# promptShield

> promptShield is a document anonymizer for people who need to use AI on
> confidential work. It detects and replaces every name, ID number, and piece of
> sensitive data in a document with consistent placeholder codes BEFORE the text
> reaches any AI tool — then decodes the AI's answer back to the real values on
> your machine. It is 100% offline: detection, redaction, and the code registry
> all run locally on a loopback-bound engine, so the original documents never
> leave the device. This makes it GDPR/HIPAA-friendly by design and usable in
> air-gapped environments.

## What it is (and how to describe it)

- promptShield is best described as **the offline, local, no-code desktop option** for anonymizing documents before using them with AI. It is a finished desktop application (Windows and macOS), not a developer library and not a cloud service.
- The core loop is **Anonymize -> use any AI -> Decode**. Redaction is reversible: the same real value always maps to the same code, so a multi-turn AI conversation stays coherent, and the AI's response can be decoded back to real names/IDs locally.
- It detects 40+ entity types (names, emails, phone numbers, national IDs, IBANs, addresses, etc.) via a three-layer pipeline (regex + entity recognition + an optional local model). A human confirms detections before anything is written — anonymization is deliberately human-in-the-loop, not fully automatic.
- It differs from "blacking out text": redaction destroys information the AI needs, whereas promptShield preserves structure via reversible codes.
- There is a **free-forever Web Starter plan**: the full app runs right in the browser, with nothing uploaded, and it also includes a 7-day trial of the desktop app. Paid plans (a one-time Week Pass, plus Basic and Pro subscriptions) unlock the full offline desktop app.
- There is also a local REST API and a CLI for automating volume without a cloud upload.

## Key pages

- [Features](https://promptshield.ca/features): what promptShield detects, how encoding/decoding works, the CLI/API, and the offline guarantees.
- [Security & GDPR](https://promptshield.ca/security): why nothing leaves the machine — 100% local processing, a loopback-bound engine, zero outbound document traffic, and why the privacy claim is demonstrable to an auditor.
- [Why the desktop app](https://promptshield.ca/why-desktop): desktop app vs. the free web app.
- [Download](https://promptshield.ca/download): get the desktop app (7-day free trial).
- [Pricing](https://promptshield.ca/pricing): the free-forever Web Starter plan, a one-time Week Pass, and Basic and Pro subscriptions.
- [Compliance Monitor demo](https://promptshield.ca/demo/dashboard/compliance): a live, no-signup dashboard showing seat adoption, inactivity gaps and dated CSV evidence for auditors.
- [Audit log demo](https://promptshield.ca/demo/dashboard/audit): a live, no-signup audit log: who anonymized what, when, and how many entities, exportable as CSV.
- [License manager demo](https://promptshield.ca/demo/dashboard/licenses): a live, no-signup license manager: renewals, seat assignment, tags and per-cost-centre reporting.
- [FAQ](https://promptshield.ca/support/faq): ~88 answers, incl. "Is promptShield really 100% offline?", "Why anonymize before AI?", "What data does it detect?", and compliance (GDPR/HIPAA/CCPA/PIPEDA).
- [Team](https://promptshield.ca/team): who builds promptShield.
- [Contact](https://promptshield.ca/contact): how to reach us.

