Is PrivacyScrubber a local or cloud PII scrubber?

PrivacyScrubber is a 100% local, browser-based PII scrubber. Unlike cloud DLP solutions, it performs enterprise-grade PII and PHI scrubbing entirely in your browser's RAM, ensuring zero-trust data sanitization for texts and documents (PDFs, DOCX, CSV) without ever sending data to an external server.

Does PrivacyScrubber send my data to any server?

No. Zero bytes of your input are ever transmitted to any external server. The entire PII detection engine runs inside your browser's JavaScript runtime using local RAM. You can verify this by opening Chrome DevTools → Network tab and clicking "Protect PII" — you will see zero outbound requests.

What happens to the session map when I close the browser?

The session map is stored exclusively in volatile browser RAM. The moment you close the tab, reload the page, or navigate away, the entire mapping — including all original PII values — is permanently destroyed.

Do I need a HIPAA BAA or GDPR DPA with PrivacyScrubber?

No. Because PrivacyScrubber never acts as a data processor (your data never reaches our infrastructure), we are architecturally exempt from BAA and DPA requirements. Your browser processes everything locally.

What is the difference between the Free and PRO tiers?

The Free tier supports text paste and single .txt/.docx file upload. The PRO plan ($110 lifetime) adds offline PDF/OCR scanning, batch file processing, and Custom Regex Rules for internal domain-specific codes.

Does PrivacyScrubber remove PII from uploaded documents, and what is the output format?

Yes. PrivacyScrubber detects and scrubs PII from local documents (.txt, .docx, .pdf, .xlsx, .csv, and images). You can download the output either as a fully sanitized, anonymized document (retaining its original file extension and structure) or copy the processed text stream directly to your clipboard.

How does the TEAMS encrypted session sharing work?

PrivacyScrubber generates an AES-GCM encrypted link locally. Your colleague can paste the AI's response and use your shared, encrypted key to safely 'reveal' the original data on their machine — no database or server involved.

How does closed Shadow DOM sandboxing protect my data from malicious scripts?

PrivacyScrubber encloses both your editor input (#inputText) and the highlighted token output within isolated, closed Shadow DOM roots. This makes the raw, unredacted text completely inaccessible to any third-party scripts, browser extensions, or key-sniffing scripts running in your main document pool, creating a hardened frontend sandbox.

Can corporate accounts or accounting firms pay via manual invoice or wire transfer (SWIFT/SEPA)?

Yes. If your corporate credit card is declined due to international banking restrictions or if your procurement department requires manual invoicing, purchase orders (PO), or bank wire transfers (SWIFT/SEPA), our team can manually issue a formal invoice with tax reverse-charge support. Contact support@privacyscrubber.com to request an enterprise invoice.

How does PrivacyScrubber prevent data residue in system RAM (V8 memory wiping)?

To prevent PII or case documents from remaining in your device's memory after sanitization, the processing engine actively overwrites all temporary parsing buffers (used for DOCX, PDF, and spreadsheet extraction) at the byte level using Uint8Array.fill(0) in local memory immediately after use, ensuring zero sensitive residue remains in RAM before garbage collection.

Does changing the detection profile reset my protected session data?

No. Changing your detection profile (e.g., from General PII to Wealth Management) does not clear your active session or reset your local token maps. This ensures that any tokens generated using your previous profile remain fully decryptable when you paste AI responses back to 'Reveal' the original text. To completely wipe your session, rotate encryption keys, and clear all memory, click the 'Clear' button at any time.

How do local Audit Receipts and Teams Handoff work without a backend database?

PrivacyScrubber operates entirely in your browser's local RAM. Compliance audit receipts and team handoffs are exclusive features of the Teams Subscription. For audit compliance, the system builds an offline cryptographic PDF receipt documenting entity counts, timestamps, and active compliance profiles. For Teams Handoff, it encrypts the tab's session map in-memory using Argon2id and XChaCha20-Poly1305. Your colleague decrypts the token map on their machine using the shared key — no central database or server ever touches your data.

