LiteLLM routes your AI traffic. Protecto sits in that path, finds what is sensitive, and masks or reveals it by policy. Your agents need minimal changes.
SOC 2 Type II · ISO 27001 · HIPAA, BAA available · On premises or private cloud
A support rep asks an AI assistant to open a ticket for Priya Shah. The request carries her name, email, account number, and a note about her missed loan payment. Most organizations have a data policy that keeps customer data away from external LLMs, so the team strips it at the gateway.
The model drafts the ticket and calls the ticket tool. The tool needs Priya’s real name and email, but it gets a placeholder, and the ticket fails.
Each step needs different data. The model can work from tokens. The ticket tool needs the name and email, but not the loan note. Blocking alone is not a policy. You need to mask what leaves and unmask only what each tool is allowed to see.
A Protecto adapter connects to LiteLLM’s request and response flow, so your agents keep calling LiteLLM. Supported sensitive data is masked before it reaches the model provider.
External models receive tokens in place of real values.
Policies and recorded activity give your team one place to show how sensitive data is handled.
Real values stay in your environment.
The Protecto dashboard shows protection activity by model, application, tool, and policy. Analytics events carry counts and outcomes, and leave out raw prompts and original values.
LiteLLM decides which callers can use a model or tool. Protecto decides which real values they receive. Rules work field by field, so a ticket tool can get a name and email while the details in its description stay masked.
Authorized editors save a new policy revision, and each change records who made it. New requests use the new revision.
Traditional DLP and PII masking can break AI workflows. Protecto works alongside your DLP and covers the AI traffic it was not built to handle.
Protect data across agents, models, and tools from the gateway they already use.
Protecto runs on premises or in your private cloud. Real values stay in your environment, and external models only receive tokens.
You keep LiteLLM as your AI traffic gateway. Protecto is a separate product that integrates with it, with Privacy Vault built in.
LiteLLM authenticates the caller, and Protecto uses that validated user and team, never an identity claim typed into a prompt.
Privacy Vault detects 50+ entity types across PII, PHI, and PCI, plus custom entities you define. It replaces them with format-preserving tokens before the request goes to the model.
Protecto examines generated text and tool arguments, and restores originals only where policy permits. Everything else stays masked.
Identifiers, counts, and outcomes go to the dashboard.
LiteLLM has hooks for open-source guardrails like Presidio, which find PII and mask it or stop the request. Agents call tools, run many turns, and need some data back.
| Open-source guardrails in LiteLLM | Protecto | |
|---|---|---|
| What happens to a value | Masked with a label such as [PERSON], or the request is stopped | Replaced with a consistent, format-preserving token. Same person, same token, across sessions, RAG, and tool calls |
| What the model sees | [PERSON] in the documented examples, so the model can mix up customers and hallucinate | <PERSON>agjwd</PERSON> and <PERSON>qk3vz</PERSON>. The model keeps track of who is who |
| Tool calls and MCP | Can check tool inputs before an MCP call. The docs show no per-field release of real values to a tool | A permitted tool gets real values, scoped to the fields its task needs. Everything else stays tokens |
| Getting values back | Can restore values in the response after the model call. The docs show no per-user or per-tool rule for this | Every token maps back through the vault. Policy decides who gets which value, per user, tool, and task |
| What counts as sensitive | Presidio entity types, plus custom recognizers you build and tune. English by default, other languages by configuration | DeepSight, a multi-agent engine: a fine-tuned proprietary LLM with NER, NLP, and regex. PII, plus business-sensitive data such as pricing, contract terms, and deal status with CBAC. Seven tested languages. New types in days |
| Session-aware masking | The docs describe no memory across turns | Remembers what it masked in the session. Each turn masks only the new text. Flat latency across long agent runs |
| Proof of what happened | Logs masked entity types, confidence scores, and counts | One record per request: who, which policy, which values, to where. You set retention and purge |
| Where it runs | Runs where you host Presidio and LiteLLM. Per-key and per-team settings choose guardrails, not who sees which value | Customer VPC, on-prem, air-gapped. Multi-tenant, DR-ready, vault under your keys |
An independent UT Dallas benchmark found higher F1 for Protecto than for Presidio. See the full comparison
Proven in production on regulated data. Results come from Protecto Privacy Vault deployments, not from LiteLLM traffic.
Recall on sensitive data with 96% precision, including Arabic, at Bank Muscat
Semantic accuracy retained after masking at Bank Muscat
Long texts processed per day at a SaaS company
“Protecto enabled us to deliver data security, privacy, and compliance for our AI features at scale across 5,000+ enterprise clients, strengthening customer trust in our AI automation solutions.”
No. LiteLLM is a separate product and stays your gateway. Protecto adds data protection to its request and response flow.
Very little if they already call LiteLLM. Check that streaming clients can accept delayed release, tools are declared, and tool results and retrieved passages go back through LiteLLM as supported text.
Protecto is model agnostic. It works with the providers you route through LiteLLM, such as OpenAI, Anthropic, Google, or self-hosted models.
Text chat, retrieved passages and tool results in the request, generated text and tool arguments in the response, the Responses interface, and text sent for embeddings. Provider-hosted retrieval, opaque files, images, audio, and traffic outside the gateway are outside this path. Privacy Vault detects 50+ entity types across PII, PHI, and PCI, plus custom entities.
Yes. MCP traffic is treated like any other tool call. Before a tool needs an MCP call, Protecto unmasks the data your policy permits, so the call works. When data comes back on its way to the LLM, Protecto checks it and masks it based on your policy.
Yes. Protecto can be hosted on premises or in your private cloud. Real values stay in your environment, and external models only receive tokens.
Yes. Protecto holds partial tokens until they can be read safely, and holds tool arguments until the full structure is ready for a policy check.
The affected operation stops, and Protecto does not guess at original values. A reporting failure does not turn protection off.
No. DLP keeps covering email, files, and endpoints. Protecto covers the AI traffic that DLP was not built to handle.
Gateway latency depends on prompt size, entity density, selected model, synchronous versus asynchronous masking, and whether tool arguments require resolution. During deployment, Protecto measures median and tail latency against the customer’s representative prompt sizes and workflows.
Bring a real agent workflow, with test data if you prefer. We will show what gets masked, what each tool receives, and what your team sees in the dashboard.
