Back to Home

How It Works

A control layer between your team and the model

NeutralAI detects and neutralizes sensitive values on the way out, resolves them safely on the way back, and leaves an auditable record of every event — so people can keep using AI without their data leaving with the prompt.

The idea

A transparent shield, not a switch

Banning AI kills productivity and pushes usage underground. Instead, NeutralAI sits in the path like a sheet of glass: outgoing text passes through and its sensitive parts are neutralized; the returning answer is re-opened on the user’s side. Raw data never reaches the external model.

What the employee writes

“Draft a petition for our client Ahmet Yıldız (ID: 12345678901, [email protected]).”

What the model sees

“Draft a petition for our client [NAME] (ID: [ID_NUMBER], [EMAIL]).”

The external model never sees the real name, ID, or email — and the employee still gets a complete, meaningful answer. In a permitted scenario, the placeholders re-open to the real values on the user’s side.

The flow

Two directions, one boundary

Every prompt makes a round trip. NeutralAI neutralizes on the way out and resolves on the way back.

Outbound — request to the model

  1. 01

    Detect

    The outgoing text is scanned for personal and sensitive values — names, emails, phone numbers, IDs, IBANs, card numbers, and more.

  2. 02

    Decide

    A tenant-scoped policy decides what to do with each entity type: allow it, mask it, tokenize it reversibly, or block the request.

  3. 03

    Neutralize

    Real values are replaced with safe placeholders or reversible tokens before the prompt ever leaves the trusted path.

  4. 04

    Forward

    Only the neutralized prompt reaches the external model. The raw value never crosses the boundary.

Inbound — answer to the user

  1. 01

    Stream back

    The model answers token by token. Redaction is streaming-aware, so a value is resolved correctly even when it splits across two chunks.

  2. 02

    Resolve

    Within a short, governed window, tokens resolve to their real values on the user’s side — so the answer reads as a complete, useful reply.

  3. 03

    Record

    Every event is written to an audit trail as metadata about the decision — never the sensitive value itself.

Policy

Detection decides; policy acts

Finding an entity isn’t enough — what happens to it is rule-driven, per tenant, per entity type.

Allow

Low-risk values pass through untouched when policy permits — for example a generic city name.

Mask

The value is irreversibly neutralized to a placeholder like [NAME]. Safest, and not reversible.

Tokenize

A reversible, encrypted, time-limited mapping. The answer re-opens to the real value on the user’s side.

Block

For the highest-sensitivity cases, the request is stopped rather than allowed through. The fail-closed choice.

A policy simulation shows what would change in a given text — a “what would this rule do?” diff — before a rule goes live.

Retention

What’s stored, and what isn’t

The design invariant: raw sensitive data is only ever seen at the engine boundary, and it cannot be written to storage, logs, or telemetry. That rule is enforced in code, not just promised in a policy.

Audit and compliance records describe the decision, not the data — so you can prove what happened without keeping the sensitive value around.
Raw promptNot storedProcessed in memory, never persisted.
Masked promptNot storedExists only while the response streams.
Token ↔ value mappingTemporaryEncrypted with AES-256-GCM and time-limited.
Audit recordStoredDecision metadata — not the sensitive value.
Compliance exportStoredWritten immutably for tamper-evident evidence.

Detection

Not one model — a calibrated pipeline

Aggressive detection floods the workflow with noise; weak detection leaks. Accuracy comes from layering signals and tuning the gates between them.

Named-entity recognition

A base recognition pass covers people, emails, phones, locations, IBANs, card numbers, IPs, and country-specific IDs such as TR_ID and UK_NHS.

Pattern + checksum validation

Structural patterns catch formatting variants, and checksum maths on IBANs and ID numbers rules out random digit strings that only look sensitive.

Context gates

Numeric, phone, reference, and person context gates lower false positives, so detection stays sharp without drowning the workflow in noise.

Semantic match

A vector-similarity signal flags content that closely resembles sensitive data even when it doesn’t match a fixed pattern.

Multilingual, including Turkish

A dedicated Turkish-aware model corrects the name boundaries that English-only NER gets wrong — a half-redacted name is worse than a missed one.

Whitelist + per-entity thresholds

Manual and contextual allow-lists, plus a confidence threshold tuned per entity type, keep precision under your control.

Deployment

One engine, four ways to run it

The same detection and policy core, delivered wherever your isolation requirements need it to live.

SaaS (cloud)

The fastest path from pilot to production, with tenant-scoped isolation.

On-prem / VPC

Data never leaves your network. Egress is deny-by-default, installed via Docker or Helm.

Browser extension

Masking happens locally, at the employee’s point of use, with managed rollout and policy sync.

SDK (Python / Node)

Mask, unmask, and stream embedded directly inside your own product.

Honest limits

What it does not solve

  • NeutralAI secures system-to-system data flow. If someone moves data by screenshot or manual copy-paste, that is a separate DLP concern.
  • We don’t claim “zero risk” or “guaranteed compliance.” We reduce exposure measurably and produce evidence you can show.
  • Reversible tokenization is a deliberate trade: it keeps answers useful, and the mapping is encrypted and short-lived rather than kept forever.

Go deeper

See it run, or read how it’s built

The engineering blog series breaks down the hard parts — streaming redaction, multilingual NER, the encrypted vault, the tamper-evident audit ledger — straight from the code.