From: Stefan Gasser Date: Sun, 28 Jun 2026 22:59:08 +0000 (+0200) Subject: Refine PasteGuard positioning docs (#129) X-Git-Tag: v0.7.3~3 X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=10065a3ec2995ac510c7eb3ee7f90a19fb24e9fd;p=sgasser-llm-shield.git Refine PasteGuard positioning docs (#129) --- diff --git a/README.md b/README.md index 6f17389..f63fb81 100644 --- a/README.md +++ b/README.md @@ -13,14 +13,14 @@

- AI gets the context. Not your secrets.
- Automatically hides names, emails, and API keys before you send prompts to AI. + AI gets the context. Not your private data.
+ PasteGuard masks PII and secrets before they reach ChatGPT, Claude, Gemini, your API provider, Codex, or Claude Code.

- Quick Start · - Chat · - Coding Tools · + Browser Chat · + Apps & APIs · + Coding Agents · Documentation

@@ -29,23 +29,52 @@ - PasteGuard — Without vs. With: masks names, emails, and API keys before they reach AI + PasteGuard masks names, emails, and API keys before they reach AI

- Detects personal data and secrets in many languages.
- Your data never leaves your machine. + You keep the originals. Providers see placeholders.
+ Run it locally or self-host it in your own infrastructure.

-## Works Everywhere +## What PasteGuard Protects -**[Chat](https://pasteguard.com/docs/use-cases/chat)** — Masks PII and secrets when you paste into ChatGPT, Claude, and Gemini. You see originals, AI sees placeholders. +PasteGuard is a local-first privacy layer for teams that cannot send raw client data, customer records, logs, credentials, or production details directly to model providers. -**[Apps](https://pasteguard.com/docs/use-cases/apps)** — Open WebUI, LibreChat, or any self-hosted AI setup. Optionally routes sensitive requests to a local model. +It works in three places: -**[Coding Tools](https://pasteguard.com/docs/use-cases/coding-tools)** — Cursor, Claude Code, Copilot, Windsurf — your codebase context flows to the provider. PasteGuard masks secrets and PII before they leave. +### Browser Chat -**[API Integration](https://pasteguard.com/docs/use-cases/api-integration)** — Sits between your code and OpenAI-compatible or Anthropic APIs. Change one URL, your users' data stays protected. +**ChatGPT, Claude, and Gemini.** Paste customer notes, contracts, support tickets, candidate details, or internal context without sending the raw private values to the chat provider. You see the originals; the AI sees placeholders. + +The browser extension is currently in beta. + +**[Install browser extension](https://pasteguard.com/browser-extension)** · **[Browser Chat docs](https://pasteguard.com/docs/use-cases/chat)** + +### Apps & APIs + +**Apps, SDKs, and internal AI products.** Point your application to PasteGuard instead of the provider directly. + +Change one base URL. PasteGuard masks the request, forwards it to the configured provider, and restores supported placeholders in the response. + +**[Apps & APIs docs](https://pasteguard.com/docs/use-cases/api-integration)** + +### Coding Agents + +**Codex, Claude Code, Cursor, Windsurf, Copilot, and other coding agents.** Agent prompts often include logs, stack traces, tickets, config files, test fixtures, and codebase context. PasteGuard masks secrets and PII before that context leaves your machine. + +**[Coding Agents docs](https://pasteguard.com/docs/use-cases/coding-tools)** + +## Built For Strict Privacy Rules + +PasteGuard is not a compliance certification and does not make your system compliant by itself. It is designed for teams that need a local or self-hosted control point before AI providers. + +Use it when your current options are: + +- Do not use cloud AI for sensitive work +- Redact client or production data manually +- Fall back to a weaker local model because the provider cannot see real context +- Build one-off masking code inside every app ## Quick Start @@ -57,7 +86,7 @@ docker run --rm -p 3000:3000 ghcr.io/sgasser/pasteguard:latest Open [localhost:3000](http://localhost:3000) for the dashboard. -Point your tools or app to PasteGuard instead of the provider: +Point your app or agent to PasteGuard instead of the provider: | Target | PasteGuard URL | Original URL | |----------|----------------|--------------| @@ -66,48 +95,38 @@ Point your tools or app to PasteGuard instead of the provider: | Codex CLI | `http://localhost:3000/codex` | `https://chatgpt.com/backend-api/codex` | ```python -# One line to protect your data +from openai import OpenAI + client = OpenAI(base_url="http://localhost:3000/openai/v1") ``` -Detection is multilingual out of the box — no per-language images or setup. For custom config or persistent logs: **[Read the docs →](https://pasteguard.com/docs/installation)** +For custom config, persistent logs, Docker Compose, or detector settings: **[Read the docs](https://pasteguard.com/docs/installation)**. -
-Route Mode +## Privacy Modes -Route Mode sends requests containing sensitive data to a local LLM (Ollama, vLLM, llama.cpp). Everything else goes to the configured cloud provider. Sensitive data stays on your network. +
+Mask Mode -**[Route Mode docs →](https://pasteguard.com/docs/concepts/route-mode)** +Mask Mode replaces PII and secrets with placeholders before sending the request to the upstream AI provider. Supported responses are restored before they return to the user.
