Stop leaking data into AI - in about five minutes.

Everything hangs off one thing: your workspace key (looks like shield_…). It identifies your workspace, carries your coverage rules, and meters your plan.

1. Create a workspace. Go to the sign-up page, enter a name and your email. You'll get a workspace key instantly - no card, 250 free requests a month.
2. Sign in any time at /login - we email you a one-time link (magic link). No passwords.
3. Open your dashboard at /my?key=shield_… - coverage, integration snippets, usage, the Leak Audit, team and billing all live here.

PII Shield meets your team wherever they use AI. Five surfaces sit over one redaction engine and one coverage config - none let raw PII reach the model. Pick whichever fits; most workspaces use several at once.

A · Gateway - one base-URL change

Point any app or SDK at the shield. It applies your coverage rules, forwards the request, and re-hydrates the reply - including streaming re-hydration, so tokens are restored to real values inside the stream, not just the buffered response. Bring your own provider key (BYOK - forwarded, never stored) or let the operator hold an encrypted managed key for you.

# Anthropic API key clients - SDKs, apps, anything ANTHROPIC_BASE_URL-aware
# NOT Claude Code - see the callout below
export ANTHROPIC_BASE_URL=https://piishield.ai
export ANTHROPIC_API_KEY=your-anthropic-key
# tell the shield which workspace this is
# header on each request:  x-shield-key: shield_your_keyCopy

# OpenAI-compatible (ChatGPT API, Kimi, Groq, Mistral, xAI, …)
base_url = "https://piishield.ai/v1"
headers  = { "x-shield-key": "shield_your_key",
             "x-shield-provider": "openai" }   # or kimi, groq, mistral, xai…Copy

B · Browser extension - in-chat, key-gated

For the web UIs, the extension redacts what you type in the box before it's sent - entirely in your browser. Add it from the Chrome Web Store (one click - Chrome, Edge and Brave; setup guide), then pick what to mask in the popup. It works across claude.ai, ChatGPT, Gemini, Grok, DeepSeek, Kimi, Mistral, Perplexity and Copilot.

• Key-gated: redaction uses your workspace key; without a valid key a PII-bearing message is blocked rather than leaked.
• "Scan my Claude history": a one-time, in-page leak backfill - detection runs locally in the browser and only masked/ciphered events leave, never your conversation text. Feeds the Leak Audit.
• "Redact a file": drop a file in the popup and get a redacted copy back to upload.

C · MCP server - one command

Add the shield as an MCP server; any MCP-aware agent gets the redaction and coverage tools. Put your key in the URL so usage is metered to your plan.

claude mcp add --transport http shield https://piishield.ai/mcp?key=shield_your_keyCopy

• redact - mask PII in any text
• detect_pii - report what would be masked, without changing the text
• redact_document - mask PII in an uploaded file (Word, Excel, PowerPoint, PDF, text…)
• get_coverage / set_coverage - read or change what's masked, right from chat

D · Claude Code plugin - local, no key in flight

Claude Code gets a local plugin instead of the gateway. It redacts file reads, command output and MCP results before Claude sees them, and restores the real values before Claude writes to disk - all on your machine, with no credential in flight.

claude plugin marketplace add aerynquarmby/pii-shield-plugin
claude plugin install pii-shield@piishield
# then give the plugin your workspace key
export PII_SHIELD_KEY=shield_your_key   # or: echo shield_… > ~/.pii-shield/keyCopy

• Check your usage anytime with /pii-shield:status - the CLI version of Claude's own usage view. It shows your monthly allowance used/left and any pay-as-you-go credits in reserve, so you always know where you stand.
• Text is redacted; images pass through. The plugin redacts text (file contents, command output). An image or binary file a tool returns is left untouched so it works normally - to redact an image or scanned PDF, use Document redaction first, then attach the clean copy.
• Fails closed. Without a valid, in-quota key, PII-bearing tool output is withheld rather than passed through. Prompts and @-mentions containing PII are blocked, because Claude Code does not let a hook rewrite a prompt.

In your dashboard's Coverage tab, toggle exactly what gets masked. Everything is stable and reversible - [email protected] becomes [EMAIL_1] on the way out and is restored on the way back. One config drives all five surfaces.

