VCAL Privacy Guard

VCAL Privacy Guard is an optional commercial module for detecting and transforming sensitive text before it reaches caches or upstream LLM providers.

When enabled, AI Cost Firewall can use Privacy Guard to detect, redact, or anonymize sensitive values on the request path and restore mapped values on the response path.

Integration point

Client
  -> AI Cost Firewall
  -> VCAL Security Guard (optional)
  -> VCAL Privacy Guard
  -> cache / upstream LLM
  -> VCAL Security Guard (optional)
  -> VCAL Privacy Guard restore
  -> Client

Typical AI Firewall configuration:

privacy_guard_enabled true;
privacy_guard_url http://vcal-privacy-guard:8090;
privacy_guard_api_key your-privacy-guard-key;
privacy_guard_mode anonymize;
privacy_guard_restore_enabled true;
privacy_guard_timeout_seconds 3;
guard_fail_open false;

Privacy Guard runs before cache lookup, so anonymized or redacted content is used for cache processing. On a cache hit, AI Cost Firewall still applies response-side guard processing and restores mapped values before returning the response to the client.

Basic service checks:

curl http://localhost:8090/healthz
curl http://localhost:8090/readyz
curl http://localhost:8090/metrics

/healthz reports process liveness. /readyz reports runtime readiness and becomes unavailable while the service is shutting down or when the active license is no longer valid.

See Configuration for AI Firewall directives and Troubleshooting for common failures.

note

This page intentionally covers only the AI Cost Firewall integration boundary. Full Privacy Guard documentation will be maintained separately.

Integration point​

Integration point