-## Chat - -Open-source browser extension for ChatGPT, Claude, and Gemini. - -- Paste customer data → masked before it reaches the AI -- AI responds with placeholders → you see the originals -- Works with the same detection engine as the proxy - -Currently in beta. Apache 2.0. - -**[Join the Beta →](https://tally.so/r/J9pNLr)** · **[Chat docs →](https://pasteguard.com/docs/use-cases/chat)** +
+Route Mode -## Coding Tools +Route Mode sends requests containing sensitive data to a local LLM such as Ollama, vLLM, or llama.cpp. Requests without sensitive data can still go to the configured cloud provider. -Protect your codebase context and secrets when using AI coding assistants. +**[Route Mode docs](https://pasteguard.com/docs/concepts/route-mode)** -**Claude Code:** +
-```bash -ANTHROPIC_BASE_URL=http://localhost:3000/anthropic claude -``` +## What It Catches -**Cursor:** Settings → Models → Enable "Override OpenAI Base URL" → `http://localhost:3000/openai/v1` +**Personal data**: Names, locations, emails, phone numbers, credit cards, IBANs, IP addresses, and EU VAT numbers. Detection is multilingual. -**Codex CLI:** Configure a custom provider with `base_url = "http://127.0.0.1:3000/codex"`. See the coding tools docs for the full snippet. +**Secrets**: API keys for providers such as OpenAI, Anthropic, Stripe, AWS, and GitHub; SSH and PEM private keys; JWT tokens; bearer tokens; passwords; and connection strings. -**[Coding Tools docs →](https://pasteguard.com/docs/use-cases/coding-tools)** +Both are detected and masked in real time, including streaming responses. ## Dashboard @@ -117,17 +136,9 @@ Every request is logged with masking details. See what was detected, what was ma [localhost:3000](http://localhost:3000) -## What it catches - -**Personal data** — Names, locations, emails, phone numbers, credit cards, IBANs, IP addresses, and EU VAT numbers. Works in many languages. - -**Secrets** — API keys (OpenAI, Anthropic, Stripe, AWS, GitHub), SSH and PEM private keys, JWT tokens, bearer tokens, passwords, connection strings. - -Both detected and masked in real time, including streaming responses. - -## How detection works +## How Detection Works -Detection runs as a separate service that PasteGuard calls over HTTP, so you can run it wherever you like. It mixes exact checks with checksums (IBANs, credit cards, emails, phones, IPs) and a small AI model ([GLiNER](https://github.com/urchade/GLiNER)) for names and places. It works the same in any language. Phone numbers are international-only by default; add `phone_regions` if you need local formats. +Detection runs as a separate service that PasteGuard calls over HTTP, so you can run it wherever you like. It combines deterministic checks and checksums for structured values with a small AI model ([GLiNER](https://github.com/urchade/GLiNER)) for names and places. Code, Docker image, and tests are in [`detector/`](detector/). diff --git a/docs/concepts/local-first-privacy.mdx b/docs/concepts/local-first-privacy.mdx new file mode 100644 index 0000000..c8db59f --- /dev/null +++ b/docs/concepts/local-first-privacy.mdx @@ -0,0 +1,72 @@ +--- +title: Local-First Privacy +description: What stays local, what reaches AI providers, and how PasteGuard restores placeholders +--- + +PasteGuard is designed to put a privacy layer before AI providers. The goal is simple: useful context can still reach the model, but sensitive values are replaced before the request leaves your environment. + +## What Stays Local + +In a local or self-hosted deployment, PasteGuard keeps the sensitive originals inside your environment. + +Examples: + +- Names +- Email addresses +- Phone numbers +- Account identifiers +- API keys +- Bearer tokens +- Private keys +- Connection strings + +PasteGuard stores a temporary placeholder mapping so supported responses can be restored before they return to the user. + +## What Providers See + +Providers receive masked prompts such as: + +```text +Write a follow-up to [[PERSON_1]] at [[EMAIL_ADDRESS_1]] about the renewal. +``` + +The model still gets useful structure and context, but not the original private value. + +## Restoration + +In mask mode, PasteGuard restores