Every shape detector is checksum- or format-validated (Luhn, Verhoeff, structure) so it stays high-precision. Plus label-driven pickup of any labelled identifier (medical aid, policy, passport, account…) and your own custom terms/regex - see below.

Label-driven detection & custom PII

Label-driven auto-detection catches values sitting next to a sensitive label (e.g. "Patient ID: …") even when they don't match a fixed pattern. On top of that, add always-mask terms (e.g. an internal project name like Project Titan) or your own regex patterns for house-specific identifiers. These apply on every surface - gateway, extension, MCP and documents.

PII isn't only in prompts - the biggest leaks are the files people upload. PII Shield redacts documents format-preserving: it edits the text in place and hands back a file that looks identical, minus the personal data.

• Review before you redact: in the dashboard and the extension, a file is first scanned as a dry run - it detects only, bills nothing, and shows every proposed redaction (lowest confidence first, each with its rationale). You approve or reject each finding, then apply. Nothing is produced until you do.
• Automatic quality review: after applying, the shield re-scans the produced file to prove the approved values are actually gone, and reports a pass (or flags anything still present) - so you never hand over a file that only looks redacted.
• But a pass is not a guarantee. It confirms the values we found are gone. It cannot confirm we found them all: detection is automated, and it can miss personal data. Always review a file yourself before you share it with an AI. PII Shield reduces the risk of a leak; it does not remove it, and you use it at your own risk.
• On the gateway, Anthropic document blocks (PDFs and text) are redacted inline before the model sees them.
• The MCP redact_document tool and the dashboard's /api/my/redact-document take a file and return a clean copy.
• The extension's document redactor (its own full-page drop zone) runs the same review → apply → QA path - drop, review, get a redacted copy, upload that.
• Each file redacted is one metered unit (OCR files can bill heavier, per page).

Every other tool starts protecting you today. Leak Audit also shows you what already got out - a retrospective, per-seat view of exactly what PII has reached AI, so management can see and close the exposure.

• Per-seat attribution: each member's exposures, by type, by conversation, over time - plus a "prevented vs. already-leaked" split.
• Opaque placeholders by default (•••). We used to store a partial like j***@acme.com, but that exposes a domain - and ****1234 a card's last four - to anyone with database access. Nothing readable is stored. Raw values appear only when you deliberately reveal them, decrypted in your own browser.
• Owner/admin-only reveal, itself audited: a privileged reveal decrypts a single value on click and writes its own audit event - so revealing is on the record, and fishing is discouraged.

Tenant-held end-to-end encryption

Where a value is stored for possible reveal, it's encrypted with an RSA public key your workspace generates in its own browser (RSA-OAEP wrapping AES-256-GCM). The private half never leaves that browser; reveal happens on your device. PII Shield holds nothing that can decrypt it - we literally cannot read your leaked values, in the dashboard or in the database. There is no fallback to a key we hold: a workspace without a reveal key simply stores no value. A blind index (HMAC) still answers "was this same value leaked again, or by someone else?" without ever decrypting, and it's what makes Not PII suppression work. The browser extension and CLI plugin go further and encrypt on your device, so the value never reaches our servers even in transit. Prefer to store nothing reversible at all? Turn cipher storage off and keep only the type.

How the history gets read

There are only two lawful ways to read a user's past AI history - and PII Shield uses the right one per tier:

• Enterprise → the Anthropic Compliance API gives a true, central, lifetime content audit with no per-user install. Enter your Compliance API credentials self-serve in the dashboard; it activates once your org's Primary Owner enables the API on Anthropic's side.
• Team / Pro → no content API exists, so the extension does an opt-in, in-page "Scan my Claude history" backfill - detection runs locally, only masked/ciphered events leave.

A daily monitor cron scans workspaces that opted into automatic monitoring, records new exposures, and can send a counts-only digest email ("3 new PII exposures across 2 seats today") that links into the dashboard for masked detail.

The dashboard

Leak Audit lives as a sub-tabbed tab in your workspace dashboard:

On any paid plan, invite teammates to share a workspace - no key passing around.

1. Open the Team tab in your dashboard (appears on paid plans).
2. Enter a teammate's email, pick Member or Admin, and Invite.
3. They sign in with their own email via a magic link and land straight in the shared workspace - same coverage, same key, metered together.
4. Remove anyone with one click; their access ends immediately.

