Token-level redaction at your edge.
Prompts are tokenised before they leave your device.
Cloak it first.
Personal data — names, emails, customer records — is replaced with tokens on your device before any AI call. Our gateway relays what your device produced — it never detects or re-identifies on our servers, and the personal data we detect never reaches it in the clear. Drop-in for the SDKs, chat and browser tools you already use — and every reply carries a signed proof you can verify yourself, months later.
Detection is best-effort, so review unusual or sensitive names before sending. See exactly what we do and don't hold →
from openai import OpenAI
# via the CloakAPI local proxy, running on your machine
client = OpenAI(
base_url="http://localhost:8799/v1",
api_key="cloak_…",
)
# Tokenised on THIS machine before the request leaves —
# <PERSON_482> never reaches the AI provider, or us.
resp = client.chat.completions.create(
model="claude-sonnet-5",
messages=[{"role":"user","content":
"Summarise email from <EMAIL_482>"}]
)
Pick by who you are
Same privacy architecture, five front doors. Tap “What you get” on any card for the full detail.
Keep the AI you already use private — tokenised on your machine before anything leaves it.
SDK — change your code. Add the library and change one line. PII is tokenised on your machine by the native Rust engine; only tokens leave.
Proxy — change one setting. Point base_url at localhost:8799 and write no code at all. This is also the way in for a local setup: a model or agent running on your own machine that needs to reach an outside AI goes through the proxy, and tokenisation happens before anything leaves the machine. It speaks the OpenAI and Anthropic formats, so whatever you already run in front of it keeps working.
MCP — your AI app calls the tools. Add CloakAPI to Claude Desktop, Cursor, Cline or Continue. Your app calls CloakAPI's tools directly — nothing to write.
Structured PII needs no AI; free-form names use an optional on-device model — and if it can't confidently tokenise a detected name, it blocks the send rather than pass it through.
Enterprise: run one central proxy on your network and route every app through it. The enterprise pattern →
For anyone. No code, no setup — open it and ask. Names, emails and IDs are tokenised in your browser before the message is sent.
Nothing to install — instant, on any device including your phone. Detected identifiers are tokenised in your browser first; our gateway is a blind token relay that forwards what your browser produced and never detects or tokenises on our servers. Detection is best-effort, so review unusual names before sending. Try it free, no signup.
▣ Power up with the desktop app for confidential and bulk files: native on-device name detection, optional local LLM-as-judge, OS-held keys, an encrypted local token store (AES-256-GCM), local-only logs. Run it in Gateway mode (tokenised locally, then any cloud model) or Complete-local (the model runs on your own hardware — nothing egresses). Windows today; macOS / Linux soon. Download →
For ChatGPT / Claude / Gemini / Grok users. Keep using them — just privately. Identifiers are tokenised in your browser before they reach the provider.
A browser extension for Chrome + Firefox. Install it, then chat normally — structured identifiers (cards, IDs, emails, phones) and common names are tokenised locally before they reach the provider. Names outside its on-device dictionary can still slip; if it can't tokenise, it blocks the send.
Live on all four — Claude, ChatGPT, Gemini and Grok, each verified against its real endpoint. Text is tokenised on every one; file uploads are tokenised on Claude and Grok, and blocked (never sent in the clear) on ChatGPT and Gemini while full file substitution there is finished.
For people who build. Ship the same architecture inside your app, so your end users get client-side tokenisation, a blind relay and a signed receipt — without you building any of it.
The API and the Platform are the same building blocks — SDK, drop-in proxy, REST — pointed at a different job. The API keeps your own prompts private; the Platform ships that same guarantee to your customers.
We built cloakup — a private-AI chat for everyday people — entirely on this Platform: messages tokenised in the browser, relayed blind, receipted, and the details it detects never reach us in the clear either.
Fork the Apache-2.0-licensed starter-kit, call the REST API, add the MCP connector to your own AI app, or embed an SDK (eight languages). REST + proxy work today; the SDKs and the MCP connector (packaged as @cloakapi/mcp-server) are downloadable now from app.cloakapi.io/downloads/sdks/ — CloakAPI does not host an MCP endpoint, so it runs on your own machine or your own infrastructure. The starter-kit is not published as a download yet.
