PasteGuard
Self-hosted AI privacy proxy that masks personal data and secrets before cloud requests, with Apache 2.0 licensing and local LLM routing.
PasteGuard is a privacy proxy that runs locally or on your own server, including through Docker. It's for teams that use cloud AI but can't send raw customer records, client files or credentials to providers. It replaces sensitive values with placeholders before requests leave your environment and restores originals in supported responses.
The privacy layer runs on your hardware. In Mask Mode, the cloud provider still receives the surrounding prompt and its context, with detected private values replaced. Route Mode sends requests containing sensitive data to a local LLM through Ollama, vLLM or llama.cpp; requests without sensitive data can go to the configured cloud provider.
For apps and SDKs, PasteGuard works with OpenAI-compatible and Anthropic APIs. It also protects context sent by coding assistants such as Codex, Claude Code, Cursor and Windsurf, where logs, configuration files and project code can expose secrets.
Multilingual detection covers names, locations, emails, phone numbers and financial identifiers. Secret detection includes API keys, passwords, private keys, JWTs and connection strings. It combines format and checksum checks with GLiNER for names and places, and supports streaming responses.
A local dashboard records requests and shows what PasteGuard detected, masked and sent to the provider. The project is open source under Apache 2.0 and has no telemetry.
