The Air-Gapped
LLM Privacy Gateway
Why send unmasked text to cloud APIs just to mask it? OwlMask LLM is a fail-closed egress firewall that keeps customer PII inside your perimeter and preserves exact numbers for AI calculations.
| Feature | OwlMask LLM | Cloud DLPs & Generic Maskers |
|---|---|---|
| Deployment & Data Residency | 100% inside your VPC / Air-Gapped. Zero external telemetry. | Must send unmasked text to external cloud APIs (Google SDP, AWS). |
| LLM Egress Architecture | Fail-closed egress firewall. Aborts immediately if masking is uncertain. | Passive detection API only. Applications must build their own proxy. |
| Math & Reasoning Preservation | Preserves financial & payroll figures byte-for-byte while masking IDs. | Blindly redacts all numbers to [NUMBER], breaking AI calculations. |
| De-Masking / Rehydration | Stateless client-side rehydration. Zero server storage, no database honeypot. | None, or centralized token vault databases with high breach exposure. |
| System Prompt Protection | Enforces server-owned prompts. Rejects unmasked caller system prompts. | User message only; system instructions pass through completely unmasked. |
| RAG & Multimodal Pipeline | Parses PDFs, structured Markdown pipe tables, and synthetic visual OCR. | Flat strings only. Engineering teams must build custom RAG parsers. |
| Pricing Model | Flat self-hosted rate ($99/month equivalent, billed annually per installation). Predictable budget. | Per-character / per-request meter billing that scales with AI usage. |
1. The Data Sovereignty Trap
To de-identify data with Google Cloud SDP or AWS Comprehend, you must transmit raw, unmasked text to an external cloud vendor first. If your compliance rules mandate zero external data egress, cloud DLPs violate the very boundary you are trying to enforce. OwlMask runs 100% in your network.
2. Math & Reasoning Preservation
Generic maskers replace figures with static tokens like [NUMBER], destroying an LLM's ability to audit expenses, calculate payroll tax, or summarize invoices. OwlMask tokenizes identifiers but preserves amounts byte-for-byte, enabling real mathematical reasoning.
3. Fail-Closed Egress Boundary
Passive detection APIs leave proxying and error-handling to your application code. If a timeout occurs, naive apps fail open. OwlMask LLM sits as a hard gate at the egress boundary: if masking is incomplete or returns an ABSTAIN, the upstream call is blocked.
Protect Your Enterprise AI Egress Today
Test OwlMask LLM on your own infrastructure with real prompts, real documents, and your choice of local or hosted models.