📸 The Enterprise Studio in Action

Interactive PII Playground (Live Detection with Visual Highlight Pills)

Inspect, scrub, and redact sensitive entities with sub-25ms latency. Visual badge pills pinpoint exactly what the engine detected before it ever leaves your network.

⚡ Overview

Enterprise PII Guardrails Studio is an ultra-fast, defense-in-depth privacy gateway designed to intercept, detect, mask, and pseudonymize Personally Identifiable Information (PII) before it reaches third-party LLM APIs (OpenAI, Anthropic, Google Gemini, Azure OpenAI) or internal vector databases.

Key Highlights:

• Sub-25ms Live Masking: In-memory LRU authorization cache and non-blocking asynchronous audit pipeline.
• Turnkey Statutory Regulatory Profiles: 1-click baseline protection for HIPAA Security Rule Safeguards (45 CFR § 164.312), GDPR Article 32 Technical Measures, PCI-DSS v4.0 Req 3.4 Shield, and India DPDP Act (2023) (with UIDAI Aadhaar, PAN, ABHA, UPI, and IFSC support).
• Zero-Leak Guarantee at Rest: Database, API keys, and audit logs are encrypted using SQLCipher 256-bit AES-CBC (with per-page HMAC-SHA512 integrity verification). Exported configurations and vault token dumps utilize Authenticated AES-256-GCM.
• SHA-256 Cryptographic Verification: Every downloaded runtime engine is verified on the fly against official SHA-256 hashes prior to execution.
• Node-Locked Licensing (v4): Commercial licenses are cryptographically locked to the host's Server Hardware ID via Ed25519 asymmetric signatures—operating 100% offline with zero cloud dependency.
• Bi-Directional Token Restoration: Effortlessly restore LLM responses (/unmask) back to original values for authorized end users.

🔄 How It Works (Zero-Trust Pipeline)

sequenceDiagram
    autonumber
    actor User as Client / App
    participant GW as PII Guardrail Gateway
    participant Cache as In-Memory Auth Cache
    participant Engine as Multi-Tier PII Recognizer
    participant DB as SQLCipher AES-256
    participant LLM as External LLM (OpenAI / Anthropic)

    User->>GW: POST /mask (Prompt with sensitive PII)
    GW->>Cache: Verify X-API-Key (< 0.1ms)
    GW->>Engine: Scan regex rules + NLP entities
    Engine->>DB: Asynchronously store reversible tokens & mapping
    GW-->>User: Return Safe Payload (<PERSON_1>, <SSN_1>)
    
    User->>LLM: Send sanitized payload
    LLM-->>User: Return completion with tokens
    
    User->>GW: POST /unmask (LLM output + mapping vault)
    GW-->>User: Return restored response with real entity values

🚀 Quickstart

Method 1: Using pip (Recommended)

# 1. Install from PyPI
pip install piiguardrails

# 2. Launch the studio
piiguardrails

On first launch, piiguardrails automatically streams the core binary, verifies its SHA-256 cryptographic checksum, provisions your encrypted database, and opens the studio dashboard on: 👉 http://localhost:8000

Method 2: Using uv (Instant Sandbox — Zero Setup)

Run directly in a self-contained, isolated environment without polluting global Python:

uv run --with piiguardrails piiguardrails

Method 3: Standalone Pre-Compiled Executable

For restricted air-gapped environments without Python installed, download the standalone binary directly from GitHub Releases:

• Windows x64: EnterprisePIIGuardrail-v2.0.8-windows-x64.exe
  • SHA-256: 43f26500fe8aed2ca78bef958639aea7317ec322ac1927fd4775fc9feea3ec37
• Linux x86_64: EnterprisePIIGuardrail-v2.0.8-linux-x86_64
  • SHA-256: 8c2c62885ecaecce1bcb458ab86aa824eee1946cfe887100dbcd01b15ffdd77a

Run directly:

# Linux
chmod +x EnterprisePIIGuardrail-v2.0.8-linux-x86_64
./EnterprisePIIGuardrail-v2.0.8-linux-x86_64

# Windows
.\EnterprisePIIGuardrail-v2.0.8-windows-x64.exe

Method 4: Docker / Podman Deployment

docker run -d \
  -p 8000:8000 \
  -v $(pwd)/data:/app/data \
  -e ACCEPT_LICENSE=true \
  -e SQLCIPHER_PASSPHRASE="your-secure-passphrase-min-32-chars!" \
  -e GUI_PASSWORD="<your-secure-password>" \
  --name pii-guardrail-studio \
  piiguardrails/enterprise-pii-guardrail:latest