Does PrivacyScrubber use third-party tracking, analytics, or review widgets?

No. To maintain a strict zero-trust data sanitization architecture, PrivacyScrubber does not load third-party analytics trackers, cookies, or reviews integrations (such as Google Customer Reviews or similar widgets). Adding dynamic third-party scripts would require relaxing our Content Security Policy (CSP) and could allow external servers to inspect page states or log user environments. We display reviews statically or link to external platforms like G2 or the Chrome Web Store to ensure zero data leakage.

Can I use PrivacyScrubber as a PII MCP Server for Cursor or Claude Desktop?

Yes. PrivacyScrubber offers an official local Model Context Protocol (MCP) server package (@privacyscrubber/mcp-server) that integrates directly with Cursor IDE, Windsurf, and Claude Desktop. It acts as a local prompt security gateway, scanning and masking PII and API keys locally in volatile RAM before they are transmitted to external LLM APIs.

How are Team Administrator roles managed without a backend server?

In our Zero-Trust Data Sanitization (ZTDS) architecture, there are no server-side accounts or traditional 'Admin' vs 'User' roles. Team Administration is handled via client-side Blueprints. A team lead sets up the required compliance profiles, custom regex rules, and organization name locally, then locks the configuration and exports a cryptographic 'Team Blueprint' URL. When workers click this URL, their local PrivacyScrubber instance activates the TEAMS license, imports the mandated configuration, and disables their ability to edit or delete rules, ensuring organization-wide compliance securely without a backend database.

Mask API Keys, Database Hashes, and Server Logs Before AI Debugging

AI Summary / Key Takeaways

Verified Zero-Trust Logic

"Developer-first data sanitization for high-velocity engineering. Automatically redact API keys, stack traces, and database connection strings locally before using AI for code review or log analysis. PrivacyScrubber acts as the pre-commit buffer for your clipboard secrets."

Zero-Server Airplane Mode No Server Logs

Live Simulation

Zero-Trust Data Sanitization

Watch PrivacyScrubber's local engine transform sensitive Dev data instantly in your browser, without any API calls.

Automated Detection Classes:

API Access Keys / Tokens JWT Authorization Tokens AWS Access / Secret Keys Database Connection URIs User / Server IP Addresses

100% Client-Side Execution

Wasm_Engine

PROD LOG > [ERROR] user=john@corp.com ip=10.0.44.201 Failed auth: key=sk-prod-xK9mN2pL8qR4tY7vZ1 DB: postgres://admin:Pass1234@db.internal:5432/prod

PROD LOG > [ERROR] user=[EMAIL_1] ip=[IP_1] Failed auth: key=[API_KEY_1] DB: [DATABASE_URL_1]

Mask API Keys, Database Hashes, and Server Logs Before AI Debugging Dashboard — Enterprise Grade · Local Execution ZTDS

Local credential masking: Stop API key leaks at the source.

Deterministic tokenization for accurate AI code debugging.

Zero-latency processing for high-speed dev workflows.

WASM-based document parsing directly in browser RAM.

Enterprise-Grade AI Privacy

Add custom redaction rules and priority support with PRO.

GO PRO

Zero-Trust GRC Checklist

GDPR: 100% local. No EEA egress.

HIPAA: Removes 18 PHI parameters.

SOC 2: Zero third-party cloud routing.

Billing: Flat-rate Teams ($99/mo).

Verified by the Enterprise Board

Our 10-persona AI team ensures Dev compliance at every layer.

Chief Information Security Officer

Security Lead

"PrivacyScrubber eliminates Shadow AI risk by intercepting PII at the edge. We've mapped this hub to SOC 2 Type II and ISO 27001 masking controls."

Data Protection Officer & Legal Counsel

Legal Counsel

"Under GDPR Article 32 and HIPAA Safe Harbor, local anonymization removes the AI provider from the 'Data Processor' chain, negating complex DPA liabilities."

