How It Works
A control layer between your team and the model
NeutralAI detects and neutralizes sensitive values on the way out, resolves them safely on the way back, and leaves an auditable record of every event — so people can keep using AI without their data leaving with the prompt.
The idea
A transparent shield, not a switch
Banning AI kills productivity and pushes usage underground. Instead, NeutralAI sits in the path like a sheet of glass: outgoing text passes through and its sensitive parts are neutralized; the returning answer is re-opened on the user’s side. Raw data never reaches the external model.
What the employee writes
“Draft a petition for our client Ahmet Yıldız (ID: 12345678901, [email protected]).”
What the model sees
“Draft a petition for our client [NAME] (ID: [ID_NUMBER], [EMAIL]).”
The external model never sees the real name, ID, or email — and the employee still gets a complete, meaningful answer. In a permitted scenario, the placeholders re-open to the real values on the user’s side.
The flow
Two directions, one boundary
Every prompt makes a round trip. NeutralAI neutralizes on the way out and resolves on the way back.
Outbound — request to the model
- 01
Detect
The outgoing text is scanned for personal and sensitive values — names, emails, phone numbers, IDs, IBANs, card numbers, and more.
- 02
Decide
A tenant-scoped policy decides what to do with each entity type: allow it, mask it, tokenize it reversibly, or block the request.
- 03
Neutralize
Real values are replaced with safe placeholders or reversible tokens before the prompt ever leaves the trusted path.
- 04
Forward
Only the neutralized prompt reaches the external model. The raw value never crosses the boundary.
Inbound — answer to the user
- 01
Stream back
The model answers token by token. Redaction is streaming-aware, so a value is resolved correctly even when it splits across two chunks.
- 02
Resolve
Within a short, governed window, tokens resolve to their real values on the user’s side — so the answer reads as a complete, useful reply.
- 03
Record
Every event is written to an audit trail as metadata about the decision — never the sensitive value itself.
Policy
Detection decides; policy acts
Finding an entity isn’t enough — what happens to it is rule-driven, per tenant, per entity type.
Allow
Low-risk values pass through untouched when policy permits — for example a generic city name.
Mask
The value is irreversibly neutralized to a placeholder like [NAME]. Safest, and not reversible.
Tokenize
A reversible, encrypted, time-limited mapping. The answer re-opens to the real value on the user’s side.
Block
For the highest-sensitivity cases, the request is stopped rather than allowed through. The fail-closed choice.
A policy simulation shows what would change in a given text — a “what would this rule do?” diff — before a rule goes live.
Retention
What’s stored, and what isn’t
The design invariant: raw sensitive data is only ever seen at the engine boundary, and it cannot be written to storage, logs, or telemetry. That rule is enforced in code, not just promised in a policy.
Detection
Not one model — a calibrated pipeline
Aggressive detection floods the workflow with noise; weak detection leaks. Accuracy comes from layering signals and tuning the gates between them.
Named-entity recognition
A base recognition pass covers people, emails, phones, locations, IBANs, card numbers, IPs, and country-specific IDs such as TR_ID and UK_NHS.
Pattern + checksum validation
Structural patterns catch formatting variants, and checksum maths on IBANs and ID numbers rules out random digit strings that only look sensitive.
Context gates
Numeric, phone, reference, and person context gates lower false positives, so detection stays sharp without drowning the workflow in noise.
Semantic match
A vector-similarity signal flags content that closely resembles sensitive data even when it doesn’t match a fixed pattern.
Multilingual, including Turkish
A dedicated Turkish-aware model corrects the name boundaries that English-only NER gets wrong — a half-redacted name is worse than a missed one.
Whitelist + per-entity thresholds
Manual and contextual allow-lists, plus a confidence threshold tuned per entity type, keep precision under your control.
Deployment
One engine, four ways to run it
The same detection and policy core, delivered wherever your isolation requirements need it to live.
SaaS (cloud)
The fastest path from pilot to production, with tenant-scoped isolation.
On-prem / VPC
Data never leaves your network. Egress is deny-by-default, installed via Docker or Helm.
Browser extension
Masking happens locally, at the employee’s point of use, with managed rollout and policy sync.
SDK (Python / Node)
Mask, unmask, and stream embedded directly inside your own product.
Honest limits
What it does not solve
- NeutralAI secures system-to-system data flow. If someone moves data by screenshot or manual copy-paste, that is a separate DLP concern.
- We don’t claim “zero risk” or “guaranteed compliance.” We reduce exposure measurably and produce evidence you can show.
- Reversible tokenization is a deliberate trade: it keeps answers useful, and the mapping is encrypted and short-lived rather than kept forever.
Go deeper
See it run, or read how it’s built
The engineering blog series breaks down the hard parts — streaming redaction, multilingual NER, the encrypted vault, the tamper-evident audit ledger — straight from the code.