Clean prompts. Caught early.
Saaf finds Aadhaar, PAN, GSTIN, UPI and 18 more Indian identifiers in your AI traffic, swaps them for tokens before they leave your network, and puts the real values back in the reply.
Mask on the way out. Restore on the way back.
Saaf sits between your users and any LLM, as a library, a gateway or a plugin. Real values stay in a short-lived vault on your side.
Detect
It cleans up hidden characters, lookalike letters and Indic digits, then checks every match with Verhoeff, Luhn and GSTIN maths.
Mask
Your policy decides whether to mask, block, warn or allow. Each value keeps the same token for the whole conversation.
Restore
Values come back even when the model changes case, drops brackets or streams the reply chunk by chunk.
Try it. Nothing leaves this tab.
This is the real Saaf engine, running in your browser. For a full round trip with a real model, streaming and file masking, open the playground.
Your text
What the model sees
Processed on your deviceModel reply, restored
Edit the reply to try messy tokensBuilt for how Indian data really looks.
Checksums, not guesses
Any 12 digits match an "Aadhaar regex". Saaf checks the maths, and the nearest label wins, so "Order ID 2345…" stays untouched.
Hinglish & Indic scripts
"mera adhaar", आधार, and digits in Devanagari, Bengali, Tamil, Telugu and five more scripts.
OCR repair
"2345 67B9 O124" from a scanned card is still an Aadhaar. The checksum confirms the repair before it counts.
Streaming-safe restore
Only the few characters that could start a token are held back. Everything else streams straight through.
Shadow mode
Watch what's really being sent for two weeks before you enforce anything. Types and counts only.
Signed audit & evidence
Hash-chained, signed records and an evidence pack (data flows, processors, retention) for your reviewers.
Measured in public.
IndicPII-Bench is our open benchmark: 2,500 documents, including Hindi, Marathi, Tamil and Telugu text from the public Naamapadam and HiNER datasets. Here Saaf runs against Microsoft Presidio with all its India recognizers on and its threshold tuned.
Detection F1 higher is better
False alarms per 1k tokens lower is better
*IndicPII-Bench v1, 2,500 documents; Presidio 2.2 with spaCy en_core_web_lg, threshold tuned on a separate dev set. Saaf is also about 44× faster per KB and 0.1 MB against 691 MB installed. Both tools still score near zero on unlabelled Indian names, and Saaf's rules were tuned on the same synthetic families, so treat its identifier scores as optimistic until our human-labelled gold set is out. Reproduce it.
22 identifier types
Works where your teams already use AI.
Gateway
An OpenAI- and Anthropic-compatible proxy. Change one URL.
Python & TypeScript
Zero-dependency libraries for servers, browsers and notebooks.
LiteLLM
One guardrail covers your whole model fleet.
Open WebUI
A one-file filter with per-chat sessions.
LangChain & RAG
Mask documents before you embed them.
MCP & Claude Code
Tools for agents and a hook that blocks PII.
Browser extension beta
Warns before you paste PII into AI chats.
CLI & pre-commit
Keeps PII out of repositories and CI logs.
n8n soon
Mask a field before any AI step.
Three lines to start.
Install the library or point your SDK at the gateway. Policies are TOML files you review like any other code.
- Consistent tokens. The same value always gets the same token, so the model can reason across a conversation.
- Tool calls handled. Function arguments come back as valid JSON.
- Same results everywhere. Python and TypeScript pass one shared test suite.
