Back to Home

How It Works

A control layer between your team and the model

NeutralAI detects and neutralizes sensitive values on the way out, resolves them safely on the way back, and leaves an auditable record of control decisions — so teams can reduce identifiable data exposure in AI workflows.

The idea

A transparent shield, not a switch

Banning AI kills productivity and pushes usage underground. Instead, NeutralAI sits in the path like a sheet of glass: outgoing text passes through and detected sensitive parts are neutralized; the returning answer is re-opened through the configured restore path.

What the employee writes

“Draft a petition for our client Ahmet Yıldız (ID: 12345678901, [email protected]).”

What the model sees

“Draft a petition for our client [NAME] (ID: [ID_NUMBER], [EMAIL]).”

The external model receives placeholders for the detected name, ID, and email — and the employee still gets a complete, meaningful answer. In a permitted scenario, the placeholders re-open to the real values on the user’s side.

The flow

Two directions, one boundary

Every prompt makes a round trip. NeutralAI neutralizes on the way out and resolves on the way back.

Outbound — request to the model

  1. 01

    Detect

    The outgoing text is scanned for personal and sensitive values — names, emails, phone numbers, IDs, IBANs, card numbers, and more.

  2. 02

    Decide

    A tenant-scoped policy decides what to do with each entity type: allow it, mask it, tokenize it reversibly, or block the request.

  3. 03

    Neutralize

    Real values are replaced with safe placeholders or reversible tokens before the prompt ever leaves the trusted path.

  4. 04

    Forward

    The external model receives the permitted prompt with detected values replaced according to policy.

Inbound — answer to the user

  1. 01

    Stream back

    The model answers token by token. Redaction is streaming-aware, so a value is resolved correctly even when it splits across two chunks.

  2. 02

    Resolve

    Within a short, governed window, tokens resolve through the configured restore path so the answer can remain useful.

  3. 03

    Record

    Audit events record metadata about the decision rather than storing the sensitive value as the event payload.

Policy

Detection decides; policy acts

Finding an entity isn’t enough — what happens to it is rule-driven, per tenant, per entity type.

Allow

Low-risk values pass through untouched when policy permits — for example a generic city name.

Mask

The value is irreversibly neutralized to a placeholder like [NAME]. Safest, and not reversible.

Tokenize

A reversible, encrypted, time-limited mapping. The answer re-opens to the real value on the user’s side.

Block

For the highest-sensitivity cases, the request is stopped rather than allowed through. The fail-closed choice.

A policy simulation shows what would change in a given text — a “what would this rule do?” diff — before a rule goes live.

Retention

What’s stored, and what isn’t

The design goal: raw sensitive data is constrained to the masking path, while storage, logs, and telemetry should capture control metadata rather than sensitive values. Confirm the configured retention policy before production use.

Audit and compliance records describe the decision, not the data — so you can prove what happened without keeping the sensitive value around.
Raw promptPolicy-dependentProcessed for the masking request; storage depends on the configured deployment path.
Masked promptPolicy-dependentRetention depends on the configured workflow and model provider.
Token ↔ value mappingTemporaryEncrypted with AES-256-GCM and time-limited.
Audit recordStoredDecision metadata — not the sensitive value.
Compliance exportStoredWritten immutably for tamper-evident evidence.

Detection

Not one model — a calibrated pipeline

Aggressive detection floods the workflow with noise; weak detection leaks. Accuracy comes from layering signals and tuning the gates between them.

Named-entity recognition

A base recognition pass covers people, emails, phones, locations, IBANs, card numbers, IPs, and country-specific IDs such as TR_ID and UK_NHS.

Pattern + checksum validation

Structural patterns catch formatting variants, and checksum maths on IBANs and ID numbers rules out random digit strings that only look sensitive.

Context gates

Numeric, phone, reference, and person context gates lower false positives, so detection stays sharp without drowning the workflow in noise.

Semantic match

A vector-similarity signal flags content that closely resembles sensitive data even when it doesn’t match a fixed pattern.

Multilingual, including Turkish

A dedicated Turkish-aware model corrects the name boundaries that English-only NER gets wrong — a half-redacted name is worse than a missed one.

Whitelist + per-entity thresholds

Manual and contextual allow-lists, plus a confidence threshold tuned per entity type, keep precision under your control.

Deployment

One engine, four ways to run it

The same detection and policy core, delivered wherever your isolation requirements need it to live.

SaaS (cloud)

The fastest path from pilot to production, with tenant-scoped isolation.

On-prem / VPC

Private cloud and on-premises deployments are scoped with your team. Model routing, permitted egress, and installation requirements are agreed during deployment review.

Browser extension

Local mode masks supported inputs on the device. Remote mode sends inputs to the configured gateway for masking; coverage and policy behaviour depend on configuration.

SDK (Python / Node)

Mask, unmask, and stream embedded directly inside your own product.

Honest limits

What it does not solve

  • NeutralAI secures system-to-system data flow. If someone moves data by screenshot or manual copy-paste, that is a separate DLP concern.
  • We don’t claim “zero risk” or “guaranteed compliance.” We reduce exposure measurably and produce evidence you can show.
  • Reversible tokenization is a deliberate trade: it keeps answers useful, and the mapping is encrypted and short-lived rather than kept forever.

Go deeper

See it run, or read how it’s built

The engineering blog series breaks down the hard parts — streaming redaction, multilingual NER, the encrypted vault, the tamper-evident audit ledger — straight from the code.