Privacy infrastructure for AI

Your prompts leave the building. Your secrets shouldn't.

Censgate builds privacy-native AI products on a substrate we open-sourced. Redact finds personal data and credentials wherever they move — in prompts, in code, in your database — and produces evidence of what was found and what left. In-process, in Rust, in a fraction of a millisecond. Apache-2.0, self-hosted, no call-home.

Star Redact on GitHub See the Presidio benchmark →

Apache-2.0 · Rust · v0.10.0 on crates.io · Available today, no waitlist

$ cargo install redact-cli
$ redact analyze --fail-on-detect -i .env config.yaml

→ config.yaml:12  ANTHROPIC_API_KEY   sk-ant-api03-xY7...
→ .env:4          AWS_ACCESS_KEY     AKIA...
→ exit 1 — blocked before it reached the model

One engine. Two risk classes.

Redact what identifies people — and what unlocks systems.

Most PII tooling stops at personal data. An AI prompt just as easily carries an API key, a private key, or a database connection string. Redact detects both, with checksum validation to keep false positives down.

PII patterns

Contact, financial, identity, healthcare, crypto and technical data — with Luhn, mod-11 and IBAN checksum validation.

Secret patterns

Named provider keys, tokens, webhooks, private keys, connection strings, and entropy-gated GENERIC_SECRET.

Contextual (NER)

Optional ONNX transformer models add person, organization, location and date-time detection.

Anonymization modes

Replace, Mask, Hash, Encrypt, Redact — chosen per data flow and per reversibility requirement.

Derived at build time from crates/redact-core/src/types/entity.rs in censgate/redact — not hand-maintained.

One engine, four places

Sensitive data doesn't only leak through prompts.

The same detection engine runs wherever the data is. Nothing calls home, and nothing leaves your network unless you send it.

In CI and pre-commit

redact analyze

--fail-on-detect exits non-zero when secrets or PII are found. No model, no service, no network. Deterministic by design.

In your database

redact-scan

Read-only Postgres discovery. Reports which columns and JSON paths hold personal data — findings only, never values. cargo install redact-scan. Details →

In the request path

redact-gateway

OpenAI-compatible proxy. Redacts on the way out, restores on the way back, with policy profiles and reversible tokenization. Runs in your own infrastructure.

In the browser or at the edge

redact-wasm

The full pattern engine compiled to WebAssembly for browsers and edge workers. Pattern detection only — no model, no runtime.

Evidence, not assurances

A log you control proves nothing.

Detecting sensitive data is the easy half. The question an auditor asks is how do you know? — and a log the operator can rewrite is not an answer.

redact-gateway emits content-free audit records — entity types and counts, never values. A separate compliance ledger stores those records in a tamper-evident hash chain. redact-verify checks an evidence pack offline, with no redact-core dependency and no network on the default path.

Ledger pack verification →

What that means in practice

Gateway records carry entity types and counts — never values
The ledger hash-chains events and signs chain tips
redact-verify checks pack consistency offline
Optional --online may re-query Rekor; never required for a pass

Useful as evidence inputs for SOC 2 CC6.7, GDPR Article 17 erasure trails, and Article 34(3)(a) where data was rendered unintelligible — not a certification, and not a substitute for one. cargo install redact-verify.

Why Rust

Fast enough to sit in the request path.

Redaction only gets adopted if nobody notices it. Against presidio-analyzer on an identical payload, Redact analyzes in 0.1960 ms at p50 where Presidio takes 6.2451 ms.

Full methodology →

Metric	Redact	Presidio	Δ
p50 latency	0.1960 ms	6.2451 ms	31.8x
Requests/sec	19,416	170	114.0x

2026-04-18 · analyzer vs analyzer · both in Docker · concurrency 1. Gateway call-path overhead is being measured separately.

Not a demo

We build on it before we ask anyone else to.

Our tutoring engine routes conversation content through Redact before any upstream model call, scoped per tenant and per learner. It is the hardest test we could give the engine: children's data, under COPPA and FERPA, in a product we ship.

Building it is how we find the gaps. The reversible-token design, the per-subject key model behind erasure, and the content-free record format all came out of running our own product on this, not from a whiteboard.

Why it's built this way

Detection in the request path, not a side-car
Same engine in the gateway, the CLI, the scanner and WASM
Content-free records — types and counts, never values
Self-hosted by default — no call-home

Our first vertical application is in development and will not enter beta until its children's-privacy obligations are finalized. Privacy infrastructure is worth very little if you don't hold your own products to it.

Open source needs participation

Useful infrastructure shouldn't grow in silence.

Redact is early. That makes every issue, test case and pull request disproportionately valuable — the defaults haven't hardened yet.

Star the repository Open an issue Contribute a detector