Developer SDK: Zero-Trust PII & Secrets Redaction for AI Pipelines
Sub-Millisecond Zero-Trust Sanitization for Modern AI Engineering
AI Summary / Key Takeaways
"Integrate PrivacyScrubber's sub-millisecond in-memory engine directly into your backend infrastructure. The Developer SDK (@privacyscrubber/sdk) provides transparent OpenAI client wrapping, LangChain/LlamaIndex middleware, vector DB de-identification, and CISO compliance telemetry with 0 network latency and 0 subprocessor liability."
Enterprise-Grade AI Privacy
Add custom redaction rules and priority support with PRO.
Interactive PII Detection & Sanitization Sandbox
Test real-time client-side RAM tokenization. Choose a specialized preset or paste your own raw prompt to test instant reversible redaction.
The Challenge with AI Data Workflows
Sending raw prompts to cloud DLP proxies (like Nightfall or Google DLP) introduces 250ms+ latency, HTTP 429 rate limits, and 6-to-8 week security review bottlenecks. Storing unmasked PII in vector databases creates permanent GDPR Article 17 compliance debt.
How It Works
Install via npm
Add @privacyscrubber/sdk to your project using npm, yarn, or pnpm. Operates with zero runtime dependencies across Node.js 18+ and modern browser ESM contexts.
Wrap LLM or Sanitize Direct
Use wrapOpenAI(client) for 1-line transparent prompt sanitization, or call sanitize(text, { profile: 'dev' }) to strip PII and infrastructure secrets before vector DB ingestion.
Deterministic Restore & Audit Receipts
Re-hydrate tokens in AI responses with restore(response, tokenMap) and output signed Markdown/JSON CISO audit receipts mapped to GDPR, HIPAA, and SOC 2.
What Teams Achieve with Local PII Masking
Swipe to read verified reviews
Supported Formats & Limitations
Supported Formats
System Limitations
- Licensed for internal backend infrastructure, microservices, and RAG pipelines (OEM required for commercial SaaS embedding)
- License keys are non-transferable; store securely in environment secret managers (Vault, AWS Secrets Manager, Doppler)
- Emergency key revocation available via SHA-256 Key Revocation List (KRL) by contacting support
- Requires modern JavaScript engine (Node.js 18+, Bun, or modern ES2020+ browser runtime)
Start in 10 seconds with the zero-trust NPM SDK
Transparent OpenAI client wrapping, vector DB de-identification, and 25+ compliance profiles.
npm i @privacyscrubber/sdkWhy AI Engineers & Backend Architects Adopt @privacyscrubber/sdk
When deploying LLMs, Autonomous Agents, and RAG pipelines in production, sending raw customer data to cloud redaction proxies introduces unacceptable latency, rate limits, and 6-to-8 week security questionnaire bottlenecks. The PrivacyScrubber Developer SDK (@privacyscrubber/sdk) executes 100% in-memory in your existing Node.js, Next.js, or browser runtime at sub-millisecond speeds — providing true Privacy by Design with 0 network egress and 0 subprocessor liability.
Zero-Trust SDK Architecture: In-Memory Lifecycle
<1ms In-Memory ExecutionThe SDK intercepts raw payloads at your application boundary, tokenizes all PII and infrastructure secrets in volatile RAM, and forwards safe tokens to external LLMs or vector databases. Responses are deterministically restored before reaching the user.
Outcome-First Integration Patterns for AI Developers
1-Line Transparent OpenAI SDK Wrapper
Wrap your standard OpenAI client. Outbound prompt messages are automatically sanitized before cloud transmission, and incoming assistant responses are restored deterministically before resolving.
import OpenAI from 'openai';
import { wrapOpenAI } from '@privacyscrubber/sdk';
// Wrap any OpenAI client instance in 1 line
const openai = wrapOpenAI(new OpenAI({ apiKey: process.env.OPENAI_API_KEY }), {
profile: 'Legal', // 25+ profiles: Medical, Finance, HR, Security...
detectSecrets: true, // Automatically strip AWS keys, JWTs, DB passwords
licenseKey: process.env.PRIVACYSCRUBBER_KEY
});
// Use standard OpenAI API calls — prompts are sanitized in RAM automatically!
const completion = await openai.chat.completions.create({
model: 'gpt-4o',
messages: [{ role: 'user', content: 'Draft NDA for Alice Smith at alice@corp.com with SSN 421-55-0147.' }]
});
console.log(completion.choices[0].message.content);
// AI received tokens only; returned response is automatically restored to Alice Smith!RAG & Vector Database Ingestion (Pinecone, Chroma, pgvector)
Storing raw PII inside vector embeddings is irreversible and violates GDPR Right to be Forgotten. Sanitize document chunks prior to vectorization to keep your vector database 100% de-identified.
import { sanitize } from '@privacyscrubber/sdk';
// Pre-process unstructured document chunks prior to embedding
function prepareVectorChunk(rawDocumentChunk) {
const { scrubbedText, tokenMap, telemetry } = sanitize(rawDocumentChunk, {
profile: 'Healthcare',
licenseKey: process.env.PRIVACYSCRUBBER_KEY
});
// Embed only the anonymized text into Pinecone / Chroma / Milvus / pgvector
return {
anonymizedChunk: scrubbedText,
riskScore: telemetry.riskLevel, // 'CLEAN' | 'LOW' | 'MODERATE'
frameworks: telemetry.frameworksList // ['HIPAA Safe Harbor (§164.514)', ...]
