Skip to main content

VCAL Privacy Guard

VCAL Privacy Guard is an optional commercial module for detecting and transforming sensitive text before it reaches caches or upstream LLM providers.

When enabled, AI Cost Firewall can use Privacy Guard to detect, redact, or anonymize sensitive values on the request path and restore mapped values on the response path.

Sensitive data detection​

Privacy Guard detects common personal identifiers and sensitive credentials before AI traffic reaches an upstream LLM. Depending on the configured mode, detected values can be reported (detect_only), redacted, or anonymized.

Currently detected data types include:

  • Payment card number patterns
  • Email addresses
  • Phone numbers
  • IPv4 addresses
  • US Social Security Numbers (SSNs)
  • International Bank Account Numbers (IBANs)
  • API keys and secrets
  • Bearer tokens
  • JWT tokens
  • Private cryptographic keys
note

IPv4 addresses can optionally be excluded from Privacy Guard detection so they remain available for security analysis.

Integration point​

Client
  -> AI Cost Firewall
  -> VCAL Security Guard (optional)
  -> VCAL Privacy Guard
  -> VCAL Usage Guard (optional)
  -> cache / upstream LLM
  -> VCAL Security Guard (optional)
  -> VCAL Privacy Guard restore
  -> Client

Typical AI Firewall configuration:

privacy_guard_enabled true;
privacy_guard_url http://vcal-privacy-guard:8090;
privacy_guard_api_key your-privacy-guard-key;
privacy_guard_mode anonymize;
privacy_guard_restore_enabled true;
privacy_guard_timeout_seconds 3;
guard_fail_open false;

Privacy Guard runs before Usage Guard and cache lookup, so anonymized or redacted content is used for usage-policy evaluation and cache processing. On a cache hit, AI Cost Firewall still applies response-side guard processing and restores mapped values before returning the response to the client.

Basic service checks:

curl http://localhost:8090/healthz
curl http://localhost:8090/readyz
curl http://localhost:8090/metrics

/healthz reports process liveness. /readyz reports runtime readiness and becomes unavailable while the service is shutting down or when the active license is no longer valid.

See Configuration for AI Firewall directives and Troubleshooting for common failures.

v0.8.2 content-array boundary

AI Cost Firewall can preserve OpenAI-style non-string message.content arrays/objects and forward them upstream, but the current guard integration sends only string message content to Privacy Guard. Nested text parts inside content arrays are not yet independently inspected or transformed.

note

This page intentionally covers only the AI Cost Firewall integration boundary. Full Privacy Guard documentation will be maintained separately.