For people with a task in front of them — writing, a CV, email, redaction, a spreadsheet, a translation, a scan, a document library, a file conversion, a meeting. Nothing to install; each one runs in the browser and cloaks the identifiers it detects before anything is relayed.
cloak-write — Draft, proofread, re-voice or condense text that names real people; detected identifiers are swapped for realistic surrogates on your device before the text is relayed.
cloak-cv — Get a CV reviewed, rewritten or tailored to a job ad while the name, address, phone and email it detects are replaced with stand-ins on your device.
cloak-convert — Convert PDF, Word, Markdown, HTML, CSV, JSON and Excel files in the tab; deterministic conversions run entirely on your device.
cloak-post — Draft, reply to and summarise email; detected names, addresses and account numbers are cloaked on your device first. It does not send the mail for you.
cloak-redact — Redact sensitive documents on your device: it proposes, you review and correct, and the result comes with a signed receipt.
cloak-sheets — Ask a sensitive spreadsheet questions in plain English; the AI writes the analysis code and it runs locally over your real cells.
cloak-translate — Translate documents and text; detected names, emails, IDs and addresses are replaced with surrogates on your device, then mapped back afterwards.
cloak-scan — OCR a photo, screenshot or scanned document on your own device, with the identifiers it detects cloaked before anything is offered to an AI.
cloak-docs — A document library that stays in your browser: ask questions, request a summary or a redline, with detected identifiers cloaked before the question is relayed.
cloak-meet — Record or upload a meeting, transcribe it on your device, and have the AI summarise the cloaked transcript rather than the raw one.
Detection is best-effort — structured identifiers (cards, IDs, emails, phones, dates) are the hard part of the guarantee. Free-form person and organisation names are weaker, and they are not equally covered: in eight of these apps they lean on an on-device model, but cloak-convert and cloak-sheets have no model-backed name detection at all — there, names are matched against a built-in list only, so an unusual or non-Latin name is more likely to be missed. Review names before you send, on every app. Each app has its own plan; see your account.
Why CloakAPI
Not a policy promise — properties of the architecture, hard to cheaply copy. Filter by theme; tap any card for the full story.
Prompts are tokenised before they leave your device.
The gateway holds no re-identification map. A design property.
The token→value map is generated on-device and never leaves it.
ECDSA-P-256 receipt over hashes — verifiable offline.
15% pooled · 5% BYOK · 5% local. No API subscriptions.
The no-log guarantee is enforced in middleware, tested each build.
Pick a mode per API key. Switch any time. $10 minimum top-up · $2 trial credit on signup.
Under the hood
Three steps on the standard client-side paths. The honest caveats live one tap away.
Detected identifiers are replaced with tokens on your machine — native Rust engine in the desktop app and local proxy, WebAssembly in the browser.
Only tokens cross the wire. The gateway forwards them and signs the receipt, but never inspects, detects, or tokenises content on our servers.
Every call returns an offline-verifiable receipt over hashes — never bytes. Zero payload logging holds: we never write prompt or response bodies to disk (CI-verified).
Configurations, not certifications. Detector + routing + retention configurations that map to common frameworks — these are configurations you can activate, not certifications we hold.
EU: GDPR · NIS2 · DORA · Health: HIPAA · UK-NHS DSPT · Financial: PCI DSS 4.0 · FINRA 17a-4.
Provider footprint: Anthropic · OpenAI · Google Gemini · xAI Grok · DeepSeek · self-hosted local (Ollama / LocalAI). One API, all current models.
Gateway hosting (Hetzner Nuremberg, EU) carries receipt-signing infrastructure, the receipt chain anchors, public JWKS, billing metadata, and the staff-action audit log only.
On the client-side paths — desktop app, browser extension, local proxy — detected identifiers are replaced on your device before any byte leaves it; cloaked is not anonymous, so undetected text can still leave, bounded by published detection recall. The chat tokenises in your browser too, then routes only tokens through our gateway, which is a blind token relay: it forwards those tokens and signs the receipt, but never inspects, detects, or tokenises content on our servers. In every case the zero-payload logging invariant holds: we never write prompt or response bodies to disk (enforced in middleware, CI-verified).
Start with $2 of trial credit. No subscription, no seats — just a small markup on the AI you already use.