Financial Audit & Compliance Lead

Financial Audit

"A single GLBA or PCI-DSS violation costs 100x more than a site-wide license. We provide verifiable ROI through data loss prevention at the prompt level."

The Dev AI Privacy Gap

Credential Spillage

Developers frequently paste crash logs containing runtime keys into AI for debugging.

Infrastructure Leak

Engineering teams leaking internal IP ranges and architecture via AI coding assistants.

Proprietary Logic

Unchecked ingestion of enterprise codebase logic into public model training sets.

Raw Input: apiKey: 'sk-123456', db_url: 'postgres://user:pass@host'...

Sanitized: apiKey: '[SECRET_1]', db_url: '[URL_1]'...

ZERO-TRUST BRIDGE ACTIVE

Secure Dev AI Workflow

Enable high-performance AI without client data leaving your machine

Import Files

Upload documents locally into the PrivacyScrubber sandbox.

Local Masking

Identify and tokenize sensitive strings entirely within browser memory.

Analyze with AI

Submit sanitized prompts to ChatGPT or Claude for processing.

Reverse Scrub

Restore original values into the AI response locally for the final draft.

Protocol: The 5-Step Airplane Mode Audit

Don't trust us. Trust the laws of physics. Follow this audit procedure to verify zero-server PII sanitization for Dev workflows.

Load the tool: Open PrivacyScrubber.com in your browser.

Go Offline: Disconnect your WiFi or enable Airplane Mode. The site remains fully functional.

Process Data: Paste a sensitive dev document and run the scrubber.

Inspect Network: Open Developer Tools (F12) and check the 'Network' tab. Verify 0 requests were made.

Verify Local RAM: All dev identifiers stay in your transient browser memory—never stored, never logged.

DevOps & Engineering: Feature Stack

Two features cover the engineering workflow: custom regex for proprietary formats and the core detection engine.

Custom Rules Engine

Docker image tags, K8s pod IDs, JWT service tokens, nginx config secrets. Define once, apply across all sessions.

Explore →

PII Detection Engine

IP addresses, AWS keys, JWT tokens, SSH keys — all detected via deterministic regex with zero false positive risk.

Explore →

Relevance-Mapped Industry Profile

DevOps, API & Server Logs Profile: Detection Coverage

Pre-commit clipboard shield for developers and SREs. Automatically redacts API keys, JWT bearer tokens, database connection URLs, and internal IP addresses.

22+ Industry Profiles Active in Web, Extension & MCP

Top 6 Dev Sensitive Entity Types Detected & Scrubbed

Automated Local Tokenization

[API_KEY] Critical (Cloud Exploitation)

Third-Party API Keys

Transform: sk-prod-xK9mN2... → [KEY_1]

[JWT_TOKEN] Critical (Session Hijacking)

Bearer Auth Tokens

Transform: eyJhbGciOiJSUzI1... → [TOKEN_1]

[DATABASE_URL] Critical (Credential Leak)

DB Connection Strings

Transform: postgres://admin:***... → [DB_URL_1]

[IP_ADDRESS] High (Network Footprinting)

Internal IPv4 & IPv6 Addresses

Transform: 10.0.44.201 → [IP_1]

[AWS_SECRET] Critical (Infrastructure Hijack)

Cloud Secret Access Keys

Transform: AKIA4X9M2PLRT... → [AWS_KEY_1]

[HOSTNAME] High (Reconnaissance)

Private Server Hostnames

Transform: db-prod.internal.corp → [HOST_1]

Continuous Detection Engine Expansion & Custom Regex Sovereignty

The 6 entity types above represent the core detection baseline for Dev. Our zero-trust engine detects hundreds of additional data classes and is continuously updated with new heuristic patterns, shadow AI leak vectors, and custom regulatory rulesets. Need proprietary database IDs or internal project codenames masked? PRO and TEAMS users can define unlimited custom regular expressions running 100% locally in browser RAM.