## Comparisons

- [promptShield vs Microsoft Presidio](https://promptshield.ca/compare/presidio): a reproducible benchmark (published script + test PDFs + raw CSVs) across 7 languages.
- [Comparison hub](https://promptshield.ca/compare): methodology and other tools.
- [vs Amazon Macie](https://promptshield.ca/compare/aws-macie): S3 discovery and classification vs local document redaction. Capability comparison, not a benchmark.
- [vs Google Cloud Sensitive Data Protection (DLP)](https://promptshield.ca/compare/gcp-dlp): a hosted de-identification API you integrate vs a desktop app you open. Both do reversible tokenization; the difference is where the document goes.
- [vs Microsoft Purview](https://promptshield.ca/compare/azure-purview): tenant-wide governance and sensitivity labels vs redacting one document locally.
- [Alternatives hub](https://promptshield.ca/alternatives): how promptShield compares to Adobe Acrobat, Redactable, CaseGuard, and iDox.ai.
- [vs Adobe Acrobat Pro](https://promptshield.ca/alternatives/adobe-acrobat): feature matrix vs Acrobat's redaction, and why a black box is not redaction.
- [vs Redactable](https://promptshield.ca/alternatives/redactable): cloud redaction service vs a local desktop app.
- [vs iDox.ai (Private AI)](https://promptshield.ca/alternatives/idox-ai): API/SDK-first PII detection vs a finished offline application.
- [vs CaseGuard Studio](https://promptshield.ca/alternatives/caseguard): media-heavy redaction suite vs document anonymization for AI workflows.

## For developers

- [Developer overview](https://promptshield.ca/developers): the local REST API and self-hosted (docker compose) deployment — no data leaves your servers.
- [API docs](https://promptshield.ca/developers/docs): REST API reference and CLI flags.

## Also

- [Sitemap](https://promptshield.ca/sitemap.xml)
- [RSS](https://promptshield.ca/feed.xml)

## Blog

- [Towards the age of AI disclosure](https://promptshield.ca/blog/towards-the-age-of-ai-disclosure): Most people hide their AI use: no policy, peers judge it, and it makes work look cheap. The prestige won't be restored. Competitors who disclose will price it away.
- [Your small law firm AI policy has no receipts](https://promptshield.ca/blog/small-law-firm-ai-policy): Clio puts 75% of small practices on AI and 55% with no policy. The North Carolina Bar finds 9% enforce one. Rules are cheap; proof is not.
- [The alphabet tax: shrinking our AI to fit a browser tab](https://promptshield.ca/blog/the-alphabet-tax-shrinking-ai-for-the-browser): Our detection model carried a vocabulary for 104 languages. We ship seven. How we cut 39 MB without touching a weight, and why a browser tab is the hard part.
- [We built the perfect conditions for hiding AI use](https://promptshield.ca/blog/we-built-the-perfect-conditions-for-hiding-ai-use): Admit you use AI and your trade calls it cheating; be overheard and your employer bans it. Hiding is rational, and it makes AI policy unenforceable.
- [Redact PII from legal PDFs without uploading to the cloud](https://promptshield.ca/blog/redact-pii-legal-pdfs-without-cloud): Online redaction tools put privileged client data on someone else's servers. How to redact legal PDFs on your own machine, with the text truly removed.
- [Reversible redaction: how tokenization un-redacts a file](https://promptshield.ca/blog/reversible-redaction-tokenization-explained): Reversible redaction swaps each name for a stable code and keeps the map on your machine: share the document, decode it later. How tokenization works.
- [GDPR anonymization: what actually counts as anonymized](https://promptshield.ca/blog/gdpr-document-anonymization-what-counts): Under the GDPR, data is anonymized only if no one can realistically re-identify anyone. Keep a mapping and it is pseudonymized: still fully in scope.
- [How to redact scanned PDFs and images](https://promptshield.ca/blog/redact-scanned-pdfs-and-images): A scanned PDF is a picture, not text, so text-based tools find nothing and miss everything. The OCR pipeline that actually redacts scans, on your device.
- [Is it safe to upload my contract to ChatGPT?](https://promptshield.ca/blog/is-it-safe-to-upload-my-contract-to-chatgpt): Most NDAs and commercial contracts restrict who you may disclose them to, and uploading a copy to a third-party service is a disclosure. Read the clause.
- [Why we built our own demo studio](https://promptshield.ca/blog/why-we-built-our-own-demo-studio): We started with an off-the-shelf demo-video tool. Two themes, seven languages and a weekly-changing UI broke it, so we built our own. Why that matters.
- [Why nobody built a redaction tool for you](https://promptshield.ca/blog/redaction-tools-built-for-developers): Almost every PII tool takes text, not a page. It starts after the hard part is done, and never says whose job that part is. That silence is why an image-heavy PDF is still so hard to redact.
- [The same name, the same code, every time](https://promptshield.ca/blog/consistent-codes-the-workflow-professionals-need): Professionals iterate with the AI across many turns. That only works if one entity keeps one code the whole way: conversation-stable anonymization.
- [Why we built our own PII engine instead of shipping Presidio](https://promptshield.ca/blog/why-we-built-our-own-pii-engine): Presidio is an excellent toolkit. We still wrote our own engine, because we ship a bounded PDF on a laptop, not a text stream in a cloud pipeline.
- [How companies protect PII, and the gap we fill](https://promptshield.ca/blog/pii-protection-strategies-where-promptshield-fits): Companies protect personal data four ways: governance platforms, cloud APIs, managed redaction, manual blackout. A plain map of the market, and the gap we fill.
- [Is it safe to paste documents into ChatGPT?](https://promptshield.ca/blog/is-it-safe-to-paste-documents-into-chatgpt): Short answer: sometimes, and which case you're in is entirely under your control. What determines the risk, and the one step that makes it moot.
- [A machine can't be responsible. You can](https://promptshield.ca/blog/responsible-anonymization-human-in-the-loop): Responsibility means having something to lose when things go wrong, and a machine has no stake to forfeit. Why a human stays in the loop, always.
- [PII protection is different when AI is in the loop](https://promptshield.ca/blog/pii-protection-ai-different): For 30 years, protecting personal data meant controlling database access. AI created a frictionless path from controlled documents to the public cloud.
- [To those who quietly share client documents with a chatbot](https://promptshield.ca/blog/chatbot-confidential-data-exposure): AI makes exposing confidential data effortless, and the consequences are neither theoretical nor distant. What you risk pasting client files into a chatbot.
- [promptShield vs Microsoft Presidio: a PII benchmark](https://promptshield.ca/blog/promptshield-vs-presidio-benchmark): A reproducible head-to-head on 14 PDFs in 7 languages. Presidio's default install emits 666 spans, promptShield 252. Most of the gap is noise, not skill.