supported placeholders in the model response before returning it to the user. + +For example: + +```text +Provider response: I can draft a note to [[PERSON_1]]. +User receives: I can draft a note to Dr. Sarah Chen. +``` + +Restoration depends on the provider endpoint and response format. OpenAI Chat Completions, Anthropic Messages, and Codex Responses have provider-specific extraction and restoration paths. + +## Browser Extension + +The browser extension is currently in beta. It uses a local PasteGuard server for masking and restoration so browser chat can follow the same privacy model as the proxy. + +## Logs And Dashboard + +PasteGuard includes a local dashboard that shows request history, detected entities, and masked content sent upstream when logging is enabled. + +Review [Logging](/configuration/logging) before using PasteGuard with production or regulated data. Configure retention and masked-content logging according to your organization's policy. + +## Route Mode + +Route mode is stricter than mask mode. Requests containing sensitive data can be sent to a local model instead of a cloud provider. + +Use route mode when a use case should not send even masked sensitive requests to a cloud model. + + + Configure local routing for sensitive requests + + +## What PasteGuard Does Not Claim + +PasteGuard does not by itself certify compliance with DORA, GDPR, HIPAA, SOC 2, or any other framework. + +It gives teams a local or self-hosted control point before requests reach model providers. diff --git a/docs/introduction.mdx b/docs/introduction.mdx index 4867916..05414a7 100644 --- a/docs/introduction.mdx +++ b/docs/introduction.mdx @@ -1,42 +1,52 @@ --- title: Introduction -description: AI gets the context. Not your secrets. Open-source privacy proxy for OpenAI, Anthropic, and any AI. +description: AI gets the context. Not your private data. PasteGuard protects Browser Chat, Apps & APIs, and Coding Agents. --- -PasteGuard automatically hides names, emails, and API keys before you send prompts to AI. Your data never leaves your machine. +PasteGuard masks PII and secrets before they reach ChatGPT, Claude, Gemini, your API provider, Codex, or Claude Code. You keep the originals. Providers see placeholders. -Detects personal data and secrets in many languages. +It is built for teams that want to use AI with real context but cannot send raw client, customer, production, or credential data to model providers. - PasteGuard Comparison - PasteGuard Comparison + PasteGuard masks names, emails, and API keys before they reach AI + PasteGuard masks names, emails, and API keys before they reach AI -## Works Everywhere +## One Privacy Layer - - - ChatGPT, Claude, Gemini + + + ChatGPT, Claude, and Gemini. Browser extension beta. - - Open WebUI, LibreChat + + Apps, SDKs, and internal AI products. - - Cursor, Claude Code, Copilot, Windsurf + + Codex, Claude Code, Cursor, Windsurf, and other coding agents. - - OpenAI SDK, Anthropic SDK, LangChain + + +## Built For Raw Data Limits + +PasteGuard does not certify your organization as compliant. It gives teams a local or self-hosted control point before requests reach AI providers. + +Use it when the current options are manual redaction, no cloud AI for sensitive work, a weaker local-only model, or custom masking code in every app. + + + + Patterns for finance, legal, healthcare, consulting, and other sensitive work. + + + What stays local, what reaches providers, and how placeholders are restored. -## Two Privacy Modes +## Privacy Modes | Mode | How it works | |------|--------------| -| **Mask** | Replace PII with placeholders, send to the upstream AI service, restore in response | -| **Route** | PII requests stay on your local LLM (Ollama, vLLM, llama.cpp), others go to the configured cloud provider | - -PasteGuard runs on your servers. Personal data never leaves your infrastructure, and the LLM provider never sees real names, emails, or secrets. +| **Mask** | Replace PII and secrets with placeholders, send to the upstream AI service, restore supported placeholders in the response | +| **Route** | Requests with sensitive data stay on your local LLM; other requests go to the configured