# Buff Guardrails > A gateway to AI models that strips personal data and secrets from requests and restores them in the answer. Open source, entirely inside your perimeter. Buff Guardrails # The model does not need your customer’s passport *to write them a reply* A gateway between your people and the AI model: it strips personal data and secrets from requests and restores them in the answer. An employee works in Claude Code, Claude Desktop or any other client as usual, the model sees anonymised text, and the data never leaves the company. [Download from GitHub](https://github.com/buffsystems/buff-guardrails) [See an example](https://buff.systems/en/guardrails#example) Open source, MIT licence. Runs on your machines, no GPU needed **0** requests go to outside providers: the model is yours, on your network **10 ms** for the rules to check a request: documents, cards, phones, keys **100 of 100** SNILS, KPP, INN and e-mail addresses are found and masked **3 commands** to a working gateway and demo on your machine Objection 01 ## “AI is banned here because of personal data” Or allowed — and everyone decides for themselves what to paste into the chat. ### The model does not need the real data People take a customer’s letter, a CRM export, a log with a password in the stack trace to the model. A ban does not work — the work moves to a personal ChatGPT. A blocking filter does not work either — it is the same ban, with irritation added. Guardrails starts from a simple observation: to write a customer a reply, the model only needs to know that a name stands here and a phone number there. So the gateway blocks nothing: it replaces the data with numbered placeholders, hands the text to the model and puts the real values back into the answer. #### What the operator pasted Hello! My name is Marina Ilyinichna Konovalova, order no. 4471920 has never arrived. My phone is +7 (921) 334-18-07, e-mail marina.konovalova@example.com, delivery address: Kazan, Chistopolskaya St., 61, apt. 14. #### What the model received Hello! My name is , order no. 4471920 has never arrived. My phone is , e-mail , delivery address: , St., 61, apt. 14. #### What the operator got back Hello, Marina Ilyinichna Konovalova! Thank you for contacting us. We are very sorry that order no. 4471920 has never arrived. Please confirm your delivery address: Kazan, Chistopolskaya St., 61, apt. 14. This is a real run through the small gemma3:4b model on a CPU. The same person in the letter is the same placeholder, so the model reasons about them consistently and restoring is unambiguous. The house number did reach the model: the basic recogniser sees names, not numbers — the accurate model covers those too, more below. Objection 02 ## “What exactly does it find? Regexes catch phone numbers — and then what?” Declined names, addresses and document numbers without a label are where such tools usually fail. ### Documents by rules with checksums, names and addresses by a model A neural network does not know the SNILS checksum algorithm and may take an order number for an INN. A rule knows: the checksum adds up — it is an INN, it does not — it is not. So documents, cards, phones, e-mail addresses, keys and passwords are found by rules in ten milliseconds. Names and addresses cannot be described by rules — a recognition model finds them, and you pick it at install time: the fast spaCy or the accurate ruBERT. When the model and a rule disagree, the rule wins. #### Russian documents Passport, SNILS, INN, OGRN and OGRNIP, KPP, OMS, driving licence — by shape and checksum. #### Payments Visa, Mastercard and Mir card numbers by the Luhn algorithm, CVC, accounts, BIC, IBAN. #### Contacts Russian, international and NANP phone numbers, e-mail addresses, IP addresses, URLs, dates of birth. #### Secrets AWS, GitHub, GitLab, OpenAI, Anthropic, Slack, Stripe and Telegram keys, JWTs, PEM private keys, passwords in URLs and assignments. #### Names and addresses Names in any grammatical case, cities, streets and houses — a recognition model, fast or accurate, your choice. #### Your own words Customer names, project code names, contract numbers and internal domains — from your dictionary. **100** of 100 SNILS, KPP, INN and e-mail addresses it finds and masks **96** of 100 phone numbers — in any spelling, with or without the country code **90** of 100 passports — it misses a series and number with no word “passport” nearby **86** of 100 keys and passwords — hex strings with no word “token” nearby are left alone, so that every commit hash is not hidden [Full benchmark tables — on GitHub](https://github.com/buffsystems/buff-guardrails/blob/main/bench/results/RESULTS.md) Objection 03 ## “How do we make sure it works on our texts?” Not on examples from a slide deck, but on your own letter and your own log. ### Demo: paste a text and see what would reach the model A demo page is installed with the gateway: paste any text, see the masked