Docs / FAQ

Frequently asked questions

Architecture and integration. Start from the docs overview if you are new.

On this page+
Does the NoeticGuard API mask my text in the cloud?
No. Masking always runs locally with @noeticguard/core inside your backend, app, CLI, or Chrome extension. The API (GET /v1/config, POST /v1/telemetry) syncs policies, usage quotas, and entitled packs only — raw prompts are not uploaded to NoeticGuard for masking.
Do FinTech or MedTech customers get a separate SDK?
No. Industry packs (PCI, HIPAA/PHI, COPPA-oriented, and similar) are entitlements on the same @noeticguard/core engine. GET /v1/config returns enabled_packs; the SDK turns on extra detector kinds. There is no separate private FinTech/MedTech SDK.
How do I protect a mobile or web AI assistant?
Send user messages to your own backend first. Call maskPii() there with @noeticguard/core, then forward only the masked text to any LLM API (OpenAI, Claude, Gemini, self-hosted). Sync policy via GET /v1/config (including enabled_packs) and report usage with POST /v1/telemetry using a publishable ng_pub_ key. Never put API keys in the mobile/web binary. Language coverage: /docs/languages.
Can I use NoeticGuard from Python, C#, Swift, or Go?
Yes for the control plane: any language can call GET /v1/config and POST /v1/telemetry. First-party maskPii() is JavaScript/TypeScript today. Native and other-backend apps should mask in a Node/TS service you run, then call the LLM. We will not add a cloud endpoint that accepts raw prompts. See /docs/languages.
How does the Chrome extension relate to the API?
Browser Shield uses the same core engine in the page to mask ChatGPT, Claude, and similar sites before the browser request leaves the device. It calls the NoeticGuard API only for workspace config and telemetry — not to mask chat content remotely. Paste an ng_pub_ key from Dashboard → API Keys.
Does Browser Shield work if I chat in Turkish or English?
Yes. Masking is independent of chat language. Emails, phones, cards, and policy-enabled detectors (including TCKN when toggled on) match patterns in the text whether you write in Turkish, English, or a mix. Brand Guard redacts dictionary terms you configure. The extension popup UI is English today. Details: /docs/browser-shield#chat-language. For Python, Go, and other stacks see /docs/languages.
Can I install @noeticguard/core from npm today?
Not from the public npm registry yet. Sign in at app.noeticguard.com, copy an ng_pub_ key from Dashboard → API Keys, then link the monorepo package (or ask [email protected] for a workspace tarball). Step-by-step: /docs/sdk/quickstart. The live API at api.noeticguard.com already serves config and telemetry.
What is the upgrade path from free?
Developer is $0 (1 seat, core PII, prove masking). Startup is $99/mo (up to 5 seats, Media Guard, production auth, audit + triage). Business is $399/mo (unlimited seats; Brand Guard, Secrets Guard, and PCI / Financial included; self-serve MDM guide). Enterprise is sales-assisted. Details: /#pricing.
Does NoeticGuard help with KVKK?
Orientation, not certification: local-first masking reduces LLM egress of personal data, and core detectors include Turkish TCKN when enabled in Policies. Same pattern as GDPR/CCPA-oriented program fit — not a KVKK audit attestation. See /security and /#features.
How do masking quotas reset?
Developer (Free) resets on the UTC calendar month (1st of each month). Startup and Business on a linked Lemon Squeezy subscription reset on the renewal (anniversary) date. Manual or private-beta paid grants without a linked Lemon subscription use the UTC calendar month until renews_at syncs.
How do I cancel or change a paid plan or add-on (Brand, Secrets, PCI)?
If your workspace has a real Lemon Squeezy subscription linked, open Dashboard → Billing (or Add-ons) → Manage billing for the customer portal (cancel, change plan, or refund). Access usually continues until the paid period ends; a full refund revokes entitlement immediately. If access was granted by NoeticGuard without Lemon checkout (private beta / support-managed), email [email protected] to change, renew, or cancel — Manage billing may not open a portal. Enterprise stays sales-assisted.
How do I buy Brand Guard, Secrets Guard, or PCI / Financial?
Business+ includes Brand Guard, Secrets Guard, and PCI / Financial Identifiers. On Startup, when Lemon checkout is enabled for the workspace, the owner can buy each pack from Dashboard → Add-ons → Subscribe ($29/mo each). Developer must upgrade to Startup first. Private beta or support-managed workspaces may receive packs without a Subscribe button — email [email protected]. Media Guard is not an Add-ons SKU — it is included on Startup+ and is on by default under Policies. PCI / Financial force-enables card + IBAN detectors — it is not a PCI DSS certification. Details: /docs/pci-financial.
How do I save or share a CLI scan report?
After a scan, open the report link on app.noeticguard.com/scan/…. Use Share when you want (copy link, email, WhatsApp, Slack, Teams) — nothing is emailed automatically. Sign in → Save to workspace → find it under Dashboard → CLI Scans. Optional --email pins/links the report to that address when it has an account (TTY prompts once; CI: --skip-email). With --key ng_pub_… (or NOETICGUARD_API_KEY), the CLI loads workspace policy and enabled_packs from GET /v1/config. Details: /docs/cli/scan.
Does revoking an API key reset my quota?
No. Usage and monthly quota live on the workspace, not on the key. Revoke + create a new ng_pub_ key only rotates credentials; Home usage and audit history stay intact.
Does the CLI scan for API keys and secrets?
Yes — the CLI freemium scan flags common secret shapes (OpenAI sk-, GitHub ghp_, AWS keys, JWTs, and similar) alongside PII. Runtime masking in Shield/SDK requires Secrets Guard (Business+ included; Startup $29/mo add-on via enabled_packs). Details: /docs/secrets-guard. Not a SQL-injection or prompt-injection scanner.
Does maskPii() send stats to my dashboard automatically?
No. maskPii() is local and silent. Home usage only moves after your backend calls POST /v1/telemetry with the same ng_pub_ key. Without that call, masking still works and the dashboard stays at 0.
What SDK usage can I see on the Free (Developer) plan?
The Home and Billing quota meter — Shield and SDK combined, e.g. 47 / 1,000. Per-event Audit Logs and 7-day volume charts are on Startup+. Pack entitlements still arrive on GET /v1/config as enabled_packs on any plan that has them.
Can I change the email on my NoeticGuard account?
Not from the dashboard yet. Email is your sign-in identity and is tied to workspace access, billing, and audit. To update it, write to [email protected] from your current account email and we’ll assist.
What is NoeticGuard?
NoeticGuard is a local-first DevSecOps toolkit: @noeticguard/core masks PII with deterministic tokens in your app, backend, CLI, or Chrome extension before text reaches LLM APIs. The NoeticGuard API syncs policy and quota — it does not receive raw prompts to mask.
What is deterministic tokenization?
The same input value consistently maps to the same token (for example [CREDIT_CARD_1]) within a vault session, so debugging and support stay possible without sending raw PII to the model.