The public-AI wave hit a policy wall this month. Nvidia and Palantir both curbed staff use of consumer AI chat after a run of data-leak incidents, and their internal memos read like a template of what most companies are quietly reviewing: the risk isn’t the model, it’s what employees paste into the prompt. The seven apps below sit between the human and the chat window, and scrub the sensitive parts before anything leaves the desk. All run on Windows, macOS, or Linux, and most work locally so nothing extra crosses the network.
We ran each tool against the same eight test documents: a customer support conversation with credit cards inline, an HR review with names and salaries, a source-code snippet holding an AWS key, a health record with a diagnosis, a legal contract with counterparty names, a support ticket with the customer’s home address, a marketing brief with an unannounced product name, and a payroll CSV.
What to look for in an AI-redaction tool
- Local by default. If the redaction step calls out to a third party, you’ve moved the leak, not fixed it.
- Recall over precision. A missed PII item is far worse than an over-redacted paragraph.
- Reversible transforms. Sometimes you want tokens the AI can reason about without exposing the underlying value; the tool should support format-preserving redaction, not only blanket masking.
- Extensible detectors. Every company has a private taxonomy (project codenames, internal ticket IDs). A rule engine that lets you extend detection matters.
- Integrates as a keyboard step, not a portal you have to log into.
- Clear logging for compliance, without storing the sensitive text itself.
Quick comparison
| App | Best for | Free plan | Starting price | License |
|---|---|---|---|---|
| Fides | Team-wide policy + open-source PII detection | Fully free | Free (self-hosted) | Apache 2.0 |
| Microsoft Presidio | Local Python-based PII detection | Fully free | Free | MIT |
| Cloak | Browser-side redaction before ChatGPT/Claude | Free tier | Around 12 USD/mo Pro | Closed source |
| Nightfall AI | Managed DLP with AI-native categories | Free trial | Custom pricing | Closed source |
| TruffleHog | Finds secrets and API keys before they leak | Fully free | Free | GPL-3.0 |
| Skyflow | Data vault with tokenization | Free tier | Contact sales | Closed source |
| Private AI | On-device redaction API | Free trial | Contact sales | Closed source |
1. Fides, best team-wide policy plus open-source PII detection
Fides is Ethyca’s open-source privacy platform. It ships a scanning engine that finds personal data in structured and unstructured input, a redaction step that transforms it, and a policy layer that describes who can see what. Deploy it on the same LAN as the users who talk to AI tools, wire it to the browser as an extension or a proxy, and every prompt gets pre-scrubbed to the team’s policy.
Where it falls short: the setup is heavier than a desktop app. Fides is a system, not a shortcut.
Pricing: free and open source. Ethyca’s hosted tier exists for teams that don’t want to self-host.
Platforms: Windows, macOS, Linux (Docker or Python).
Download: Fides on GitHub · Ethyca
Bottom line. The right pick for a team that wants one policy across every AI touchpoint.
2. Microsoft Presidio, best local Python-based PII detection
Presidio is Microsoft’s open-source PII detection and anonymization library. It ships language models tuned to recognize names, addresses, national IDs, financial data, health codes, and custom entities, and lets you replace, hash, or format-preserve each hit. Because it runs entirely on your machine, nothing about the sensitive text ever leaves the process.
Where it falls short: it’s a library, not an app. Using it well requires a small script or plugin. False positives on names in technical documentation are common.
Pricing: free, MIT license.
Platforms: Windows, macOS, Linux (Python 3.9+).
Download: Presidio on GitHub · Documentation
Bottom line. The engine most other redaction tools eventually copy features from.
3. Cloak, best drop-in browser redaction
Cloak installs as a browser extension and rewrites your prompt on the fly before it hits ChatGPT, Claude, Gemini, and a few other frontends. It replaces names, emails, phone numbers, credit-card numbers, and API keys with reversible placeholders, then swaps the responses back so the reply reads naturally.
Where it falls short: browser-side hooks can break when a chat frontend restyles its input. The free tier caps redactions per month.
Pricing: free tier for occasional users; Pro runs around 12 USD per month.
