01 · mask
Reversible obfuscation
xfilguard reads what is about to leave, substitutes sensitive values with monospace tokens, and holds the originals in an audit record readable only by the data owner.
Quiet enough to be trusted.
xfilguard reads what is about to leave, quietly masks what must not (names, numbers, clauses, code) and restores the original for the people who should see it, nobody else.
Please summarize the contract between Acme Corp and Globex Ltd. for FY2025, and flag any clause that may conflict with Project Halcyon.
Six plain facts. No adjectives load-bearing. The same discipline applies to every file, every language, every model.
01 · mask
xfilguard reads what is about to leave, substitutes sensitive values with monospace tokens, and holds the originals in an audit record readable only by the data owner.
02 · trade secrets
Proprietary formulas, codenames, pricing tables, and unreleased strategy read as clearly to the system as SSNs do. If it shouldn't leave the building, it doesn't.
03 · 60+ languages
Multilingual documents, code-switching, regional variants. A value is recognized regardless of which script it is written in, and restored in the same script on return.
04 · every format
Messy, real-world inputs: OCR artifacts, handwritten forms, ASR transcripts. Format is a detail, not a constraint.
05 · synthetic
When a value must be replaced rather than hidden, xfilguard can produce a plausible stand-in that preserves statistical shape without leaking the source.
No queue. No approval. The request goes through; the secrets do not.
step 01
xfilguard intercepts the outbound request and reads it the way a notary reads a document, patiently, character by character, looking for what should not leave.
step 02
Sensitive values collapse into tokens. <person_01>. <org_02>. <year_01>. The structure of the request is preserved; only the contents are substituted.
step 03
When the model responds, xfilguard puts the originals back for the right reader. The envelope opens, for the right reader. Nothing is lost.
We borrow from DLP, PII detection, synthetic data, confidential computing, and prompt security. The through-line is ours: reversible obfuscation at the edge of the model.
we are
we are not
Every mask leaves an audit record. Timestamp, policy, model, entity type, verb, retention window, readable only by the data owner. The list below is what we attest to, and the regions each statement applies in. Attestation dates and auditor details are available on request.
The things people ask before they ask for a demo. No adjectives load-bearing.
xfilguard is a privacy layer that sits between your organization and the AI models it uses. It reads every outbound request, replaces sensitive values with reversible tokens before the request reaches the model, and restores the originals in the response for the people entitled to see them. The model does its work; the sensitive data never leaves.
Reversible obfuscation is the substitution of a sensitive value with a placeholder token that can later be exchanged back for the original. Where redaction destroys information and anonymization discards the link to the source, reversible obfuscation keeps that link in an audit record readable only by the data owner. The prompt loses the secret; the answer does not lose its meaning.
xfilguard is model-agnostic and intercepts the request before it reaches any provider. Names, national identifiers, account numbers, contract clauses, source code, and internal codenames collapse into tokens such as <person_01> or <org_02>; the provider receives a structurally intact prompt with no recoverable personal or proprietary data in it. When the response returns, the tokens are exchanged back. Switching model vendors changes nothing about the policy.
xfilguard borrows from data loss prevention but does not behave like it. Classic DLP blocks the request and files an alert, which is why people route around it. xfilguard lets the request through with the sensitive values removed, so there is no queue, no approval step, and no incentive to paste work into a personal account instead. It is a translator, not a gate.
xfilguard detects classic personal data (names, addresses, national identifiers such as SSNs, email addresses, phone numbers, payment card numbers, and health information) alongside commercial secrets that most PII tools ignore: proprietary formulas, project codenames, unreleased pricing, internal strategy, and source code. Anything ambiguous is flagged for review rather than silently passed.
xfilguard supports compliance with GDPR, HIPAA, CCPA/CPRA, SOC 2 Type II, PCI-DSS, and Japan's APPI. Every mask leaves an audit record (timestamp, policy, model, entity type, verb, and retention window) readable only by the data owner, which is what turns a technical control into evidence during an audit. Attestation dates and auditor details are available on request.
xfilguard works across more than 60 languages, including multilingual documents, code-switching, and regional variants; a value is recognized regardless of the script it is written in and restored in the same script on return. Supported formats include plain text, DOCX, PDF, CSV, and audio, including messy real-world inputs such as OCR artifacts, handwritten forms, and ASR transcripts.
Redaction and anonymization are one-way: once a value is blacked out or generalized, the answer that comes back refers to nothing you can act on. xfilguard's substitution is reversible, so a summary of a masked contract still names the right counterparty when it reaches the person allowed to read it. Where a value must be replaced rather than hidden, xfilguard can generate a synthetic stand-in that preserves statistical shape without leaking the source.
The originals are held in an audit record readable only by the data owner, governed by a retention window you set in policy. xfilguard is the layer that holds the mapping, not a party to it: the record exists so that masks can be reversed and audits can be answered, and for no other purpose.
We are the quiet layer between your work and the model. Book a demo and we’ll walk through your workflow, your policy, and what the audit record looks like on the other side.