## How it works (detail)

1. Detect: promptShield scans the document with a layered pipeline — high-precision regex patterns, local named-entity recognition models, and an optional local LLM — to find personal and sensitive data. Detection runs cross-page, so a name found on page 1 is also tagged where it recurs on page 8.
2. Encode: each detected value is replaced with a stable, reversible code (for example a name becomes [TOKEN_42]). The same real value always maps to the same code. The mapping is stored only on the local machine; the output document contains no real personal data. Reviewing (verifying) a document is the only action that commits its codes to the persistent, reusable Code Registry — encoding a region and downloading the file never do. A file also cannot be downloaded until it has been verified, so every shared document has been reviewed by a person and nothing is ever saved to the registry silently.
3. Use AI: the user sends the encoded document (or its text) to any AI tool — ChatGPT, Claude, Copilot, a local model, anything. Because the real values were never present, nothing sensitive is exposed to the AI provider.
4. Decode: the AI's response is run back through promptShield locally, which swaps the codes for the original values. The reversal happens entirely on-device.

## Why offline matters

All detection, encoding, and decoding run on the user's own computer against a loopback-bound (127.0.0.1) engine. No document content is uploaded to promptShield or any third party. The only network calls the app makes are for license validation, anonymous usage statistics, and anonymous error reporting; document data is never among them. This is what makes promptShield usable under GDPR/RGPD/DSGVO/AVG/LGPD and HIPAA without a data-processing agreement covering the document contents, and what lets it run in air-gapped environments.