🎁 Community Launch Promo: 6 Months Free Enterprise

To celebrate our v2.0 release, early adopters can unlock full Enterprise Tier features (unlimited API requests, unrestricted payload length, and custom regex policies) through March 31, 2027:

ED3-AMBGXK7UVD777777-GRYXEUYUZ432JOHY-UWVDBHXRLAXU4U47-7MBK2DQGIUV4JQT6-UJNRXNTHI3JPBGIS-P66HGKVYNLMQXHHS-M3N4RF3XDN6LZILT-WQNCGJ4KEY6ONIIM

To activate:

1. Open the studio dashboard (http://localhost:8000).
2. Go to Settings > License & Quota in the sidebar.
3. Paste the key above and click Activate License.

🧩 Python Integration Example

Once the studio is running, integrate it directly into your LangChain, LlamaIndex, or raw API pipeline:

import requests

API_KEY = "your-api-key-here"  # Generated in the Studio UI
headers = {"X-API-Key": API_KEY, "Content-Type": "application/json"}

# 1. Mask sensitive input before sending to LLM
payload = {
    "text": "Hello Alice Smith, your verification code was sent to alice.smith@acme.corp. Call us at 415-555-2671."
}

mask_response = requests.post("http://localhost:8000/mask", json=payload, headers=headers).json()
print("Masked text for LLM:", mask_response["masked_text"])
# Output: "Hello <PERSON_1>, your verification code was sent to <EMAIL_1>. Call us at <PHONE_1>."

# 2. Query your LLM with safe, masked prompt...
# simulated_llm_reply = "We contacted <PERSON_1> at <EMAIL_1> regarding the ticket."

# 3. Unmask the LLM response back to real entities for your user
unmask_payload = {
    "text": "We contacted <PERSON_1> at <EMAIL_1>.",
    "mapping": mask_response["mapping"]
}
unmask_response = requests.post("http://localhost:8000/unmask", json=unmask_payload, headers=headers).json()
print("Restored response:", unmask_response["unmasked_text"])
# Output: "We contacted Alice Smith at alice.smith@acme.corp."

🛡️ Enterprise Feature Matrix

🎁 Community Launch Promo: To celebrate our launch, early adopters can use the promotional product key above to activate the full Enterprise Tier (unlimited quota, unrestricted payload length, and unlimited custom regex patterns) free of charge through March 31, 2027.

📚 Complete Documentation Index

• 📖 API Reference Specification: Full OpenAPI / REST documentation with request/response schemas for /mask, /unmask, /health, and Admin endpoints.
• 📊 Performance Benchmarks: Latency breakdown (<25ms target, 3.8ms P50), concurrency tests, and test machine methodology.
• 🗂️ Entity Catalog: Exhaustive reference of 30+ built-in recognizers, context patterns, and mathematical checksum validations.
• 🛡️ Security Policy: Vulnerability disclosure SLAs, security practices, and incident reporting.
• 🏰 Threat Model & Trust Boundaries: STRIDE analysis, network ingress/egress profile, and local attack surface.
• 🔑 Customer Licensing Guide: Guide on tiers, obtaining your Server Hardware ID, and activating enterprise keys offline.
• 💾 Backup & Disaster Recovery Guide: Database persistence, .env encryption passphrase management, and server migration.

📋 System Requirements

• Operating System: Windows 10/11/Server (64-bit) or Linux (Ubuntu, Debian, RHEL, CentOS, Rocky, WSL2 x86_64)
• Python: >= 3.8 (if running via pip / uv)
• Memory: Minimum 2 GB RAM (4 GB recommended for high throughput)
• Network Port: Default 8000 (configurable via --port or .env)

📄 License

This software is governed by the Enterprise Evaluation and Commercial License Agreement (Repository Copy). All rights reserved.

⚖️ Statutory & Compliance Disclaimer

Enterprise PII Guardrail provides technical safeguards to assist organizations in meeting regulatory obligations (such as HIPAA Security Rule § 164.312, PCI-DSS v4.0 Req 3.4, and GDPR Art. 32). Software alone does not constitute legal certification or regulatory compliance. Organizations remain responsible for their overall compliance postures and governance policies.