Protect one request in five minutes.

• Docker Engine with Compose v2, or Python 3.11–3.13 for a direct install.
• A local checkout of the SHREDDAR project.
• Synthetic data for the first run. Do not begin with production secrets.
• Port 8787 available on the loopback interface.

The checked-in Compose definition starts a hardened gateway and the website. API keys are optional in development but required whenever public mode is enabled.

cp .env.example .env
docker compose up --build

Every request needs a narrow purpose. SHREDDAR uses the task, policy, and privacy mode to decide what may remain precise and what must be transformed, removed, blocked, or kept local.

curl http://127.0.0.1:8787/v1/protect \
  -H "Content-Type: application/json" \
  -d '{
    "text": "Mara Voss can be reached at mara@example.test. Contract value is $84,000.",
    "task": "Summarize the commercial obligation",
    "policy_id": "strict-v1",
    "privacy_mode": "strict"
  }'

1. 01

   Protected text

   Confirm direct identifiers are absent or represented by controlled placeholders before any downstream call.

2. 02

   Route

   Stop if the route is local_only. Never bypass that decision by sending the source directly.

3. 03

   Receipt

   Keep the request id, policy hash, counts, route, and receipt hash. The receipt intentionally excludes source content and Vault mappings.

4. 04

   Reconstruction credentials

   Keep session_id and reconstruction_token in the trusted application. They do not belong in model or agent context.