version and the list of what was found with its types, switch between eight ready-made sets — support, HR, banking, code, logs, a contract, corporate data — and, with a model configured, run the text through it and get an answer with the data restored. **Buff Guardrails demo** localhost:8080 ← scroll the frame → **A customer’s letter after masking**: name, phone, e-mail and city are replaced with placeholders; below, the list of what was found with types and confidence. Objection 04 ## “How long does it take to roll out?” Usually a project like this is a quarter with an integrator. ### Three commands and three questions The install script asks which model to use — run one on this machine, point at yours or do without one for now — how thoroughly to look for names and addresses, and which ports to open the gateway and the demo on. Then it downloads and starts everything itself and checks its own work: masks a test letter, passes it through the gateway and makes sure everything came back restored. ``` git clone https://github.com/buffsystems/buff-guardrails.git cd buff-guardrails ./install.sh ``` #### Docker Linux, macOS or Windows with Docker Desktop. No GPU needed: the rules and the basic recognition model run on the CPU. #### Memory 8 GB for the gateway and the demo. If the model runs on the same machine — 16 GB or more. #### Model Ollama is bundled, vLLM for a machine with an NVIDIA GPU, or the address of a model the company already has. You can start without a model too — masking and the demo only. The gateway speaks the Anthropic and OpenAI APIs. Claude Code needs three environment variables: ``` export ANTHROPIC_BASE_URL=http://localhost:4000 export ANTHROPIC_AUTH_TOKEN=sk-... export ANTHROPIC_MODEL=default ``` Claude Desktop and Cowork, Buff Code and any SDK connect the same way — step by step for Windows, macOS and Linux, with settings export for handing out to employees: [docs/clients.md](https://github.com/buffsystems/buff-guardrails/blob/main/docs/clients.md) Objection 05 ## “What if it misses something?” An honest answer matters more than a pretty number. ### What the gateway does, and what it does not The weak spot of the basic option is addresses: spaCy sees street and city names in Russian, but not house numbers. On real chats it finds 60 names and 51 addresses out of a hundred, the accurate ruBERT model — 92 and 98, at 150 milliseconds per request instead of 11. If your people work with customer requests, choose ruBERT — it is one item in the installer. - It does not block requests and keeps no incident register: it is not a DLP but a layer between the employee and the model that makes everyday work safe. - It does not replace the legal basis for processing: it removes the transfer of data to a third party, the rest is your policies. - It does not promise a hundred percent: the numbers are measured on open datasets and reproduced with make bench in the repository. - Open source under the MIT licence: what exactly is masked and how can be checked rather than taken on trust. [How Buff’s own security works](https://buff.systems/en/security) Other questions ## What people ask about Buff Guardrails ### Is this yet another proxy our data will go through? No. The gateway is installed on your machine and makes no outside calls: the recognition models are downloaded on first start and work offline afterwards. An external model address appears only if you enter one yourself. ### Which models can we use? Any with an OpenAI-compatible API. Ollama is bundled — gemma3 on a CPU, for example — and vLLM for a machine with an NVIDIA GPU; you can also point at a model already running in the company. ### What about English texts and mixed logs? The engine understands Russian and English, so English fragments inside a Russian letter or log are handled. We measured quality on Russian data — that is what the kit is built for. ### Can we add our own words — customer and project names? Yes. A corporate dictionary in YAML: customer names, project code names, contract numbers and internal domains are masked like everything else and restored in the answer the same way. ### Is this part of Buff or a separate product? A separate open-source kit; it does not need Buff. It works with any client that talks to the OpenAI or Anthropic API: Claude Code, Claude Desktop and Cowork, Buff Code, your own scripts. ### Where can I ask a question or report a bug? In the issues of the buff-guardrails repository on GitHub. Contractual support comes with Enterprise. Where to start ## Install the gateway and paste your own letter into the demo You need Docker and 8 GB of memory. A few minutes after ./install.sh you have a gateway address for Claude Code and a demo that shows what would reach the model. [Download from GitHub](https://github.com/buffsystems/buff-guardrails) [Write to us](mailto:info@buff.systems) Open source, MIT licence. Questions and bugs — in the repository on GitHub