IDENTITY + CONTACT
Names, organisations, email, phone, street address, SSN and BSN.
Pseudonymize or removeDirect identifiers can become session-local placeholders; irrelevant contact lines can be removed entirely.SECURITY MODEL / PUBLIC ALPHA
PROTECT THE CONTEXT.
NOT JUST THE LOGIN.
SHREDDAR reduces what AI systems, agents and tools receive. It does not replace endpoint security, authorization, retention controls or legal review—and it does not guarantee anonymity.
LAST REVIEWED 02 SEP 2026
TRUST BOUNDARY / ALPHA
RAW SOURCEHELD LOCAL
VAULT MAPPINGSESSION BOUND
MINIMIZED CONTEXTROUTE ELIGIBLE
IDENTITY STAYS BEHIND THE LINE01 / PROTECTED SURFACE
What SHREDDAR is built to protect.
The self-hosted alpha has deterministic rules for the classes below. The browser showcase demonstrates a representative subset. Detection coverage is not exhaustive.
CREDENTIALS + KEYS
Passwords, API and auth tokens, AWS credentials, private keys, SSH keys and seed phrases.
Block the valueCredential-like values become typed presence markers. The raw value is never eligible for upstream forwarding.FINANCIAL + PAYMENT
Exact monetary values, payment cards and IBANs.
Generalize, block or removeTask-useful magnitude can remain as a range while card data is blocked and irrelevant commercial detail is cut.WALLET + NETWORK
EVM wallet addresses, IP addresses and known locations.
Pseudonymize, generalize or removeOperational meaning can survive without exposing a reusable address, endpoint or exact location to a model.SENSITIVE RECORD FACTS
Health markers, ages, dates, employee and customer record fields.
Local-only, generalize or minimizeThe default gateway keeps health-marked content local and reduces precision or removes facts the stated task does not need.SOURCE + VAULT MAPPINGS
The original document, placeholder mappings and reconstruction authority.
Keep inside the trust boundaryMappings are session-bound and encrypted at rest in the self-hosted gateway; receipts never contain source text or mappings.02 / ISSUE → CONTROL → RESULT
The failure modes SHREDDAR is solving.
These are exposure-reduction controls with inspectable outputs—not claims that risk disappears.
ISSUEEXPOSURESHREDDAR CONTROLEXPECTED RESULT
01
WHOLE-DOCUMENT OVERSHARING
A small AI task receives an entire employee file, contract or incident record.
Task-aware minimization removes fact categories that are not required by the declared purpose.
Only the smallest useful representation becomes eligible to leave.02
SECRETS COPIED INTO PROMPTS
API keys, passwords, tokens or recovery material are pasted beside otherwise useful context.
Deterministic secret recognizers replace values with typed markers before routing; secret-like model output is blocked.
The task may know a credential was present without receiving the credential.03
LINKABLE IDENTIFIERS
Names, email, wallet and account identifiers let an upstream correlate records or people.
Session-local pseudonyms preserve references while Vault mappings stay within the trusted environment.
The model can reason about a subject without receiving the subject's direct identifier.04
UNNECESSARY PRECISION
Exact salary, age, date or location reveals more than the decision requires.
Generalization converts exact values into task-useful ranges, quarters or broader regions.
Useful shape remains while identifying precision is reduced.05
ONE PROVIDER SEES EVERYTHING
A multi-part contract or agent job sends every semantic compartment down one route.
SHARD separates obligations, financial terms, termination and security context into bounded, independently routable pieces.
Each route can receive less context; synthesis stays local. Correlation risk is reduced, not eliminated.06
UNSAFE OUTPUT + RECONSTRUCTION
A model introduces a new identifier or tries to resolve arbitrary placeholders from the Vault.
The output guard blocks credentials and strips new direct identifiers; STITCH accepts only current-session placeholders and reconstruction authority.
Unknown references stay unresolved and unsafe output fails closed.07
LOGS BECOME A SECOND COPY
Prompts and mappings reappear in analytics, traces, receipts or debugging logs.
Zero-raw-content telemetry records policy, classes, counts, routes, timing and keyed integrity metadata only.
Operators get evidence without intentionally recreating the sensitive payload.03 / ENFORCEMENT
Controls at the boundary.
The important security property is not a badge. It is whether the system stops, minimizes and records the right thing under failure.
FAIL CLOSED
Classification, marker reconciliation, output inspection and upstream compatibility errors stop forwarding.
VAULT SEPARATION
AES-256-GCM mappings use authenticated session context and a 0600 key stored outside source.
BOUNDED STITCH
Only current-session placeholders and explicit reconstruction tokens can resolve. Unknown placeholders remain untouched.
NO RAW TELEMETRY
Receipts contain classes, counts, policy IDs, latency, routing and keyed fingerprints—never prompts or mappings.
SECRET BLOCKING
Credential-like values become typed presence markers and are tested not to persist in SQLite.
OUTPUT GUARD
Credential-like model output is blocked; newly introduced direct identifiers are removed before STITCH.
TRUST BOUNDARY
Raw context belongs inside your environment.
The self-hosted gateway processes source material locally. Only policy-approved protected representations may reach a configured upstream. The hosted site does not offer production raw-data processing.
KNOWN LIMITS
- Detection coverage is not exhaustive.
- Pseudonymized data may remain personal data.
- SHARD is not cryptographic secrecy.
- A receipt hash does not prove implementation security.
- Independent privacy and security review is pending.
Report a suspected vulnerability privately through the project's verified Telegram destination. Do not include secrets, private documents, or live exploit data in a public channel.