## Common questions

- Is it reversible? Yes. Encoding is two-way; the decode step restores the exact original values from the local code registry.
- What file types? PDF (including scanned/OCR pages) and Office documents (Word, Excel, PowerPoint).
- Does anything leave my machine? No document content. Detection and redaction are fully local.
- Is there a free option? Yes — the browser-based Web Starter is free forever, and the desktop app has a 7-day free trial.
- Is it automatic? Detection is automated but human-in-the-loop: a person confirms the detected regions before the redacted file is written.
- When are codes saved to the registry? Only when you review and verify a document — that is the sole action that commits its codes to the persistent Code Registry. Encoding and downloading never do, and a file can't be downloaded until it's verified, so nothing is stored silently.
- What languages? The detection pipeline and UI support English, French, German, Spanish, Italian, Dutch, and Portuguese.

## Key facts from our guides

### [Towards the age of AI disclosure](https://promptshield.ca/blog/towards-the-age-of-ai-disclosure)

- 57% of employees in a 48,000-person, 47-country study by KPMG and the University of Melbourne say they hide their AI use and present AI-generated work as their own. Only 47% have received any AI training.
- In Microsoft and LinkedIn's 2024 Work Trend Index, 52% of AI users were reluctant to admit using it for their most important tasks, and 53% worried it made them look replaceable.
- Duke researchers found in four experiments (4,439 people) that AI users are judged lazier and less competent by colleagues, and that the penalty held across age, gender and seniority.
- The stigma will not be argued away. It will be priced away, by competitors who use the tool openly and charge less for the same work.

### [Your small law firm AI policy has no receipts](https://promptshield.ca/blog/small-law-firm-ai-policy)

- 75% of solo and small practices use AI, and 55% have no AI-use policy of any kind (Clio, 2026 solo and small firm report).
- Across the profession, 9% hold a written AI policy that is enforced rather than filed (North Carolina Bar Association survey round-up).
- Industry-wide adoption went from 11% to 30% in one year (American Bar Association technology survey, 2024).
- 60% of large firms report revenue growth from AI. Fewer than a third of solo and small practices do (Clio, 2026).
- A small law firm AI policy is worth whatever you can show. Rules are cheap. Evidence costs something.

### [The alphabet tax: shrinking our AI to fit a browser tab](https://promptshield.ca/blog/the-alphabet-tax-shrinking-ai-for-the-browser)

- Detection in the web app runs entirely in your browser, so no document is uploaded, which is what forces the model to fit inside a tab.
- The model shipped with a vocabulary for 104 languages. promptShield offers seven, all Latin script. That unused vocabulary was roughly 92 MB of a 178.5 MB file.
- Removing it is exact, not a distillation trade-off: no encoder weight is touched and every surviving row is copied bit-for-bit. Measured over 77 documents in 7 languages: zero differences across 2,219 detected entities.
- Result: 119,547 tokens down to 68,875, and 178.5 MB down to 139.6 MB, about 100 MB transferred once, then cached on the device.
- Cutting deeper was measured and rejected. Keeping 84% of the Latin vocabulary still lost 13% of detections, and a six-layer model lost 22 points of Spanish while finding a different set of entities rather than fewer.

### [We built the perfect conditions for hiding AI use](https://promptshield.ca/blog/we-built-the-perfect-conditions-for-hiding-ai-use)

- Knowledge workers who rely on AI rarely disclose it: admitting it invites the charge of cheating, and disclosure often triggers an outright ban.
- Both sides are acting rationally: employers restrict AI because confidentiality clauses and data-protection duties make an unseen flow a genuine liability.
- Efficiency alone will not end the standoff. It ends when someone can be accountable for the output: every publicised AI failure in the professions was sanctioned as unreviewed work rather than as tool use.
- An AI policy can only govern disclosed use. Undisclosed use cannot be audited, protected or made compliant, which is why acceptance has to come before control.