Platforms: Chrome and Firefox on Windows, macOS, and Linux.
Download: Cloak official
Bottom line. The lowest-friction option for individuals who want private-by-default AI chat without changing their workflow.
4. Nightfall AI, best managed DLP for AI-native categories
Nightfall AI is a data-loss-prevention product built for the AI era. Its detectors are trained on the categories that actually cause AI incidents: prompt-injected secrets, API keys pasted mid-conversation, customer records buried in support threads. It integrates with major AI chat frontends and with Slack, Zendesk, and email as sidecars.
Where it falls short: it is a managed service. Data has to pass through Nightfall’s cloud for detection, which some regulated teams cannot allow.
Pricing: free trial; production pricing is custom.
Platforms: SaaS control plane; agents on Windows, macOS, and Linux.
Download: Nightfall AI
Bottom line. The right pick for security teams that want a turnkey answer rather than a build.
5. TruffleHog, best for finding secrets and API keys before they leak
TruffleHog is the open-source scanner most engineers meet in a CI pipeline, but the desktop version does the same thing to any folder or paste: it finds credentials, cloud keys, private keys, and access tokens with verified detectors that also confirm whether the key is live. Running it against a clipboard before pasting into an AI chat catches the class of leak that hurts most.
Where it falls short: it doesn’t understand names or addresses. It is a secrets scanner, not a general PII tool.
Pricing: free, GPL-3.0 open source. Truffle Security offers a paid hosted tier.
Platforms: Windows, macOS, Linux (Go binary).
Download: TruffleHog on GitHub · Truffle Security
Bottom line. Pair it with Presidio or Fides for a full-coverage sweep.
6. Skyflow, best data vault with tokenization
Skyflow is a data vault that stores sensitive values and hands back tokens that look like the original but reveal nothing. Point your AI workflow at the tokens, keep the real data in the vault, and detokenize only when a downstream system needs the underlying value. That pattern is how most banks and healthcare firms think about AI adoption.
Where it falls short: the vault pattern demands re-architecting how a team thinks about data flow. It is not a one-week rollout.
Pricing: free tier; production pricing is custom.
Platforms: SaaS. SDKs for Windows, macOS, and Linux clients.
Download: Skyflow
Bottom line. The correct pick when the same data will feed AI, analytics, and application code.
7. Private AI, best on-device redaction API
Private AI ships a container that runs on your machine and exposes a REST endpoint for PII detection and redaction across 50-plus languages. It plugs into any workflow: browser extension, Slack bot, email gateway, or an internal chat frontend that adds a “scrub” button. Because the container is local, no plaintext ever leaves the host.
Where it falls short: it is a paid product past the free trial. The container needs a modern CPU and enough RAM to keep the models resident.
Pricing: free trial; production pricing is custom.
Platforms: Docker on Windows, macOS, and Linux.
Download: Private AI
Bottom line. The right pick for a team that wants a local API to bolt into existing tools.
How to pick the right one
- For an individual who wants private-by-default AI chat: Cloak.
- For a solo engineer who wants zero-cost coverage: Presidio plus TruffleHog.
- For a small team that wants one policy across every chat frontend: Fides.
- For a large security-led rollout: Nightfall AI or Private AI.
- For companies that will feed the same data to AI and other systems: Skyflow’s vault pattern is worth the redesign.
FAQ
What is the difference between redaction and tokenization? Redaction removes or masks the sensitive value; the AI never sees anything at all. Tokenization replaces the value with a stable placeholder the AI can reason about, and detokenizes on the way back.
Can I use these with Claude and ChatGPT? Yes. Cloak is browser-side and works with both. Fides, Presidio, and Private AI wrap the request server-side.
Do these stop prompt injection? Redaction reduces what an attacker can steal even if a prompt is injected. It is not a full prompt-injection defence on its own.
Are open-source tools accurate enough? For most PII categories, yes. Names in technical text and non-English content are the weakest spots for open-source detectors; managed services still lead there.
Do any of them work offline? Fides, Presidio, TruffleHog, and Private AI all run locally without an internet connection.
