Project

Sovereign Shield

Use ChatGPT, Gemini or Claude while the things you'd never want to paste — AHV and IBAN numbers, cards, API keys, a client's name — stay on your side of the border. Each one becomes a placeholder before the prompt is sent, and the real value comes back in the reply.

Add to Chrome v0.8.3 · free · no account, no servers · try it in the browser first → 
Draft a reply to Hans Muster about the double charge.
AHV 756.1234.5678.97, IBAN CH93 0076 2011 6238 5295 7,
card 4111 1111 1111 1111.

An ordinary prompt, pasted into ChatGPT, Gemini or Claude.

Draft a reply to Hans Muster about the double charge.
[AHV_1], [IBAN_1], [CARD_1].

The only thing that crosses the border. Even if the provider logs every prompt it receives, all it logged were placeholders.

"Dear Hans Muster, sorry about the double charge — we've
refunded CHF 240 to CH93 0076 2011 6238 5295 7."

The real values slot back in on the way home, in your browser. The answer reads normally; the model never saw them.

Synthetic values, but real detector output: [AHV_1], [IBAN_1] and [CARD_1] are what ships. The name stays — names have no check digit to verify, so the shield deliberately leaves them alone rather than guess.

The Sovereign Shield inspector open beside a Gemini composer. The 'You typed' pane lists a name, an AHV number, an IBAN, a mobile number, an email and a card number; the 'What the provider receives' pane shows the same message with [AHV_1], [IBAN_1], [PHONE_1], [CARD_1] and a stand-in address in their place, while the name is unchanged.
Not a mockup — the extension on Gemini. Above the chat box, a count of what will stay local; on the right, your prompt beside the payload Google would actually receive. The name is the one thing left alone.
Why a boundary, and not a policy

Picture an employee pasting a customer email into ChatGPT to draft a reply — a name, an AHV number, an IBAN. Thirty seconds saved; also a cross-border transfer of personal data to a US-hosted service, which is precisely the act the revised Swiss FADP (and the GDPR) built their guardrails around. The violation isn't the model misbehaving — it's the data leaving.

So the fix is a boundary, not a better promise. Sovereign Shield sits on the egress path — inside the chat page as an extension, or as a proxy in front of your own app — and does the same thing either way: identifiers out, placeholders in, real values restored on the way home.

Why regex and checksums, and not a model

Lean on an LLM to do the redacting and you inherit the very blind spots that let a model leak in the first place; reach for a cloud "PII detection" API and you have already shipped the personal data off somewhere to find it. Better to validate a Swiss AHV by its EAN-13 check digit, an IBAN by ISO-7064 mod-97, a card by Luhn. Shape and check digit must agree, so ordinary text is never touched — and it runs air-gapped.

Where it stops
  • Structured identifiers are the deterministic core — AHV, IBANs, cards, phones, emails, national IDs across the EU, UK, Americas and Asia, plus common API keys and secrets and any term you add yourself. Names and street addresses need a named-entity model.
  • It guards the prompt you type, not the files you attach — redact a document before you upload it.
  • Some tasks genuinely need the real value (validate this IBAN; compute an age from a date of birth). Tokenisation is a per-field policy, not a blanket switch.
  • It doesn't try to survive deliberate obfuscation, and it's data minimisation and residency — not a DPIA, not legal advice. It's the outer, deliberately-dumb layer of a defence-in-depth stack.

Does redacting the prompt make the model dumber? Rather than guess, I ran it — three real Swiss business documents, three models, all judged blind.

Privacy total No raw personal data reached a model; the token↔value round-trip was flawless.
Utility a small cost Task-dependent and mild — names, amounts, and numbers stayed correct either way.
The numbers and the caveats →
In your browser The extension A live count of what stays local before you hit send, your prompt beside what the provider actually receives, and a warning if a site ever changes its API so a message would go out uninspected. See it working → In front of your app The gateway The same boundary as an OpenAI-compatible proxy: your app changes its base_url and nothing else, and every request leaves an audit line for the DPO. Watch the round-trip →

Source on GitHub · How it works · Privacy policy

Open source under Apache-2.0 — the stdlib-only detector core, the tokenise → restore round-trip, and the demo. pip install sovereign-shield-ch.

Write-up

Sovereign Shield grew out of K.E.V.I.N., the autonomous red-teaming research that proved why you can't trust a model to police itself — and why the boundary has to sit outside it.