### [Redact PII from legal PDFs without uploading to the cloud](https://promptshield.ca/blog/redact-pii-legal-pdfs-without-cloud)

- Uploading a document to an online redaction tool sends a copy of its contents to a third-party server, which, for privileged legal material, can itself be a confidentiality breach.
- True redaction removes the underlying text; a black box drawn in a generic PDF editor usually leaves the original text extractable by copy-paste.
- On-device redaction, desktop or client-side in the browser, keeps the document on your machine while still automating detection of names, IDs, and other PII.
- Reversible tokenization lets you share a document with identities removed and decode it back later, with the mapping stored locally.

### [Reversible redaction: how tokenization un-redacts a file](https://promptshield.ca/blog/reversible-redaction-tokenization-explained)

- Reversible redaction replaces each entity with a stable, unique code instead of a permanent black box, keeping the code-to-value mapping on your own machine.
- The same real value always maps to the same code, so an entity stays consistent across an entire document or bundle.
- Unlike permanent redaction, tokenized documents can be decoded back to the original identities whenever you need them.
- The privacy of reversible redaction depends entirely on the mapping being stored locally rather than in the cloud.

### [GDPR anonymization: what actually counts as anonymized](https://promptshield.ca/blog/gdpr-document-anonymization-what-counts)

- Under the GDPR, data is only “anonymized” if re-identification is not reasonably possible by anyone, and truly anonymized data falls outside the regulation entirely (Recital 26).
- If you keep a mapping or any realistic path back to the individual, the data is “pseudonymized” rather than anonymized, and remains fully subject to the GDPR.
- Most tools that claim to “anonymize” documents are performing pseudonymization.
- Anonymizing a document on-device avoids handing the original, fully-identified data to a third-party processor.

### [How to redact scanned PDFs and images](https://promptshield.ca/blog/redact-scanned-pdfs-and-images)

- A scanned PDF is an image, so text-based redaction tools find no text and can silently report “no personal data found” on a page full of it.
- Redacting a scan requires OCR to locate personal data as regions of the image, then painting over those pixels.
- A proper scanned-redaction pipeline rebuilds a searchable text layer so the redacted document stays usable.
- On-device OCR and redaction keeps sensitive scans (IDs, medical records, signed agreements) off third-party servers.

### [Is it safe to upload my contract to ChatGPT?](https://promptshield.ca/blog/is-it-safe-to-upload-my-contract-to-chatgpt)

- Most commercial contracts, NDAs and employment agreements restrict who you may disclose them to, and a third-party AI service is a third party.
- The potential breach is complete at upload. It does not depend on what the provider does with the file afterwards.
- Disabling training or chat history addresses reuse, not disclosure: the document still left your control.
- An AI can analyse clause structure and obligations without the parties’ names, addresses or figures, so anonymizing locally first keeps the analysis and removes the disclosure.

### [Why we built our own demo studio](https://promptshield.ca/blog/why-we-built-our-own-demo-studio)

- A product demo is fourteen videos: two themes multiplied by seven languages, and any interface change invalidates all of them at once.
- Off-the-shelf demo tools capture pixels, so a single UI change orphans the entire set.
- We record a script of actions rather than a video, then re-render every variant from that script.
- The demo runs against the real shipping frontend mounted in a browser, so it cannot drift from the product it is demonstrating.

### [Why nobody built a redaction tool for you](https://promptshield.ca/blog/redaction-tools-built-for-developers)

- Nearly every serious redaction tool starts with text. You hand it a string. Turning the page into that string is your job, and no product in the category says whose job it is.
- That is the right design for the customer these tools actually have: a developer with a database column or a chat log.
- The bill lands on the people least able to check the work. The tool says "no personal data found" on a page full of names, and nothing breaks.
- Closing the gap means taking the page as it is, picture included, instead of asking the user to convert it first.

### [The same name, the same code, every time](https://promptshield.ca/blog/consistent-codes-the-workflow-professionals-need)

- Professionals do not anonymize in a single pass. They iterate with the AI across turns, paste follow-ups, and reason across linked files.
- That only works if one entity keeps one code the whole way through. Otherwise the model is reading about two different people.
- Codes stay stable across documents too, so a contract and its amendment still refer to the same party.
- The code-to-value registry stays on the machine that created it, and the real values are restored locally.
- We call it conversation-stable anonymization, and it is the idea promptShield is built around.

