baldanders 0.1.2

Put real customer data through Claude and ChatGPT without it ever reaching them.

Baldanders is a local personal-data firewall for cloud LLMs. You chat with Claude, ChatGPT or Grok as usual. Names, emails, ID numbers, bank details and secrets are swapped for tokens like [PERSON_1] before anything leaves your machine, and swapped back when the reply arrives. The AI never sees the data. The token map never leaves your computer.

Why

Most teams can't put customer or employee data into AI tools, because it would be sent to a third party. So the tools get used for harmless work only, or the company pays per token for a controlled API setup.

Baldanders removes that limit at the source. Staff keep using the seat licences you already pay for, on real work with real data, and personal data is stopped on the laptop before it goes out. Run with -v to see exactly what was sent.

Quick start

pip install "baldanders[all]"
baldanders download     # one-time, ~320 MB name & address model, runs offline afterwards
baldanders              # chat with Claude through your Claude Code login

How it works

Detection runs locally, in three layers:

1. Your rules. Terms and patterns from your config that must always be hidden.
2. Deterministic detectors. Emails, phones from any country, cards, IBANs, 55+ national ID formats and secrets, each checksum-validated where the format has a checksum.
3. A multilingual AI model (optional) for names and street addresses in 20+ languages.

Each match becomes a token. Only the cleaned text is sent, plus a short instruction asking the AI to keep the tokens intact. Tokens in the reply are replaced with the real values on your side.

Providers

baldanders                      # Claude, via your Claude Code login (no API key)
baldanders -p chatgpt           # ChatGPT, via your Codex CLI login (no API key)
baldanders -p grok              # Grok, via grok-cli (SuperGrok / X Premium+, no API key)

baldanders -p anthropic-api     # Claude API (ANTHROPIC_API_KEY or `ant auth login`)
baldanders -p openai-api        # OPENAI_API_KEY
baldanders -p deepseek          # DEEPSEEK_API_KEY
baldanders -p groq              # GROQ_API_KEY
baldanders -p openai-api --base-url http://localhost:11434/v1 -m llama3   # any OpenAI-compatible API

Usage

baldanders -v                   # show exactly what leaves your machine
baldanders --no-save            # don't write this conversation to disk
baldanders sessions             # list saved sessions
baldanders --resume 20261002-143022
baldanders sessions --delete 20261002-143022

Inside the chat:

Scrub text without talking to any AI, for scripts and pipelines:

echo "Call me on +54 9 11 4567-8901" | baldanders scrub
# Call me on [PHONE_1]
baldanders scrub --json "IBAN DE89 3704 0044 0532 0130 00"

What gets scrubbed

• Contact details: emails (including non-Latin addresses), phone numbers from any country (Google's libphonenumber).
• Financial: credit cards (Luhn-checked), IBANs for 89 countries (length and mod-97 checked), crypto wallets.
• Identity: 55+ national ID and tax number formats, passport numbers next to a keyword, dates of birth.
• People and places: names and street addresses, with the model installed.
• Network: IPv4/IPv6 and MAC addresses.
• Secrets: API keys (AWS, GitHub, GitLab, Slack, Stripe, Google, OpenAI, Anthropic, Hugging Face, npm), JWTs, private keys, passwords in password: … / contraseña = … / database URLs.

Ordinary text is left alone: code, SQL, version numbers, order numbers, amounts, ordinary dates and city names. If something is over-scrubbed anyway, the AI only sees a token and you still get the real value back.

Configuration

~/.baldanders/config.yaml is created on first run:

regions: [AR, US]        # local phone formats to recognise; empty = guess from OS locale
paranoid: false          # scrub checksum-valid IDs even without a keyword nearby
# ner_threshold: 0.6     # name/address model confidence (default: names 0.7, addresses 0.4)
save_sessions: true

allowlist:               # never scrub these
  - my-s3-bucket-name

denylist:                # always scrub these (case-insensitive) as the given type
  "Project Falcon": PROJECT

custom_patterns:         # extra regexes; first capturing group is scrubbed if present
  customer_id: "CID-\\d{8}"

Use denylist and custom_patterns for anything specific to your organisation: client names, project code names, internal customer IDs.

Set BALDANDERS_HOME to keep config, sessions and the model somewhere other than ~/.baldanders.

Privacy notes

• What is sent: only the scrubbed text, plus a short instruction telling the AI to keep the tokens intact. Run with -v to see every byte.
• What stays local: the token map, the model, and your config. Saved sessions (~/.baldanders/sessions/) contain the real values so --resume works. They are readable only by your user. Turn them off with --no-save or save_sessions: false.
• Subscription CLIs: Baldanders runs claude and codex in an empty private directory. For Claude Code, all tools and MCP servers are disabled, so the AI can't read your files. Codex runs in its read-only sandbox, so it can still read files outside that directory if it chooses to. Prefer -p claude or an API provider for sensitive work. These CLIs add their own context to each request (OS, working directory path, and for Claude Code your personal ~/.claude/CLAUDE.md if you have one). Baldanders doesn't control that context.
• No detector is perfect. Unusual names, free-form addresses, or IDs written in unexpected ways can slip through. Check -v output when it matters, and add anything specific to your work to the denylist.

Install options

pip install baldanders                 # core: regex/checksum detectors, all providers except the API ones
pip install "baldanders[ner]"          # + name & address model (pulls in PyTorch, ~1 GB)
pip install "baldanders[anthropic]"    # + direct Claude API provider
pip install "baldanders[all]"          # everything

pipx keeps it isolated: pipx install "baldanders[all]".

Requirements: Python 3.10+, plus the CLI for the provider you use:

• -p claude: Claude Code, logged in
• -p chatgpt: Codex CLI (npm install -g @openai/codex, then codex login)
• -p grok: grok-cli (grok-cli login)

Development

pip install -e ".[dev,ner,anthropic]"
baldanders download   # optional: enables the NER integration tests
pytest

The name

Baldanders is the shape-shifter from Borges' Book of Imaginary Beings, taken from Grimmelshausen's Simplicissimus. The name means "soon different". Your data does the same: it leaves as a mask and comes back as itself.

License

MIT