};
}Autonomous AI Agents (LangChain, AutoGen, CrewAI, LlamaIndex)
Maintain persistent token bindings across multi-step agent reasoning loops. [NAME_1] consistently maps to the same individual across tool executions and conversation history.
import { PrivacyScrubberEngine, createLangChainTransform } from '@privacyscrubber/sdk';
// Initialize stateful engine for agent session
const agentScrubber = new PrivacyScrubberEngine({
defaultProfile: 'DevOps',
licenseKey: process.env.PRIVACYSCRUBBER_KEY
});
// Turn 1: Sanitize user input and assign [NAME_1], [SECRET_1]
const turn1 = agentScrubber.sanitize('User John Doe ran deploy with token ghp_abc123456.');
// Turn 2: Engine remembers [NAME_1] is John Doe for subsequent reasoning steps
const turn2 = agentScrubber.sanitize('Assign ticket to John Doe.');
// Result: 'Assign ticket to [NAME_1].' (Token numbering is consistently preserved!)
// Restore full multi-turn assistant answer
const finalResponse = agentScrubber.restore(agentOutputText);Empirical Performance Benchmarks
Verified execution latency on Node.js 20 / Apple Silicon & x86-64 server hardware:
Architecture Comparison: SDK vs Legacy Cloud DLP Proxies
Why in-memory zero-trust execution outperforms cloud redaction APIs and containerized engines:
| Dimension | @privacyscrubber/sdk | Google Cloud DLP | MS Presidio |
|---|---|---|---|
| Processing Model | Local In-Memory (<1ms) | Remote Cloud API (150–400ms) | Self-hosted Python (~30ms) |
| Network Egress | Zero (Air-gapped certified) | Full unencrypted payload egress | Internal network hop |
| Runtime Footprint | 180KB (Zero dependencies) | Cloud Managed Service | ~500MB Docker image + spaCy |
| OpenAI 1-Line Drop-in | Yes (wrapOpenAI helper) | Custom manual pipeline | Custom wrapper required |
| DevOps Secrets Scanning | Built-in (AWS, JWT, DB URIs) | Separate custom detectors | Requires custom regex rules |
| Pricing Predictability | $199/mo Flat (Unlimited nodes) | Pay-per-GB / Pay-per-scan fees | Compute & DevOps maintenance overhead |
Multi-Framework Integration Examples
Drop the SDK into backend microservices, web apps, or serverless actions:
import { sanitize } from '@privacyscrubber/sdk';
export function piiGuard(req, res, next) {
if (req.body?.prompt) {
const { scrubbedText, tokenMap } = sanitize(req.body.prompt, {
profile: 'Security',
detectSecrets: true
});
req.body.prompt = scrubbedText;
req.tokenMap = tokenMap;
}
next();
}'use server';
import { sanitize, restore } from '@privacyscrubber/sdk';
export async function askAI(prompt: string) {
const { scrubbedText, tokenMap } = sanitize(prompt, { profile: 'Legal' });
const rawAI = await callLLM(scrubbedText);
const { restoredText } = restore(rawAI, tokenMap);
return restoredText;
}import { useState, useCallback } from 'react';
import { sanitize, restore } from '@privacyscrubber/sdk';
export function useScrubber() {
const [map, setMap] = useState>({});
const scrub = useCallback((text: string) => {
const res = sanitize(text);
setMap(res.tokenMap);
return res.scrubbedText;
}, []);
const reveal = useCallback((text: string) => restore(text, map).restoredText, [map]);
return { scrub, reveal };
} Zero-Trust Cryptographic Guarantees
Verified boundaries enforced at the library level:
No HTTP requests, WebSocket connections, or phone-home telemetry pings.
No user tracking, error beacons, or remote key-validation roundtrips.
No localStorage, cookies, or fs writes. Volatile in-memory garbage collection.
Zero eval() or dynamic code execution. 100% strict CSP compatible.
Developer SDK Commercial Licensing
Instant offline cryptographic license token for unlimited internal microservices, RAG databases, and backend services at $199/mo (or $1,990/yr with 2 months free). OEM redistribution starts at $599/mo.
Client-Side Reliability & Audit Verification
Powered by the Zero-Trust Sanitization Engine (ZTDS). All detection, tokenization, and regex evaluation execute 100% inside your local client process boundary — eliminating cloud proxies, intermediate servers, and third-party data retention risks.
Step-by-Step Guide
How to use this feature
Install Package
Run 'npm install @privacyscrubber/sdk' in your terminal.
Import SDK
import { sanitize, restore, wrapOpenAI } from '@privacyscrubber/sdk';
Transparent OpenAI Wrapper
const openai = wrapOpenAI(new OpenAI(), { profile: 'legal' });
Call LLM Safely
const response = await openai.chat.completions.create({ model: 'gpt-4o', messages: [{ role: 'user', content: rawPrompt }] });
Frequently Asked Questions
Technical Details & Privacy Architecture
What environments and runtimes does @privacyscrubber/sdk support?
How does the 1-line wrapOpenAI helper work?
How does the SDK protect Vector Databases (Pinecone, Chroma, Qdrant, Milvus, pgvector)?
How does the SDK handle multi-turn AI agents and state consistency?
Does the SDK detect infrastructure secrets and DevOps tokens?
What compliance frameworks and audit telemetry are generated?
Does the SDK require an outbound internet connection to validate licenses?
How does the SDK compare to MS Presidio and Google Cloud DLP?
Is the SDK fully typed with TypeScript?
How does pricing and quota management work for the Developer SDK?
Embed Zero-Trust PII Masking into Your AI Stack
Instant offline Ed25519 license key. 14-day money-back guarantee.
