PII ShieldChange the base URL. Instead of calling the model provider directly, point your SDK at a redaction gateway with the same API shape; it masks personal data in the request, forwards it to the provider, and restores the real values in the response before your code sees it. Because it sits in the transport rather than in your application, it applies to every request from every code path automatically — including the ones written next year by somebody who has never heard of your redaction policy. That is the difference between a gateway and a library call: a library is something a developer has to remember, and across a real codebase the answer is eventually no.
In practice it is two environment variables and no code change: set the base URL to the gateway and add your workspace key as a header.
Why not just call a redact() function?
Because it is a control that depends on being remembered. It holds beautifully in the file where it was introduced and starts leaking the moment a second team ships a second code path — the background job, the retry handler, the new endpoint, the debug script somebody left running. None of those authors were being careless; they simply never knew the rule existed.
Anything transparent to the caller has the opposite property: it is on for code that has not been written yet.
What it looks like
export ANTHROPIC_BASE_URL=https://piishield.ai
export ANTHROPIC_API_KEY=your-anthropic-key
# and on each request:
# x-shield-key: shield_your_keyYour SDK is unchanged. Streaming still streams. The response your code receives has the real values back in it, so nothing downstream needs to know any of this happened.
Bring your own key, or do not
Two arrangements, and the difference is who holds the provider credential. Bring-your-own-key means the gateway forwards using your key and your provider billing is unchanged — most teams want this, because it keeps one vendor out of a relationship that already works. Managed means the credential is held for you, encrypted, which is simpler to start with and means one less secret in your environment.
What to check
- Tokens must be stable within a request. If the same person becomes
[PERSON_1]in one paragraph and[PERSON_4]in the next, the model will treat them as two people and the output will be quietly wrong. - Restoration must survive streaming. A token can be split across two chunks; a naïve implementation emits half a token and then corrupts the rest of the stream.
- It must fail closed. If the redactor cannot run, the request must not proceed unredacted. This is the single most important line in the whole system, and the easiest one to get wrong in the name of availability.
- Secrets are PII too, for this purpose. API keys, private-key blocks, JWTs and database URLs with inline passwords go into prompts constantly, and they cost money the same afternoon they leak.
One thing not to do
Do not point a subscription-based coding agent at a gateway. Claude Code on a subscription authenticates with your claude.ai account token, and sending it to a third-party base URL hands over your account, not an API key. Coding agents want a local plugin that redacts on your machine instead — same coverage, no credential in flight.
Common questions
What is an LLM gateway?
A service that sits between your application and a model provider, speaking the same API. Because your code only changes its base URL, anything the gateway does — redaction, logging, routing, rate limiting — applies to every request from every code path automatically, including code paths written later by people who never knew the gateway existed.
Will redaction break streaming responses?
It should not, but it is the first thing to test. A token can be split across two streamed chunks, and an implementation that restores values naïvely will emit a broken token and corrupt everything after it. Ask for a streamed response containing several redacted values and read the whole thing.
Should Claude Code go through an API gateway?
No. On a subscription, Claude Code authenticates with your claude.ai account token rather than an API key, so pointing it at a third-party base URL sends that account token to a third party. Use a local plugin that redacts on your own machine instead.
Try it on your own data
A free workspace takes one step — 250 requests a month, three connected systems, no card.
Create a workspace