# pip install "saaf @ git+https://github.com/physicsisawesome7/Saaf#subdirectory=packages/saaf-core"
from saaf import Saaf
saaf = Saaf()
masked = saaf.mask("PAN ABCPE1234F, call +91 98765 43210")
masked.text # 'PAN [PAN_1], call [PHONE_IN_1]'
reply = llm(masked.text)
saaf.restore(reply).text# Run it in two minutes: github.com/physicsisawesome7/Saaf/blob/main/docs/try-it.md
from openai import OpenAI
client = OpenAI(base_url="http://localhost:8787/v1")
# masked on the way out, restored on the way back,
# streaming included// npm package coming soon; build from packages/saaf-js meanwhile
import { Saaf } from "@safearly/saaf";
const saaf = new Saaf();
const s = saaf.streamRestorer();
for await (const chunk of stream) out.write(s.feed(chunk));
out.write(s.flush());[policy]
mode = "shadow" # observe first, enforce later
default_action = "mask"
[entities.SECRET]
action = "block"
[[rules]] # approved in-region endpoint
entities = ["PAN"]
destinations = ["*.in-region.example.com"]
action = "allow"Built so we never see your data.
Saaf runs on your infrastructure. Safearly never receives your prompts, replies or token mappings.
| Data | Where it lives | How long |
|---|---|---|
| Your prompt | Your own process, in memory | For the request |
| Token ↔ value vault | In memory by default; optionally SQLite or Redis, encrypted with AES-GCM | Session, or a TTL you set |
| What the LLM receives | Tokens such as [PAN_1] in place of values | The provider's terms |
| Audit records | Your log sink: types and counts only, signed and hash-chained | Your retention policy |
| Anything sent to Safearly | Nothing. No telemetry. | n/a |
Careful by default
Persistent vaults refuse to run without an encryption key. Destroying a key crypto-shreds its data. Values never appear in logs.
Verifiable releases
Signed packages and container images, an SBOM with every release, a public threat model, and an external review of the vault cryptography before enterprise availability.
Honest limits
Saaf can miss names without an honorific or a label such as “Name:”, free-text addresses, images and unlabelled numbers. Full list.
Saaf provides evidence and safeguards for your own DPDP work. It is not a compliance certificate, and we will never claim it is. Found a vulnerability? Email lalit@safearly.com (we acknowledge within 3 working days).
Free to start. Ready to scale.
Open source
Apache-2.0, forever.
- Libraries, CLI and gateway
- All plugins
- IndicPII-Bench
- Community support
Team
For teams putting AI on customer data.
- Console and policy editor
- Shadow-mode findings feed
- Audit viewer and evidence exports
- BFSI sector pack
Enterprise
For regulated organisations.
- SSO and RBAC
- KMS-backed vaults
- On-prem and air-gapped installs
- Health and HR packs, SLAs
Questions, answered.
Can I try it without installing anything?
Yes. The playground runs the real engine in your browser: chat with a model of your choice (or a simulated one, no key needed) and see exactly what the model receives, or mask a whole CSV. To run it on your own machines, see Try Saaf.
Does our data leave our network?
No. Saaf runs as a library, a gateway or a plugin on your own infrastructure. Only tokens reach the model provider, and Safearly never receives your traffic.
Is Saaf "DPDP compliant"?
No tool can make you compliant on its own. Saaf reduces how much personal data reaches LLMs and produces evidence (policies, signed audit logs, an evidence pack) for your own DPDP programme. Have your counsel review how you use it.
How is it different from a regex?
It validates checksums (Verhoeff, Luhn, GSTIN), scores the surrounding words, repairs OCR errors and normalises Unicode. On look-alike numbers such as order IDs, a bare regex raised 245.66 false alarms per 1,000 tokens and Microsoft Presidio (tuned) 131.34; Saaf raised 0.35.
Does it work with streaming responses?
Yes. Text streams through as it arrives; only the few characters that could start a token are held back. Tests check that any chunking gives the same result.
What doesn't it catch?
Names without an honorific or a label such as “Name:”, free-text addresses, images, and unlabelled generic numbers such as bank accounts or PIN codes. An Indic name-recognition model is on the roadmap.
What does this website collect?
Nothing. There are no cookies, no analytics and no third-party scripts. The demo runs entirely in your browser. In the playground, if you pick a model provider, your browser sends the masked text straight to that provider with your key; Safearly never sees either. If you email us, we use your address only to reply.
Start in shadow mode this week.
We're onboarding design partners in fintech, health, legal and BPO. Your pilot is free, with a weekly findings review. We only ever see types and counts.