Clean prompts. Caught early.
Saaf finds Aadhaar, PAN, GSTIN, UPI and 18 more Indian identifiers in your AI traffic, swaps them for tokens before they leave your network, and puts the real values back in the reply.
Mask on the way out. Restore on the way back.
Saaf sits between your users and any LLM, as a library, a gateway or a plugin. Real values stay in a short-lived vault on your side.
Detect
It cleans up hidden characters, lookalike letters and Indic digits, then checks every match with Verhoeff, Luhn and GSTIN maths.
Mask
Your policy decides whether to mask, block, warn or allow. Each value keeps the same token for the whole conversation.
Restore
Values come back even when the model changes case, drops brackets or streams the reply chunk by chunk.
Try it. Nothing leaves this tab.
This is the real Saaf engine, running in your browser.
Your text
What the model sees
Processed on your deviceModel reply, restored
Edit the reply to try messy tokensBuilt for how Indian data really looks.
Checksums, not guesses
Any 12 digits match an "Aadhaar regex". Saaf checks the maths, and the nearest label wins, so "Order ID 2345…" stays untouched.
Hinglish & Indic scripts
"mera adhaar", आधार, and digits in Devanagari, Bengali, Tamil, Telugu and five more scripts.
OCR repair
"2345 67B9 O124" from a scanned card is still an Aadhaar. The checksum confirms the repair before it counts.
Streaming-safe restore
Only the few characters that could start a token are held back. Everything else streams straight through.
Shadow mode
Watch what's really being sent for two weeks before you enforce anything. Types and counts only.
Signed audit & evidence
Hash-chained, signed records and an evidence pack (data flows, processors, retention) for your reviewers.
Measured in public.
IndicPII-Bench is our open benchmark. Its headline number is false alarms on look-alikes: order IDs, AWB, UTR and invoice numbers.
Detection F1 higher is better
False alarms per 1k tokens lower is better
*Synthetic corpus v0, 420 documents; restore round-trip 100%. This is a smoke test, not a claim. Comparisons with other tools will be published with every adapter and command. Reproduce it.
22 identifier types
Works where your teams already use AI.
Gateway
An OpenAI- and Anthropic-compatible proxy. Change one URL.
Python & TypeScript
Zero-dependency libraries for servers, browsers and notebooks.
LiteLLM
One guardrail covers your whole model fleet.
Open WebUI
A one-file filter with per-chat sessions.
LangChain & RAG
Mask documents before you embed them.
MCP & Claude Code
Tools for agents and a hook that blocks PII.
Browser extension beta
Warns before you paste PII into AI chats.
CLI & pre-commit
Keeps PII out of repositories and CI logs.
n8n soon
Mask a field before any AI step.
Three lines to start.
Install the library or point your SDK at the gateway. Policies are TOML files you review like any other code.
- Consistent tokens. The same value always gets the same token, so the model can reason across a conversation.
- Tool calls handled. Function arguments come back as valid JSON.
- Same results everywhere. Python and TypeScript pass one shared test suite.
# pip install saaf
from saaf import Saaf
saaf = Saaf()
masked = saaf.mask("PAN ABCPE1234F, call +91 98765 43210")
masked.text # 'PAN [PAN_1], call [PHONE_IN_1]'
reply = llm(masked.text)
saaf.restore(reply).text# pip install saaf-gateway && saaf-gateway
from openai import OpenAI
client = OpenAI(base_url="http://localhost:8787/v1")
# masked on the way out, restored on the way back,
# streaming included// npm i @safearly/saaf
import { Saaf } from "@safearly/saaf";
const saaf = new Saaf();
const s = saaf.streamRestorer();
for await (const chunk of stream) out.write(s.feed(chunk));
out.write(s.flush());[policy]
mode = "shadow" # observe first, enforce later
default_action = "mask"
[entities.SECRET]
action = "block"
[[rules]] # approved in-region endpoint
entities = ["PAN"]
destinations = ["*.in-region.example.com"]
action = "allow"Built so we never see your data.
Saaf runs on your infrastructure. Safearly never receives your prompts, replies or token mappings.
| Data | Where it lives | How long |
|---|---|---|
| Your prompt | Your own process, in memory | For the request |
| Token ↔ value vault | In memory by default; optionally SQLite or Redis, encrypted with AES-GCM | Session, or a TTL you set |
| What the LLM receives | Tokens such as [PAN_1] in place of values | The provider's terms |
| Audit records | Your log sink: types and counts only, signed and hash-chained | Your retention policy |
| Anything sent to Safearly | Nothing. No telemetry. | n/a |
Careful by default
Persistent vaults refuse to run without an encryption key. Destroying a key crypto-shreds its data. Values never appear in logs.
Verifiable releases
Signed packages and container images, an SBOM with every release, a public threat model, and an external review of the vault cryptography before enterprise availability.
Honest limits
Saaf can miss names without an honorific, free-text addresses, images and unlabelled numbers. Full list.
Saaf provides evidence and safeguards for your own DPDP work. It is not a compliance certificate, and we will never claim it is. Found a vulnerability? Email lalit@safearly.com (we acknowledge within 3 working days).
Free to start. Ready to scale.
Open source
Apache-2.0, forever.
- Libraries, CLI and gateway
- All plugins
- IndicPII-Bench
- Community support
Team
For teams putting AI on customer data.
- Console and policy editor
- Shadow-mode findings feed
- Audit viewer and evidence exports
- BFSI sector pack
Enterprise
For regulated organisations.
- SSO and RBAC
- KMS-backed vaults
- On-prem and air-gapped installs
- Health and HR packs, SLAs
Questions, answered.
Does our data leave our network?
No. Saaf runs as a library, a gateway or a plugin on your own infrastructure. Only tokens reach the model provider, and Safearly never receives your traffic.
Is Saaf "DPDP compliant"?
No tool can make you compliant on its own. Saaf reduces how much personal data reaches LLMs and produces evidence (policies, signed audit logs, an evidence pack) for your own DPDP programme. Have your counsel review how you use it.
How is it different from a regex?
It validates checksums (Verhoeff, Luhn, GSTIN), scores the surrounding words, repairs OCR errors and normalises Unicode. On look-alike numbers, a bare regex raised 236.95 false alarms per 1,000 tokens; Saaf raised 0.83.
Does it work with streaming responses?
Yes. Text streams through as it arrives; only the few characters that could start a token are held back. Tests check that any chunking gives the same result.
What doesn't it catch?
Names without an honorific, free-text addresses, images, and unlabelled generic numbers such as bank accounts or PIN codes. An Indic name-recognition model is on the roadmap.
What does this website collect?
Nothing. There are no cookies, no analytics and no third-party scripts. The demo runs entirely in your browser. If you email us, we use your address only to reply.
Start in shadow mode this week.
We're onboarding design partners in fintech, health, legal and BPO. Your pilot is free, with a weekly findings review. We only ever see types and counts.