Built for trust.
Provable, not just promised.

Prompts are tokenised in your perimeter — desktop, extension, chat, or the local proxy for the SDK — before they leave. On those client-side ways CloakAPI never sees plaintext PII: what crosses the wire is already redacted.

Structured PII — emails, cards, IDs, IBANs, phones, IPs — is caught deterministically and offline on your machine, with zero AI. The privacy layer never phones home, while you still call frontier models directly.

Free-form personal names are the hardest PII to pattern-match. A multilingual NER model runs on your device and catches them locally, so names never reach the wire — across the languages your team writes in.

On the desktop app, an optional on-device LLM-as-judge inspects the tokenised prompt for contextual identifiers pattern-matching might miss — before any byte leaves your machine, on your hardware only, never on our gateway.

Documents and images are converted to text on your device — OCR plus an on-device image captioner — then tokenised like any other prompt. Raw file bytes are never uploaded.

Since the pure-relay flip, the gateway holds no re-identification map at all. Nothing server-side can turn tokens back into your data — not a policy promise, a property of the design.

The token→value map is generated on your device and never leaves it. No one — not CloakAPI, not an upstream provider, not anyone on our infrastructure — can reverse your tokens without you. Sole custody, by construction.

Run the model on your own hardware and nothing leaves the machine — no prompts, no tokens, no metadata. The strictest environments get the same tooling and workflow with zero egress.

Every call — successful or failed — returns an ECDSA-P-256 signed receipt over hashes, never bytes. Verifiable offline with the public JWKS. Your auditor needs no CloakAPI account.

Every shipped client — desktop app, browser extension, portal chat and the local proxy — signs a content-free attestation of exactly what left the device (hashes and counts, never your text) with a key that never leaves that device. The gateway verifies that exact attestation, countersigns it and anchors its hash. Both signatures and the hash binding verify offline — the device signature from the receipt's own embedded key, the gateway countersignature against the published gateway key (fetch once, cache it, and every later check is fully offline). Flip a single byte on either side and verification fails.

Status updates on status.cloakapi.io are signed and chain-linked with the same keys as the receipts, so incident history can't be silently rewritten after the fact.

The gateway persists no request or response bodies — only hashes (in the receipt) and aggregate structure: provider, model, token counts. If residency matters, the default data plane runs EU-only (Hetzner Nuremberg).

"We never log prompts or responses" is not a promise — it's enforced in middleware and verified by CI checks on every build. Re-tested on every change, not asserted once in a policy PDF.

Operated under EEA law, so GDPR-grade statutory data protection applies by default — a structural foundation you can evaluate with your own counsel (not legal advice).

Exercise the GDPR right to erasure and you get back a cryptographically signed erasure receipt — verifiable proof that the deletion ran, not a confirmation email.

On the client-side ways — desktop, extension, chat, local proxy — calls are tokenised on your device before they reach us, so we hold no PHI, GDPR personal data, or regulated PII. A structural argument — evaluate with your own counsel, not legal advice.

Detectors cover identifiers across many languages and jurisdictions — national IDs, tax numbers, phone and banking formats — not just US patterns. Built for global teams from day one.

On our pooled keys your prompts mix into aggregate upstream traffic — providers see "a CloakAPI call," not your individual usage pattern. We write up the honest residual risks in full.

The OpenReceipt spec is public; the reference implementation and the detector library are Apache-2.0. Verify receipts, audit the codepaths, even rebuild the gateway yourself.

The same FIPS-compliant ECDSA-P-256 / SHA-256 stack signs at every layer — gateway, desktop, extension, SDKs, receipt-verifier embed, and the installer binaries. Verify any artifact with the same public-key tooling.

Per-tenant signed reports roll every receipt in a period into one artifact — usage, routing, chain checksum, downloadable manifest — signed by the same gateway key. Auditors verify against the public JWKS, no account needed. Generated automatically each quarter.

Every invoice carries an evidence summary — receipt count, first/last receipt, chain root hash, a signed link to the full manifest. Each line item ties back to a real signed receipt.

Per-call routing across providers on your policy — cheapest, fastest, or EU-only. The receipt records which provider actually got the call, so it isn't a take-our-word claim. You keep the savings.

15% on our pooled keys · 5% BYOK · 5% complete-local. No tiers, no subscriptions, no per-seat fees, no monthly minimums. Read the rate, plug in your volume, get an answer in 30 seconds.

One API, all providers, all current models. No GPU fleet, no model-update treadmill, no per-provider procurement chain, no DevOps team.

Third parties build private-AI apps on top via a REST API, a hosted MCP server, an open (Apache-2.0) starter-kit, SDKs in eight programming languages, and a drop-in proxy — inheriting the same client-side tokenisation, blind relay and signed receipts. The REST API and proxy work today; the SDKs and hosted MCP publish to their registries at launch (build from source until then). Platform overview →

Every app built on CloakAPI ships the same OpenReceipt signed receipts — client-signed and gateway-countersigned — so a third party's end users get the same offline-verifiable proof, not a second-hand promise.

The gateway checks each call's declared engine version and hash against a configurable security floor — content-free metadata only, no payload inspection. Raising the floor rejects any downstream build still on an outdated tokeniser, forcing a fix through the single relay chokepoint.

The SDKs, MCP server and drop-in proxy are gateway-locked to the metered relay at construction, so the privacy relay, the signed receipt and billing run on every call. A builder can't route around them to a free, unmetered, unreceipted path.

A public conformance suite makes a third-party integration's correctness falsifiable — does it tokenise client-side, emit and check receipts, label its assurance level honestly. Builds that pass may display a "Verified by CloakAPI" badge; issuance is self-attested and manually reviewed, not automated certification.