Privacy Gateway for AI Chat
Use any model. The model never sees the real values.
Protecto Privacy Gateway for AI Chat masks sensitive values before the prompt leaves your infrastructure and unmasks them on the way back. Tool calls that need a real value still resolve at the boundary. Your users see real data. The model holds a surrogate at every point in the conversation.
Model choice stops being a security decision and becomes a quality decision, because the model never receives a real value.
The constraint
You self-hosted because it was the only way. It isn't anymore.
| Before the Gateway | With the Gateway | |
|---|---|---|
| To keep sensitive data private, you had to | ✕ self-host, and accept whichever models you could run | ✓ nothing. Use any model. |
| Model choice was | ✕ a security decision | ✓ a quality decision |
| Frontier models were | ✕ off limits for sensitive work | ✓ available, because the model never sees real values |
Across the deployments we have run in banking, healthcare and enterprise SaaS, almost nobody self-hosted because they wanted to run their own inference. They self-hosted because it was the only way to use AI on this data at all. The price was the model list: whatever you could stand up on your own hardware, not whatever was best for the task.
The Gateway removes the reason for that trade. Sensitive values never leave your infrastructure in the clear, so the provider on the other end holds surrogates. Today that means OpenAI or Gemini, whichever you route to, alongside the local model you already run.
Session persistence
Your session history is sitting in the provider's infrastructure.
When you send a prompt to a hosted model, the exposure is not only the prompt you just sent. The session persists on the provider’s side: every earlier message, the context built across turns, the detail a user typed three questions ago. You control none of it. Not retention, not access, not training use, not third-party sharing.
Sensitive information also accumulates differently across a conversation than it appears in one prompt. Nothing in turn four looks sensitive on its own. Turns one through four together identify a patient.
Run a self-hosted chat interface behind the Gateway and the session stays on your infrastructure. The provider only ever holds masked values, on every turn, for the life of the conversation.
How it works
Mask before the model. Unmask after. Tool calls keep working.
Prompt in
The user types normally. Sensitive entities are detected and replaced with format-preserving surrogates before the prompt leaves your infrastructure. The model receives a prompt that is structurally intact and that it can still reason over.
Retrieved context in
Uploaded files and retrieved passages are masked before they enter the prompt. Ask for a summary of a document and the model generates it from surrogate values, so a file upload does not become the gap in the control.
Tool call
This is the point that decides whether the workflow still works. If a masked surrogate reaches a tool without authorized resolution, an exact-match lookup can fail or return no result, and the model answers confidently from that empty result. The Gateway resolves supported tool arguments at the tool boundary: the lookup runs on the real key, and the model never held one.
Response out
The response is unmasked for the authorized user on the way back, using controlled boundary resolution authorized by a per-user Protecto token.
Why DLP breaks here
Detection is the part everybody has.
Every tool in this category can find the sensitive value. The value gets replaced. Then the workflow needs it back. A control built to stop data from leaving has nowhere to put that requirement.
- The tool call fails without authorized resolution. If a masked surrogate reaches a tool without authorized resolution, an exact-match lookup can fail or return no result, and the model answers confidently from nothing. Protecto Gateway resolves supported tool arguments at the tool boundary.
- Redaction and rescanning cost tokens, processing, and latency, unevenly. Redaction or surrogate markers can change token usage, while repeated scans at each workflow step add processing and network latency and may add service cost. The impact depends on value length, tokenizer, payload size, and replay behavior. A long value does not automatically inflate; a long value can become a shorter token and vice versa.
- Scan-then-forward delays the first token. Prompt inspection has to complete before the first model token can go out, because a scan-then-forward architecture needs the full payload before it can decide. Protecto Gateway can stream the model’s response afterward; how much of the preprocessing shows progress depends on the endpoint and tool-turn constraints.
Works with your stack
Broad on interfaces. Narrow on use case.
