Palisade is a bidirectional PII firewall for cloud LLM agents. The model you rent works only in placeholder-space. Names, cards, and keys stay on your machine. Tool calls still work. When something asks for more than it should, it hears no.
Every prompt your agent sends today hands a vendor data you cannot take back. One breach, one subpoena, one retention policy you never read.
403unregistered destination, blocked at the gate. the model only ever saw [SSN_1].
200[EMAIL_1] rehydrated to j@osei.io after the gate, on your machine.
newthe response minted a fresh id. re-redacted to [MSG_1] before the model ever read it.
Redaction is the easy half. The round trip is where every other filter breaks.
A one-way filter kills the agent. The model plans with placeholders, but the real API needs real values. Here is one booking, end to end.
You type the real thing. Palisade catches the sensitive parts before one byte leaves your machine.
Book the flight for June Osei, card ending 4242.
The cloud model gets placeholders. It plans the whole booking and never learns who you are.
Book the flight for [NAME_1], card [CARD_1].
The model calls the airline API. Palisade checks that destination against your policy, then fills the real values back in locally.
book_flight allowed, card injected from the vault
The confirmation comes back carrying new personal data. Palisade catches that too. The cloud sees a tag. You see the real thing.
X4JQ2Z becomes [PNR_1] before the cloud reads it
you wrote
“Book the flight for June Osei, DOB 03/14/1989, home zip 06902.”
the model saw
“Book the flight for [NAME_1], [DOB_1 ~ mid-30s], home [ZIP_1 ~ Fairfield County, CT].”
Generalized tags keep a coarse but truthful value. The model still reasons with an age bracket or a county. The exact value stays home. When a tool call names a tag, Palisade fills in the real value locally, and only if your policy names the destination.
Palisade runs as a localhost gateway that speaks the Anthropic and OpenAI protocols. Claude Code, Codex CLI, aider, or anything with a base URL sits behind it unchanged. You change one environment variable, not one line of code. An MCP proxy extends the same fence to claude.ai and ChatGPT connectors. Credentials live in an encrypted vault, and Palisade injects them at call time. The cloud model asks for tools abstractly and touches nothing. Memory lasts one session by default, persists encrypted if you want it, and one command wipes it all.
under 10ms detection97%+ recall0 raw values upstream~15MB model