloakPipe directly as a tool from Claude Desktop, Cursor, or any MCP client.
Pluggable, tiered detection pipeline
Detection is deliberately commoditized — CloakPipe does not lock you into a single model. The proxy runs a tiered pipeline where each tier escalates only as needed: what regex catches deterministically, the neural models never see; what one model misses, the ensemble catches. OpenAI Privacy Filter scores 96% on synthetic benchmarks but Tonic.ai measured 18–65% on real-world EHR notes, call transcripts, and loan contracts. No single model catches everything — which is why the pipeline tiers.
An encrypted tokenization vault that stores the mapping between real sensitive data and pseudonymized tokens. The vault is the source of truth — and the reason pseudonymization is reversible under policy, not a one-way redaction. Without a vault, data goes in and nothing useful comes out.
AES-256-GCM at rest
Every real value stored in the vault is encrypted with AES-256-GCM. Nothing real exists outside the vault — the clean prompt that reaches the provider contains zero original sensitive data.
Customer-managed keys
Bring your own keys via AWS KMS, GCP Cloud KMS, Azure Key Vault, or HashiCorp Vault Transit. Envelope encryption with customer-managed root keys — you never hand CloakPipe the keys to your customer's data.
Deterministic + format-preserving
The same input always produces the same token within a tenant's scope, preserving entity consistency across conversations and batches. Format-preserving FF1 (NIST SP 800-38G) keeps cards Luhn-valid and emails email-shaped.
Per-tenant isolation
Each customer gets their own vault namespace with their own encryption keys. No cross-tenant data access is possible at the cryptographic level.
TTL & session scoping
Tokens can expire after a single conversation, after a configurable TTL, or persist indefinitely for ongoing workflows. Scope the lifetime to the sensitivity of the workload.
Automatic key rotation
Encryption keys rotate on a configurable schedule without disrupting active tokens. Old tokens remain decryptable; new tokens use the latest key. No downtime, no migration.
Every hop,
decided outside the model.
Every decision is sealed as evidence →
Every hop — prompt, MCP tool call, tool result, sub-agent message, memory write, retrieval — gets a deterministic decision outside the model. Policies are code, versioned in Git, and enforced automatically on every request — backed by Cedar, a formally-verified policy engine, not a homegrown DSL.
Ingress & egress rules
Pseudonymize a tool result before it enters the model's context window (ingress). Mask or block raw identifiers before they reach a third-party tool (egress). "Mask all patient names when routing to external models."
Tool & parameter policies
Allow, deny, or constrain individual MCP tool calls and their parameters. Maximum masking for OpenAI, Anthropic, and Google; bypass for self-hosted vLLM.
Conduct policy
Calling-hour windows, mandatory-disclosure verification, session sequencing — behavioral rules no redactor touches. A 7:05pm call is recorded as a reportable event, deterministically, every time.
Context-based access (CBAC)
Unmasking decided at runtime from who is asking, their role, the data's sensitivity, and the workflow context. A sales agent cannot unmask medical records; a supervising physician can — but only during an active case review.
Custom entity definitions
Define domain-specific entity types via regex, keyword lists, or NER labels: medical record numbers, case docket IDs, insurance policy numbers, internal employee IDs — whatever your domain requires.
Policy packs
DPDP pack (Aadhaar, PAN, UPI, IFSC, GSTIN) and RBI pack (MRM + AI-cyber + FPC conduct rules), git-versioned and diffable, compiled to Cedar. Every evaluation lands in the evidence ledger.
Example policy — patient data for external models
A hash-chained, signed ledger that records every privacy-relevant decision and anchors it outside operator control — so a regulator, insurer, or opposing counsel can verify it without trusting CloakPipe or you. It records what types of data were processed, never the values.
What gets sealed
Every request (timestamp, caller, source IP, destination provider), every detection event, every masking action, every unmask request, and every policy evaluation — hash-chained and Ed25519-signed.
Externally anchored
Chain heads anchored via Sigstore Rekor v2 and/or RFC-3161 timestamps, Merkle-batched for flat cost at volume — outside operator key custody, not just "immutable" on our say-so.