What a member sees is a scoped version of the dashboard: their own usage, the tools, and their own Leak Audit exposures - but no Team tab and no billing (those are owner/admin only), and no inviting others. Their guided onboarding leads with turning on two-factor to secure the account first.

Add a second layer to sign-in with any authenticator app - for owners, admins and teammates alike.

1. Open Profile → Security and click Turn on two-factor.
2. Scan the QR code with Google Authenticator, 1Password, Authy or Aegis - or enter the setup key by hand.
3. Type the 6-digit code it shows to confirm. From then on, signing in needs that code as well as your email link.
4. Turning it off later needs a current code, so a lost session can't quietly disable it.

Every surface is usage-metered against your plan's monthly allowance, and the Billing tab shows your usage in real time. The Free tier includes 250 requests a month - no card required.

Two ways to upgrade

• Manual (EFT / bank transfer): pay by transfer and the operator upgrades your workspace on their side - no card needed. Handy for enterprise procurement.
• Self-service checkout: upgrade instantly through the built-in billing portal. The operator switches this on when they're ready to accept card payments; until then, upgrades go through the manual path.

• Team is per-seat, like Claude: minimum 5 seats, 200k requests per seat. Adding a teammate uses a seat; when seats are full you're prompted to add one.
• Three billing terms - monthly, 6-month, and annual - with growing discounts. Switch terms on the Billing tab; annual is the best value.
• Hit your limit? Every surface (gateway, extension, MCP, documents) returns a clear "upgrade" response - no silent overage. Upgrading raises your allowance immediately; cancelling drops you to Free.
• Your allowance has two parts, spent in order: your monthly plan allowance first, then any pay-as-you-go credits (packs of requests that never expire). Protection stays active - and every surface keeps working - until both are exhausted; only then does it pause. So a workspace at its monthly cap with credits in reserve is still fully protected.
• See exactly where you stand, everywhere: the Billing tab and Overview show monthly used/left plus your credit balance; the browser extension popup shows the same picture; and in Claude Code, /pii-shield:status prints your monthly allowance and pay-as-you-go credits on demand.
• Manage your subscription (cancel, change plan, invoices, payment method) via the built-in billing portal - VAT/tax is handled for you.
• Your model token costs stay with your own AI provider - you only pay for the shield.

PII Shield is layered so each role sees exactly what it should - and no more. Three tiers, strictly separated:

Using the console

The console is organised into three pages you switch between in the side-nav:

1. Go to /console and sign in with your operator email; we email a one-time link.
2. Analytics - billing across all tenants: active subscribers, MRR/ARR, revenue and pay-as-you-go, paid seats, a per-plan breakdown and a live billing-events feed, in USD.
3. Billing requests - the queue of tenant upgrade requests raised from their "Contact us to upgrade" form. Review one, record the payment you received, and apply the plan/seats - the tenant's usage updates automatically. (Card / self-service payments apply on their own and show in Analytics, not here.)
4. Clients - pick a client from the top-bar switcher, then use its sub-tabs: Overview (connect details + live stats), Plan (adjust plan / credits / seats, manual EFT upgrades), Coverage & rules (detectors, custom terms/patterns, live tester), Leak audit, and Audit log (filter by seat and date, export CSV/JSON - counts only, never the data).
5. Create a new client any time with + New client in the top bar.

The whole point: your personal data is masked before it reaches the model and before it reaches us.

• Never stores raw PII: prompts, personal data, and the token↔value map live in memory for a single request, then are discarded.
• Counts-only logs: all we keep is how many of each type were masked, plus a timestamp / model / status line - to bill and show your usage.
• AES-256-GCM encrypts anything that must be stored (managed provider keys; revealable Leak Audit values under a per-tenant key), with a privileged, self-audited reveal.
• Self-host the whole thing in your own cloud - data never leaves your network and the platform operator has zero access.
• GDPR / POPIA-aligned by design - masked-by-default, short retention, right-to-erasure, DPIA & employee-notice templates included.
• ISO 27001 / SOC 2 in progress - a starter ISMS kit (policies, risk register, subprocessor register, incident-response plan, key-rotation runbook) ships in the repo.