How It Works
A control layer between your team and the model
NeutralAI detects and neutralizes sensitive values on the way out, resolves them safely on the way back, and leaves an auditable record of control decisions — so teams can reduce identifiable data exposure in AI workflows.
The idea
A transparent shield, not a switch
Banning AI kills productivity and pushes usage underground. Instead, NeutralAI sits in the path like a sheet of glass: outgoing text passes through and detected sensitive parts are neutralized; the returning answer is re-opened through the configured restore path.
What the employee writes
“Draft a petition for our client Ahmet Yıldız (ID: 12345678901, [email protected]).”
What the model sees
“Draft a petition for our client [NAME] (ID: [ID_NUMBER], [EMAIL]).”
The external model receives placeholders for the detected name, ID, and email — and the employee still gets a complete, meaningful answer. In a permitted scenario, the placeholders re-open to the real values on the user’s side.
The flow
Two directions, one boundary
Every prompt makes a round trip. NeutralAI neutralizes on the way out and resolves on the way back.
Outbound — request to the model
- 01
Detect
The outgoing text is scanned for personal and sensitive values — names, emails, phone numbers, IDs, IBANs, card numbers, and more.
- 02
Decide
A tenant-scoped policy decides what to do with each entity type: allow it, mask it, tokenize it reversibly, or block the request.
- 03
Neutralize
Real values are replaced with safe placeholders or reversible tokens before the prompt ever leaves the trusted path.
- 04
Forward
The external model receives the permitted prompt with detected values replaced according to policy.
Inbound — answer to the user
- 01
Stream back
The model answers token by token. Redaction is streaming-aware, so a value is resolved correctly even when it splits across two chunks.
- 02
Resolve
Within a short, governed window, tokens resolve through the configured restore path so the answer can remain useful.
- 03
Record
Audit events record metadata about the decision rather than storing the sensitive value as the event payload.
Policy
Detection decides; policy acts
Finding an entity isn’t enough — what happens to it is rule-driven, per tenant, per entity type.
Allow
Low-risk values pass through untouched when policy permits — for example a generic city name.
Mask
The value is irreversibly neutralized to a placeholder like [NAME]. Safest, and not reversible.
Tokenize
A reversible, encrypted, time-limited mapping. The answer re-opens to the real value on the user’s side.
Block
For the highest-sensitivity cases, the request is stopped rather than allowed through. The fail-closed choice.
A policy simulation shows what would change in a given text — a “what would this rule do?” diff — before a rule goes live.
Retention
What’s stored, and what isn’t
The design goal: raw sensitive data is constrained to the masking path, while storage, logs, and telemetry should capture control metadata rather than sensitive values. Confirm the configured retention policy before production use.
Detection
Not one model — a calibrated pipeline
Aggressive detection floods the workflow with noise; weak detection leaks. Accuracy comes from layering signals and tuning the gates between them.
Named-entity recognition
A base recognition pass covers people, emails, phones, locations, IBANs, card numbers, IPs, and country-specific IDs such as TR_ID and UK_NHS.
Pattern + checksum validation
Structural patterns catch formatting variants, and checksum maths on IBANs and ID numbers rules out random digit strings that only look sensitive.
Context gates
Numeric, phone, reference, and person context gates lower false positives, so detection stays sharp without drowning the workflow in noise.
Semantic match
A vector-similarity signal flags content that closely resembles sensitive data even when it doesn’t match a fixed pattern.
Multilingual, including Turkish
A dedicated Turkish-aware model corrects the name boundaries that English-only NER gets wrong — a half-redacted name is worse than a missed one.
Whitelist + per-entity thresholds
Manual and contextual allow-lists, plus a confidence threshold tuned per entity type, keep precision under your control.
Deployment
One engine, four ways to run it
The same detection and policy core, delivered wherever your isolation requirements need it to live.
SaaS (cloud)
The fastest path from pilot to production, with tenant-scoped isolation.
On-prem / VPC
Private cloud and on-premises deployments are scoped with your team. Model routing, permitted egress, and installation requirements are agreed during deployment review.
Browser extension
Local mode masks supported inputs on the device. Remote mode sends inputs to the configured gateway for masking; coverage and policy behaviour depend on configuration.
SDK (Python / Node)
Mask, unmask, and stream embedded directly inside your own product.
Honest limits
What it does not solve
- NeutralAI secures system-to-system data flow. If someone moves data by screenshot or manual copy-paste, that is a separate DLP concern.
- We don’t claim “zero risk” or “guaranteed compliance.” We reduce exposure measurably and produce evidence you can show.
- Reversible tokenization is a deliberate trade: it keeps answers useful, and the mapping is encrypted and short-lived rather than kept forever.
Go deeper
See it run, or read how it’s built
The engineering blog series breaks down the hard parts — streaming redaction, multilingual NER, the encrypted vault, the tamper-evident audit ledger — straight from the code.