cloud provider | ## Next Steps @@ -44,7 +54,7 @@ PasteGuard runs on your servers. Personal data never leaves your infrastructure, Run PasteGuard as a local proxy - - Customize detection and providers + + Configure Docker, persistent logs, and detector settings diff --git a/docs/mint.json b/docs/mint.json index 4ccdb25..aa206ba 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -40,14 +40,15 @@ "group": "Use Cases", "pages": [ "use-cases/chat", - "use-cases/apps", + "use-cases/api-integration", "use-cases/coding-tools", - "use-cases/api-integration" + "use-cases/regulated-teams" ] }, { "group": "Concepts", "pages": [ + "concepts/local-first-privacy", "concepts/mask-mode", "concepts/route-mode", "concepts/pii-detection", diff --git a/docs/quickstart.mdx b/docs/quickstart.mdx index d8237ab..e92ffff 100644 --- a/docs/quickstart.mdx +++ b/docs/quickstart.mdx @@ -1,6 +1,6 @@ --- title: Quickstart -description: Run PasteGuard as a local proxy +description: Run PasteGuard locally and connect Browser Chat, Apps & APIs, or Coding Agents --- ## 1. Start PasteGuard @@ -12,12 +12,26 @@ docker run --rm -p 3000:3000 ghcr.io/sgasser/pasteguard:latest PasteGuard runs on `http://localhost:3000`. Open `http://localhost:3000` to see the dashboard. -For custom configuration or persistent logs, see [Installation](/installation). +For custom configuration, Docker Compose, or persistent logs, see [Installation](/installation). -## 2. API Endpoints +## 2. Choose Your Path -Point your tools or SDKs to PasteGuard: + + + Use the browser extension beta with ChatGPT, Claude, and Gemini. + + + Change one base URL for your app or SDK. + + + Point Codex, Claude Code, Cursor, and other coding agents at PasteGuard. + + + +## 3. API Endpoints + +Point your app, SDK, or coding agent to PasteGuard: | Target | PasteGuard URL | |----------|----------------| @@ -25,7 +39,7 @@ Point your tools or SDKs to PasteGuard: | Anthropic | `http://localhost:3000/anthropic` | | Codex CLI | `http://localhost:3000/codex` | -## 3. Verify It Works +## 4. Verify It Works Send a test request and check the response headers: @@ -37,38 +51,22 @@ curl -i http://localhost:3000/openai/v1/chat/completions \ ``` Look for: -``` + +```text X-PasteGuard-PII-Detected: true X-PasteGuard-PII-Masked: true ``` The name and email were masked before reaching OpenAI and restored in the response. -## 4. View Dashboard +## 5. View Dashboard Open `http://localhost:3000` in your browser to see: - Request history -- Detected PII entities +- Detected PII and secrets - Masked content sent to upstream APIs or Codex CLI PasteGuard Dashboard - -## Now Configure Your Tool - - - - ChatGPT, Claude, Gemini - - - Open WebUI, LibreChat - - - Cursor, Claude Code, Copilot, Windsurf - - - OpenAI SDK, Anthropic SDK, LangChain - - diff --git a/docs/use-cases/api-integration.mdx b/docs/use-cases/api-integration.mdx index f9b2a4d..9e5ffbb 100644 --- a/docs/use-cases/api-integration.mdx +++ b/docs/use-cases/api-integration.mdx @@ -1,10 +1,12 @@ --- -title: API Integration -sidebarTitle: API Integration -description: Mask PII in your AI-powered application with OpenAI, Anthropic, LangChain, and LlamaIndex +title: Apps & APIs +sidebarTitle: Apps & APIs +description: Add PII and secrets protection to apps and SDKs that call AI providers --- -Point your SDK to PasteGuard instead of the provider directly. Every request gets PII and secrets protection automatically. +Use this path for apps, SDKs, internal AI products, customer-facing AI features, and automation that calls model providers through HTTP APIs. + +Point the app to PasteGuard instead of the provider directly. PasteGuard masks PII and secrets, forwards the request, and restores supported placeholders in the response. ## OpenAI SDK @@ -50,6 +52,14 @@ const client = new Anthropic({ +## Self-Hosted App Examples + +Self-hosted products such as Open WebUI and LibreChat can also use PasteGuard as their OpenAI-compatible endpoint. + + + Example configuration for self-hosted chat products + + ## LangChain ```python @@ -71,3 +81,12 @@ llm = OpenAILike( is_chat_model=True ) ``` + +## When To Use This Path + +Use this path when you are building or operating the app: + +- Internal support, legal, finance, or operations apps +- Customer-facing AI features that may process user data +- Self-hosted AI interfaces for teams +- Regulated teams that need a local or self-hosted control point before requests reach a provider diff --git a/docs/use-cases/apps.mdx b/docs/use-cases/apps.mdx index ff53d1d..f5dac83 100644 --- a/docs/use-cases/apps.mdx +++ b/docs/use-cases/apps.mdx @@ -1,10 +1,10 @@ --- -title: Apps -sidebarTitle: Apps -description: Protect data in Open WebUI, LibreChat, and other self-hosted AI setups +title: Open WebUI and LibreChat +sidebarTitle: Open WebUI and LibreChat +description: Example configuration for self-hosted chat products inside Apps & APIs --- -PasteGuard sits between your self-hosted chat interface and the LLM provider. Users interact with Open WebUI, LibreChat, or similar tools — PasteGuard handles privacy automatically in the background. +Open WebUI and LibreChat are examples inside the Apps & APIs path. Users keep the same chat UI while PasteGuard handles masking, forwarding, restoration, and dashboard logging in the background. ## Open WebUI @@ -15,7 +15,7 @@ OPENAI_API_BASE_URL=http://localhost:3000/openai/v1 OPENAI_API_KEY=your_openai_api_key ``` -In Docker Compose, use the service name instead of `localhost` (e.g., `http://pasteguard:3000/openai/v1`). +In Docker Compose, use the service name instead of `localhost`, such as `http://pasteguard:3000/openai/v1`. ## LibreChat @@ -27,7 +27,7 @@ cache: true endpoints: custom: - name: "PasteGuard" - apiKey: "${OPENAI_API_KEY}" # Your API key, forwarded to OpenAI + apiKey: "${OPENAI_API_KEY}" baseURL: "http://localhost:3000/openai/v1" models: default: ["gpt-5.2"] @@ -42,8 +42,8 @@ Self-hosted setups can use either privacy mode depending on your requirements: | Mode | Best for | How it works | |------|----------|--------------| -| **Mask** | Teams using cloud LLMs (OpenAI, Anthropic) | Replaces PII with placeholders, sends to cloud provider, restores in response | -| **Route** | Teams with a local LLM (Ollama, vLLM) | Requests containing PII stay on your local LLM, others go to the cloud provider | +| **Mask** | Teams using cloud LLMs | Replaces PII and secrets with placeholders, sends to the cloud provider, restores supported placeholders in the response | +| **Route** | Teams with a local LLM | Requests containing sensitive data stay on your local LLM, others go to the cloud provider | Route Mode requires a local LLM provider configured in `config.yaml`. See [Route Mode](/concepts/route-mode) for setup details. diff --git a/docs/use-cases/chat.mdx b/docs/use-cases/chat.mdx index add7fdc..20a5a1b 100644 --- a/docs/use-cases/chat.mdx +++ b/docs/use-cases/chat.mdx @@ -1,25 +1,41 @@ --- -title: Chat -sidebarTitle: Chat -description: Mask PII when pasting into ChatGPT, Claude, and Gemini +title: Browser Chat +sidebarTitle: Browser Chat +description: Mask private data before it reaches ChatGPT, Claude, or Gemini --- -Paste customer data into ChatGPT — the AI sees `[[PERSON_1]]` and `[[EMAIL_ADDRESS_1]]`. When you copy the response, placeholders are replaced with the originals. +Browser Chat protects what people already do: paste real context into ChatGPT, Claude, and Gemini. + +PasteGuard masks names, emails, account details, customer notes, contracts, support tickets, and other sensitive values before they reach the chat provider. You keep the originals. The AI sees placeholders. + + +The browser extension is currently in beta. + ## Supported Platforms -- ChatGPT (chatgpt.com) -- Claude (claude.ai) -- Google Gemini (gemini.google.com) +- ChatGPT (`chatgpt.com`) +- Claude (`claude.ai`) +- Google Gemini (`gemini.google.com`) ## How It Works -1. **Paste** — You paste text containing PII into the chat input -2. **Mask** — The extension detects and masks PII via your local PasteGuard server -3. **Chat** — The masked text is inserted into the chat. The AI only sees placeholders. -4. **Copy** — When you copy the AI's response, placeholders are replaced with the original values +1. **Paste**: You paste text containing PII or secrets into the chat input. +2. **Mask**: The extension sends text to your local PasteGuard