Any chat interface
The Gateway is decoupled from the chat interface. It runs in the request path between the interface and your model providers, so changing the UI does not move the control. LibreChat integration available today.
Protecto + LibreChat →
OpenAI and Gemini
The Gateway exposes OpenAI-compatible APIs and translates protected conversations to either OpenAI or Gemini. Masking happens before the request leaves your infrastructure, so the provider you route to is a configuration choice, not a security review.
Chat, on purpose
This is built for chat workflows. Not agent frameworks, not RAG pipelines, not the whole AI stack. We would rather tell you where the edge is than have you find it in a POC.
Security & compliance
Certified, audited, and enterprise-ready
Protecto combines Privacy Vault capabilities with enterprise data security vault controls, including independently verified safeguards and ready-to-use policies for regulated data across SaaS, on-premises, and air-gapped deployments.
SOC 2 Type II
Audited controls
ISO 27001
Certified ISMS
HIPAA
BAA available
GDPR
EU data ready
DPDP
India · pre-built
CCPA / CPRA
US privacy
- Independently verified to outperform AWS Comprehend and Microsoft Presidio · audit logs on every scan, mask, and unmask.
FAQ
Common Questions
So you renamed Protecto Vault?
The detection and masking engine is Vault, and it is already in production at named enterprise customers. What is new is where it runs and what it does on the way back. The Gateway sits in the chat runtime path and resolves a tagged value at the tool boundary whenever it is present and the per-user Protecto token permits it, so tool calls resolve and the user sees real data while the model never held a real value.
What does this add to latency per turn?
Gateway latency depends on prompt size, entity density, selected model, synchronous versus asynchronous masking, and whether tool arguments require resolution. During deployment, Protecto measures median and tail latency against your representative prompt sizes and workflows.
What does the Gateway protect?
Protecto Gateway is designed to detect and mask supported entity-based sensitive data, including common personal, health, payment, account, government, and customer identifiers, before protected chat content reaches the model provider.
Where does the mapping between masked and real values live, and who can reach it?
Protecto is built primarily for on-prem, VPC, or air-gapped deployment — the mapping and the masked data stay inside your environment by default. Protecto maintains the authoritative token-to-value mapping in the configured Privacy Vault. The Gateway holds mappings transiently while processing a request, and your chat interface stores encoded replay data used to reconstruct masked history. Unmasking uses a per-user Protecto token. Access to the vault, chat interface artifacts, and operational logs must be restricted.
Why not just run a local model and skip all this?
A local model is a legitimate choice and plenty of good teams have made it. It is also a choice most teams made because it was the only one available, and it costs capability on every task where a frontier model is better. The Gateway does not argue against your local model. What changes is that using OpenAI or Gemini alongside it stops being a security decision.
Which chat interfaces does this work with on day one?
The Gateway is decoupled from the chat interface, so nothing in the architecture is tied to one UI. LibreChat is the integration available today. Open WebUI and other interfaces are available on request, and the fastest path is a short call where we look at your instance.
Does the model still produce good answers on masked data?
Yes, because the masking is context-preserving and format-preserving rather than blanket redaction. The model reasons over structurally intact, consistent values instead of blacked-out text. In a deployment at a large bank in the Middle East, semantic accuracy held up well after masking.
Can I attach a file directly to the model instead of pasting it into the prompt?
No. Attaching raw file bytes directly to the model provider is not supported. Files are read through the chat interface and masked before their content enters the prompt, which is what keeps the control in place.
Does the Gateway authenticate who is chatting?
No. The Gateway does not itself authenticate the chat session. It trusts caller-supplied identity and relies on network placement, the same as the systems in front of it. What it does control is what each authenticated user sees once identity is established: masking and unmasking run against policies keyed to user and group role, so teams see the values they’re permitted to see and nothing more.
See it against your own stack.
Bring the model you wanted to use and the data you were told you could not use it on. We will run it.
- SOC2 Certified
- HIPAA Compliant
- GDPR Ready
- ISO 27001