On-device tokenization before prompts leave the browser or your app. Browser Shield for team chats, CLI for your repo, SDK for your product’s users → any LLM.
Zero Leak on managed browsers with Shield installed. Incognito / unmanaged Chrome: MDM docs.
Live egress pipeline simulator
Tokenize PII & secrets → LLM → Re-identify. Competitors stay blocked.
Raw Prompt
Untrusted user input
Type sensitive data or pick a scenario. NoeticGuard Core tokenizes PII and high-precision secrets into a vault ([EMAIL_n], [SECRET_n]), routes safe placeholders to the LLM, then re-identifies on the way back to the user.
Masked Prompt (To LLM)
Vault tokens ([EMAIL_n], [SECRET_n]) + Brand Guard — reversible PII/secrets only
Masked prompt will appear here.
Raw LLM Output
Model echoes vault tokens (never raw PII)
Run the pipeline to simulate the LLM response.
Final Unmasked Output (To User)
unmaskPii restores vault PII & secrets · competitors stay blocked
Run the pipeline to see PII restored for the end user.
How it works
Local scan and mask demos. The live chat simulator is in the hero above.
scanning local payload…
CLI local scan & SDK mask — same @noeticguard/core engine
Before & After
{
"name": "John Doe",
"email": "[email protected]",
"phone": "+1 555-0100",
"card": "4111-1111-1111-1111"
}Core + Shield scan
{ "name": "John Doe", "email": "[EMAIL_1]", "phone": "[PHONE_1]", "card": "[CREDIT_CARD_1]" }
Delivery surfaces
Same on-device engine. Shield for employee chats, CLI for your repo, SDK for your product’s users → any LLM. FinTech/MedTech packs are entitlements on that engine — not a second SDK.
Browser Shield
Masks PII in ChatGPT, Claude, and Gemini web chats on-device before it leaves the browser.
Prevent + measure (telemetry). Best for employee chats in the browser.
Shield docsCLI scan
Scans your local repo for PII sitting in code and opens a masked risk report with a score.
Measure (repo hygiene). Best for leftover PII in git before it becomes a leak.
CLI docsSDK + API
Masks your users’ text in your backend with @noeticguard/core before you call any LLM API — OpenAI, Anthropic, Gemini, or self-hosted.
Prevent + measure (telemetry / gateway quota). Best for product AI: your users → your server → the model.
SDK docsProducts
Real-time, zero-trust PII masking directly inside ChatGPT, Claude, and other web-based AI tools on managed browsers with Shield installed. Incognito / unmanaged Chrome need MDM — see docs. On Startup+, Media Guard can also block images, screenshots, and file uploads before they leave the browser. On Developer, this shows as an upgrade to Startup.
Chrome Extension
On-device PII discovery (`noeticguard scan`) before Copilot or ChatGPT Enterprise. Same core engine as Shield and the SDK. Freemium scan flags common secret shapes; runtime masking requires Secrets Guard.
Mask user text in your backend with @noeticguard/core, then call any LLM API. Policy, quota, and industry packs sync over GET /v1/config — same engine, not a second SDK.
FinTech, MedTech, and KidTech packs are add-ons on the same core — extra detectors and policy, not a separate private SDK. Live add-ons: Secrets Guard, Brand Guard, and PCI / Financial ($29/mo each on Startup; included on Business+). PCI force-enables card + IBAN — not a PCI DSS engine.
Shield for team chats on ChatGPT, Claude, and Gemini. SDK in your backend before OpenAI, Anthropic, Gemini, or your own model HTTP API. We sit on the path to the model — not Slack, Gmail, or endpoint DLP.
Link @noeticguard/core from your workspace (or a tarball we share — not on public npm yet), call maskPii in your process, then send only tokens to whatever LLM you already call.
// Package access ships with your workspace (not on public npm yet).
// See /docs/sdk/quickstart for monorepo / tarball install.
import { maskPii } from '@noeticguard/core';
const vault = new Map();
const { output } = maskPii(userText, { vault });
// → only masked text reaches the LLMPackage access ships with your workspace — see the SDK quickstart.
Redaction runs on-device before traffic reaches LLM APIs. Raw prompts stay in your process — we don't need them to mask.
CISO boundary: Zero Leak assumes a managed browser with Shield installed. Incognito and unmanaged Chrome need MDM policy — Incognito gap & MDM. Proof → Architecture.
Multi-layer stack · Core → Shield → Network
Workloads, API calls, and employee browser prompts enter here.
Local runtime cube
Local SDKs and Browser Extensions attach directly at the source — policies compile to native runtime checks.
Egress & redaction plane
NoeticGuard enforces outbound rules — PII and sensitive entities are strictly tokenized into a local vault before egress.
One policy surface
External LLMs and model APIs
Only masked, vault-safe payloads cross the boundary.
Observable. Audited. Policy-mapped.
Architecture runs the same core engine wherever you mask — then syncs policy and quota only.
Program fit
Local-first masking helps you reduce LLM egress risk under GDPR, CCPA, and KVKK-style programs (TCKN already in core detectors). These labels are orientation aids — not certifications, audits, or attestations. HIPAA/COPPA-oriented packs are roadmap entitlements. Enterprise SSO is sales-assisted; Chrome Enterprise / Intune force-install docs are self-serve.
GDPR-oriented
EU egress minimization
CCPA-oriented
CA privacy programs
KVKK-oriented
TR personal data · TCKN
HIPAA-oriented
PHI presets — roadmap
COPPA-oriented
KidTech — roadmap
* The NoeticGuard SDK may call home for license verification and policy bundles only. Raw prompts and payloads stay on your machines.
Redaction runs inside @noeticguard/core in your process, so models never see raw PII — and we never receive the prompt to mask.
Stable [EMAIL_1]-style vault tokens keep traces debuggable without sending originals to the model — and identical values reuse the same token in a session, so prompts stay cleaner when PII repeats.
GET /v1/config and POST /v1/telemetry sync detectors and usage — ng_pub_ keys only; masking stays local.
Startup+ owner policy: block screenshots, images, and file uploads on Shield hosts — no OCR, no media bytes upstream. Developers upgrade to Startup.
Start on Developer. Move to Startup when you need seats, Media Guard, and production auth. Business when packs and MDM rollout matter.
Step 1
Developer $0
1 seat · core PII · prove masking locally
Step 2
Startup $99/mo
5 seats · Media Guard · production auth · audit + triage
Step 3
Business $399/mo
Unlimited seats · Brand / Secrets / PCI packs included · MDM guide
Enterprise is sales-assisted (SSO help, MDM rollout, SLA). See full plans → · MDM docs
Self-serve from $0. Create a free workspace, then upgrade Startup or Business from Billing. Enterprise is sales-assisted (SSO setup help, MDM rollout support, SLA). Business includes a self-serve MDM force-install guide; SSO on Business is coming soon.
Developer
For side projects, local validation, and solo builders.
Startup
Switch to Annual to see yearly pricing and savings.
For early teams shipping AI features to production.
Business
Switch to Annual to see yearly pricing and savings.
For scaling platforms with heavy AI workloads and full teams.
Enterprise
For regulated industries and large deployments.
Resources
Everything you need to integrate, ship, and stay compliant.
Overview, SDK, Shield, CLI, and API Gateway.
Mask PII before OpenAI/Claude, ChatGPT employee controls, GDPR/KVKK checklists.
How masking stays in your process — architecture you can inspect.
Release notes and breaking changes.
Reach our team for onboarding and enterprise help.
Works with — masks before prompts reach