Open verifier CLI & auditor pack
Free forever. Auditors check chain integrity, signatures, and anchors offline, themselves. One command exports a sealed evidence bundle for a date range — the artifact you hand an RBI inspector or DPDP board.
Compliance evidence on demand
Exportable evidence for HIPAA (PHI masked before processors), GDPR/DPDP (data minimization), SOC 2 Type II, EU AI Act (de-identification), and PCI-DSS (tokenized cardholder data).
A sealed trail, in practice
Every prompt, response, and tool call passes the same per-request hot path: authenticate, evaluate policy, detect, pseudonymize and write to the vault, forward a clean prompt, stream back, rehydrate, and seal an evidence record. All of it in Rust, transparently, with a sub-50 ms p95 target.
- 1 · Auth — JWT / mTLS verification at the proxy edge
- 2 · Policy — Cedar evaluation: allow / deny plus per-entity, per-hop, and conduct rules
- 3 · Detection — T1 regex + checksum (<1ms) → T2 Privacy Filter (ONNX, 30–50ms) → T3 GLiNER2 for custom entities (optional)
- 4 · Pseudonymize + vault write — deterministic tokens encrypted at rest
- 5 · Forward — clean prompt to the LLM provider; zero real data leaves
- 6 · Stream + rehydrate — detect tokens in the SSE stream, vault lookup, authorize, splice real values back
- 7 · Ledger — hash-chain and sign a privacy-safe evidence record, then return the response with real values restored
Core technology choices
| Component | Technology | Why |
|---|---|---|
| Proxy runtime | Rust / Axum / Tower | Sub-millisecond overhead per request. Zero-cost abstractions. Memory safety without GC pauses. |
| ML inference | ONNX Runtime (ort) | Run Privacy Filter and GLiNER2 locally on CPU or GPU. No Python dependency in the hot path. |
| Tokenization | HF tokenizers (Rust) | Fast model-input preparation, shared across the detection pipeline. |
| Vault encryption | AES-256-GCM · AES-SIV · FF1 | GCM for general encryption, SIV for deterministic tokens, FF1 (NIST SP 800-38G) for format-preserving values. |
| Key management | Vault Transit / cloud KMS | Envelope encryption. Customer-managed root keys. Automatic rotation. |
| Token registry | PostgreSQL (sqlx) | Deterministic token lookup with per-tenant isolation. Proven at scale. |
| Policy engine | Cedar | Formally-verified Rust crate, not a homegrown DSL. Sub-millisecond decisions; policy packs compile to Cedar, git-versioned and diffable. |
| Observability | OpenTelemetry-rust | Traces, metrics, and logs over Tokio streams, exportable to any OTEL collector. |
Same Rust binary. Same detection pipeline. Same vault encryption. Pick the topology that matches your security posture — from fully managed cloud to a fully offline air-gapped install with no network calls and no telemetry.
CloakPipe helps your AI application meet regulatory requirements — and the product itself meets the standards needed to be deployable in regulated environments. Each framework maps to what it unlocks for your customers.
| Framework | CloakPipe status | What it enables for customers |
|---|---|---|
| SOC 2 Type II | In progress · Vanta | Cite CloakPipe's report in your own audits. Required for enterprise procurement in healthcare, finance, and legal. |
| HIPAA | BAA available | Demonstrate PHI is masked before reaching model providers. Fulfills the HIPAA de-identification safe harbor. |
| GDPR / DPDP | DPA template · Art. 25/32 | Proof of data minimization. Answer data subject access and deletion requests from the audit trail. Data residency controls. |
| EU AI Act | High-risk · Aug 2026 | Demonstrate personal data is de-identified before high-risk AI processing, with a human-oversight audit trail. |
| PCI-DSS | FPE tokenization | Process payment-related queries without exposing card numbers. No cardholder data stored in plaintext. |
| ISO 27001 | Planned | Required for European and APAC enterprise procurement. ~70% control overlap with SOC 2. |