You can automate redaction without uploading your documents first. The promptShield API runs the desktop app's detection engine on your own host, as a local REST service or a command-line tool. Your documents stay inside your perimeter. One thing does leave: a licence check with our server every six hours.
What a cloud redaction API asks of you
AWS Comprehend, Google Cloud DLP and Azure AI Language are good services, and they work the same way. You upload your documents, detection runs on their servers, and you get a result back. The redaction is automatic and it scales.
The cost is that your data leaves your hands. Your data moves into infrastructure you do not control, to be processed by a third party. For many workloads that is acceptable, but often not for confidential client files. Once the pipeline works, the transfer on every call is also easy to forget.
Building a redaction API is a solved problem. We asked whether you can automate redaction without the transfer. The useful question is not cloud versus local. It is who holds the document when detection runs.
The same engine, on your host
We do not run this API for you. It is the engine we wrote for the job, the same one the desktop app uses: pattern matching, entity detection and an optional local model. Your own code calls it inside your own environment.
It comes in two forms: a CLI for scripting, covered in the developer tooling post, and a self-hosted REST API. The REST API starts with docker compose up, listens on your host and talks only to your code. The API key it checks is one you issue and hold. It lets your scripts use your own engine.
An earlier post mapped how companies protect personal data: governance platforms, cloud redaction APIs, managed redaction and manual blackout. The desktop app serves a few high-value documents, where one missed name is a real incident. The API does the same for high volumes of documents, at a flat cost.
Two limits to check before you rely on it
The package is not on PyPI yet. Install the CLI from a checkout with pip install -e . rather than by name.
The container also depends on us. It revalidates its key against our licensing server every six hours. If the server is unreachable, it falls back to an offline cache that expires after three days.
So the API has no air-gapped mode. The desktop app's air-gapped tier, part of the Pro plan, is a different mechanism. The licence check never carries document content.
| Dimension | Cloud redaction API | promptShield API |
|---|---|---|
| Where detection runs | On the vendor's servers | On your host, inside your perimeter |
| What crosses the boundary | Every document you want redacted | No document. Only a licence check every six hours reaches the network |
| Codes across a batch | A fresh label per run | One stable code per entity within a folder |
| What comes back | A redacted result | Reviewable spans and a tokenized output you can compare and check before release |
Doesn't an API remove the human reviewer?
Our position is that at high stakes, automation proposes and a person decides. Anonymization fails silently, so someone has to vouch for the result. An API run unattended has no person in the loop.
The rule depends on two things: what one miss in a document would cost, and how certain you need to be. When both are high, a person must review. When both are low, automation alone is right, and making someone read ten million log lines is a waste of their time. Three design choices suit the API to low-stakes work.
- It proposes detections. It returns reviewable spans and a tokenized output you can inspect and compare before anything ships. You can add a human approval step before anything irreversible happens, and for high-value documents you should.
- It suits work where automatic redaction with occasional misses is enough. Examples are first-pass triage, test data masking, log and ticket scrubbing, and bulk pre-filtering. One miss costs little there, and a later step catches the rest.
- It works with the desktop app. The API runs a high-volume first pass and flags the documents that look high-value. Those go to the desktop app for human review. Both process documents locally, so the files stay in your perimeter at every stage. A cloud API cannot offer this, because it processes your files on its own servers.
Which one to use
- The API for pipelines, test data, logs and support tickets, or a first pass over a large set.
- The desktop app when someone must put their name to the redaction: a contract, a medical record, a discovery set, an investigation file.
- Both when a large volume holds a high-value subset. The API triages and the desktop app covers what matters.
Common questions
Does the API send my documents anywhere?
Detection runs on your host, and the only outbound call is the licence check every six hours. That check carries no document content. The free web app uses the same local approach to work in the browser with no upload.
Can it run with no network at all?
For three days at most. If it cannot reach our licensing server, the offline cache keeps it working that long. The API has no air-gapped mode, unlike the desktop app.
How do I install it?
Run docker compose up for the REST API. For the CLI, run pip install -e . from a checkout, since the package is not on PyPI yet.