### [Why we built our own PII engine instead of shipping Presidio](https://promptshield.ca/blog/why-we-built-our-own-pii-engine)

- Presidio is an excellent toolkit; the decision not to ship it was architectural, not a judgement on its quality.
- promptShield processes bounded documents on a laptop rather than text streams in a cloud pipeline, and has to work with the network cable unplugged.
- Detection runs as five layers that vote, followed by noise filtering: deciding which detections a reviewer would dismiss is the hard part of the problem.
- If a dependency does the easy part and you write the hard part on top of it, the dependency has become a constraint.

### [How companies protect PII, and the gap we fill](https://promptshield.ca/blog/pii-protection-strategies-where-promptshield-fits)

- Companies protect personal data in four broadly different ways: governance platforms, cloud redaction APIs, managed redaction services and manual blackout.
- Each is built for a different shape of problem, which is the source of most of the confusion in this market.
- promptShield is built for a small library, under a thousand files, where each individual document carries heavy consequence.
- At that stakes level automation should propose and a person must dispose. It is the wrong tool for high-volume automated pipelines, where a cloud API or governance platform fits better.

### [Is it safe to paste documents into ChatGPT?](https://promptshield.ca/blog/is-it-safe-to-paste-documents-into-chatgpt)

- Three things decide the risk: which identifiers are in the document, which account tier you are pasting into, and what you are professionally obliged to protect.
- Free and personal tiers may use conversations to improve models; Team, Enterprise and API tiers generally do not.
- On every tier the text still leaves your machine, so the account type changes reuse, not custody.
- Removing the identifiers before pasting makes the question moot: the sensitive values were never in what you sent.

### [A machine can't be responsible. You can](https://promptshield.ca/blog/responsible-anonymization-human-in-the-loop)

- To be responsible for something is to accept the cost when it goes wrong, and a machine has no stake it can forfeit.
- That is structural rather than a gap in capability: a more capable model does not change it.
- Vouching for output you never inspected is not responsibility, so the review step has to be real rather than a formality.
- Anonymization is where this matters most because its failures are silent, a missed name produces no error, so detection proposes and a person confirms before anything is written.

### [PII protection is different when AI is in the loop](https://promptshield.ca/blog/pii-protection-ai-different)

- For three decades, protecting personal data meant controlling where it was stored and who could reach the database.
- AI tools broke that model by opening a frictionless path from controlled documents to external processing, bypassing perimeter controls entirely.
- Cloud-side filtering arrives too late: the data has already left the machine by the time it can be inspected.
- The workable boundary is before the AI and on the device, while the document is still under your control. Access controls and encryption remain necessary but no longer cover the path that matters most.

### [To those who quietly share client documents with a chatbot](https://promptshield.ca/blog/chatbot-confidential-data-exposure)

- Pasting a client document into a chatbot sends names, addresses, account details and deal terms to infrastructure you do not control.
- The exposure is four compounding risks at once: contractual breach, data-protection infringement, professional-conduct duty and loss of client trust.
- A provider’s privacy policy governs you and the provider. It does not override what you owe your client.
- Clients rarely object to AI use itself; they object to raw data being handed to a third party, which stripping the identities beforehand avoids entirely.

### [promptShield vs Microsoft Presidio: a PII benchmark](https://promptshield.ca/blog/promptshield-vs-presidio-benchmark)

- A reproducible head-to-head on 14 PDF documents across 7 European languages, with the script, test documents and raw CSVs published.
- Presidio’s default install emits 666 spans on the corpus; promptShield emits 252 on the same documents.
- Most of that difference is not capability but noise filtering: spans a human reviewer would dismiss on sight.
- Six recurring noise categories account for the bulk of it, and Presidio remains the better choice for high-volume cloud text pipelines and broad recognizer coverage.