server for masking. +3. **Chat**: Masked text is inserted into the chat. The provider sees placeholders such as `[[PERSON_1]]` and `[[EMAIL_ADDRESS_1]]`. +4. **Copy**: When you copy a supported AI response, placeholders are replaced with the original values. + +Placeholder numbering stays consistent across messages in the same conversation. Streamed responses are highlighted in real time. + +## Who This Helps + +Browser Chat is useful for teams that want AI help with real work but cannot paste raw sensitive data into third-party chat products: -Placeholder numbering stays consistent across messages in the same conversation. Streamed responses are highlighted in real-time. +- Advisors and consultants working with client data +- Legal teams handling contracts or privileged context +- Support and success teams working with customer tickets +- Recruiting and HR teams handling candidate or employee data +- Finance, insurance, and healthcare-adjacent work with strict confidentiality needs ## Requirements @@ -31,10 +47,10 @@ docker run --rm -p 3000:3000 ghcr.io/sgasser/pasteguard:latest See [Quickstart](/quickstart) for setup details. -## Beta +## Install Browser Extension -The browser extension is in beta. Open source (Apache 2.0). +The browser extension uses the same detection and masking engine as the local proxy. - - Get early access to the browser extension + + Add PasteGuard to Firefox or Chrome diff --git a/docs/use-cases/coding-tools.mdx b/docs/use-cases/coding-tools.mdx index ee710d8..c22b5f0 100644 --- a/docs/use-cases/coding-tools.mdx +++ b/docs/use-cases/coding-tools.mdx @@ -1,34 +1,23 @@ --- -title: Coding Tools -description: Protect your codebase context and secrets in Claude Code, Cursor, and other AI coding assistants +title: Coding Agents +sidebarTitle: Coding Agents +description: Protect codebase context, logs, tickets, and secrets in Codex, Claude Code, and other coding agents --- -PasteGuard protects your codebase when you use AI coding assistants. Config files with database credentials, customer data in test fixtures, API keys in environment files — all masked before reaching the provider. +Coding agents often receive more than code. They see logs, stack traces, support tickets, config snippets, test fixtures, environment examples, and production context. -## What Gets Detected - -- **Secrets** — API keys, private keys, database passwords, tokens in config files and `.env` files -- **PII** — Customer names, emails, phone numbers in code comments, test data, or log output - -PII detection works [in many languages](/installation). Full entity lists: [PII Detection](/concepts/pii-detection), [Secrets Detection](/concepts/secrets-detection). - -## Claude Code - -One environment variable: +PasteGuard sits between the coding agent and the provider, masks PII and secrets before the request leaves your environment, and restores supported placeholders in responses. -```bash -ANTHROPIC_BASE_URL=http://localhost:3000/anthropic claude -``` +## What Gets Detected -To make it permanent, add to your shell profile: +- **Secrets**: API keys, private keys, database passwords, bearer tokens, JWTs, connection strings, and `.env` values +- **PII**: Customer names, emails, phone numbers, locations, account data, test fixtures, comments, and log output -```bash -export ANTHROPIC_BASE_URL=http://localhost:3000/anthropic -``` +PII detection works [in many languages](/concepts/pii-detection). Full entity lists: [PII Detection](/concepts/pii-detection), [Secrets Detection](/concepts/secrets-detection). ## Codex CLI -Codex users signed in with ChatGPT should use PasteGuard's Codex endpoint, not the OpenAI API endpoint: +Codex users signed in with ChatGPT should use PasteGuard's Codex endpoint: ```toml model_provider = "pasteguard-codex" @@ -51,23 +40,37 @@ codex exec --skip-git-repo-check 'Reply with exactly: ok' Codex Responses requests are scanned, masked, unmasked, and shown in the dashboard. In route mode, sensitive Codex requests are blocked because PasteGuard does not route Codex Responses traffic to a local provider. +## Claude Code + +One environment variable: + +```bash +ANTHROPIC_BASE_URL=http://localhost:3000/anthropic