Explore PII Scanner

Engine Workflow

How the PrivacyScrubber Engine Solves This

Interactive Tool Controls for Dev. Hover for specs.

Log Dump Tokenization

Paste raw stack traces. Use Developer Profile to hunt for hardcoded tokens, OAuth keys, and nested JSON IP configurations.

Technical Audit Data

Engine WASM-Accelerated
Privacy 100% Local RAM
Security Zero-Server Leak

Reverse Reassembly

After ChatGPT fixes your logic, click Reverse (Reveal) to restore the tokens and instantly copy perfectly patched, runnable code.

Technical Audit Data

Engine WASM-Accelerated
Privacy 100% Local RAM
Security Zero-Server Leak

Dev Compliance Library

Step-by-step redaction workflows for Dev environments.

Core Capabilities	Free Web Only	PRO $15/mo or $110 Lifetime	TEAMS $99/mo	ENTERPRISE Custom Tier
100% Local Processing (Airplane Mode)
Text Paste & Single File Docs	Max 5k chars	UNLIMITED	UNLIMITED	UNLIMITED
Batch Processing & Background OCR	—
Custom Regex & Specific Redaction Rules	—
Chrome Extension Native App	—
Silent Corporate Deployment (MDM)	—	—
Policy Control Center & Enforcement	—	—
On-Premise Source Code License	—	—	—
100% Air-Gapped Operation	—	—	—
Dedicated GRC Support	—	—	—
Includes guaranteed no server logs for all tiers. 100% Client-Side.	Try Free	Details	Deploy TEAMS	Enterprise Hub

Add to Device Home Screen

Mask API Keys, Database Hashes, and Server Logs Before AI Debugging

AI Summary / Key Takeaways

Zero-Trust Data Sanitization

Verified by the Enterprise Board

The Dev AI Privacy Gap

Credential Spillage

Infrastructure Leak

Proprietary Logic

Secure Dev AI Workflow

Import Files

Local Masking

Analyze with AI

Reverse Scrub

Protocol: The 5-Step Airplane Mode Audit

DevOps & Engineering: Feature Stack

DevOps, API & Server Logs Profile: Detection Coverage

Top 6 Dev Sensitive Entity Types Detected & Scrubbed

Third-Party API Keys

Bearer Auth Tokens

DB Connection Strings

Internal IPv4 & IPv6 Addresses

Cloud Secret Access Keys

Private Server Hostnames

Continuous Detection Engine Expansion & Custom Regex Sovereignty

How the PrivacyScrubber Engine Solves This

Log Dump Tokenization

Reverse Reassembly

Dev Compliance Library

Sanitize JSON Payloads for Secure AI Processing

Cursor AI Privacy

GitHub Copilot Privacy

Redact Jira Tickets Before Pasting into ChatGPT

Mask Datadog Alerts and Logs Offline

Redact Splunk Exports for Secure ChatGPT Threat Hunting

Cleaning Sensitive Prod Logs for AI Debugging

How to Sanitize Server Logs for AI Debugging

Secure AI Code Review

Local vs Server-Side AI Data Protection

GitHub Copilot PII Leakage

How to Protect Internal API Keys & Project Codes from AI

AWS Secret Key Redaction for AI Tools

JWT Token Redaction

GitHub Token DLP

NPM PII Redaction SDK

Node.js PII Masking Workspace

Python PII Masking Workspace vs Client-Side Sanitization

Prevent LLM Data Poisoning via PII Injection

Cursor MCP Server Security

Building Secure MCP Servers with Zero-Trust Sanitization

GitHub Copilot and Code Privacy

Jira & ServiceNow Ticket Scrubbing for Secure AI DevOps

How to Write Custom Regex Rules to Mask Internal Corporate Data for AI Workflows

Compare Edition Features

Dev Technical Compliance Library

Frequently Asked Questions

Zero-Trust Sanitization Verified

Session Memory Handoff

Save Output Package

Blueprint Generated

Add to Device Home Screen