claude +``` + +To make it permanent, add to your shell profile: + +```bash +export ANTHROPIC_BASE_URL=http://localhost:3000/anthropic +``` + ## Cursor -1. Open **Settings** → **Models** -2. Scroll to **API Keys** section -3. Enable **Override OpenAI Base URL** toggle +1. Open **Settings** -> **Models** +2. Scroll to **API Keys** +3. Enable **Override OpenAI Base URL** 4. Enter: `http://localhost:3000/openai/v1` 5. Add your OpenAI API key -## Environment Variables +## Other Coding Agents -Most AI coding tools respect the standard environment variables: +Most coding agents respect standard provider base URL settings: ```bash -# OpenAI-compatible tools +# OpenAI-compatible agents export OPENAI_API_BASE=http://localhost:3000/openai/v1 -# Anthropic tools (Claude Code, etc.) +# Anthropic-compatible agents export ANTHROPIC_BASE_URL=http://localhost:3000/anthropic ``` @@ -75,6 +78,6 @@ export ANTHROPIC_BASE_URL=http://localhost:3000/anthropic | Target | PasteGuard URL | |----------|----------------| -| OpenAI | `http://localhost:3000/openai/v1` | -| Anthropic | `http://localhost:3000/anthropic` | +| OpenAI-compatible agents | `http://localhost:3000/openai/v1` | +| Anthropic-compatible agents | `http://localhost:3000/anthropic` | | Codex CLI | `http://localhost:3000/codex` | diff --git a/docs/use-cases/regulated-teams.mdx b/docs/use-cases/regulated-teams.mdx new file mode 100644 index 0000000..f624347 --- /dev/null +++ b/docs/use-cases/regulated-teams.mdx @@ -0,0 +1,72 @@ +--- +title: Regulated Teams +sidebarTitle: Regulated Teams +description: Use AI with sensitive context without sending raw private values to model providers +--- + +Regulated teams often want AI help, but the useful context is exactly the context they cannot paste into a third-party provider unchanged. + +PasteGuard gives these teams a local or self-hosted privacy layer before requests leave their environment. + +## Common Status Quo + +Teams usually choose one of these options before adopting a privacy layer: + +- Avoid cloud AI for sensitive work +- Redact client or production data manually +- Use a weaker local model because cloud providers cannot receive raw data +- Build one-off masking code inside each app + +PasteGuard is designed to replace that manual step with a consistent control point. + +## Who It Fits + +PasteGuard is useful when sensitive values appear in normal AI work: + +- Finance and banking work with customer or transaction context +- Legal and advisory work with privileged or client-confidential material +- Healthcare-adjacent operations with patient or provider details +- Insurance, accounting, consulting, HR, and recruiting work +- Regulated SaaS teams handling logs, support tickets, and production context + +## Product Paths + + + + Browser extension beta for ChatGPT, Claude, and Gemini. + + + Apps, SDKs, internal AI products, and provider-compatible APIs. + + + Codex, Claude Code, logs, tickets, codebase context, and secrets. + + + +## Deployment Model + +PasteGuard can run locally for individual use, or self-hosted for team and infrastructure use. + +Use local or self-hosted deployment when your team needs tighter control over: + +- Where private values are processed +- Which provider receives masked requests +- What request metadata is logged +- How sensitive requests are routed to local models +- How masking rules are configured + + +PasteGuard is not a compliance certification and does not make an organization compliant by itself. It can help keep sensitive values out of prompts before they reach a provider. + + +## What To Validate In A Pilot + +For a regulated pilot, validate the trust questions before adding more features: + +- Can users complete real work without manual redaction? +- Do they understand which values stayed local? +- Do they trust the restoration flow? +- Do they need local, self-hosted, or managed deployment? +- Which logs and audit exports are required before production use? + +Start with [Local-First Privacy](/concepts/local-first-privacy), then connect the path your team uses most: [Browser Chat](/use-cases/chat), [Apps & APIs](/use-cases/api-integration), or [Coding Agents](/use-cases/coding-tools).