Know what's
privileged before
it reaches the model
A regulatory-sensitivity classifier for AI applications. It reads text on-device, flags what must never leave, and tells your app where it's safe to send.
Watch it read a privileged memo.
Redaction bars fall over the sensitive spans, the sensitivity score settles, and a routing verdict comes back — all before a single character could leave the device. Hover any bar to see the entity behind it.
Per our conversation with outside counsel at Davis Polk regarding the SEC investigation, this memo is privileged and confidential.
The moment text leaves the device, the duty of confidentiality is already tested.
US v. Heppner (S.D.N.Y., Feb 2026) held that sending content to public AI tools waives attorney-client privilege. The same logic extends to HIPAA-PHI, SEC/FINRA material non-public information, and every regulated profession with a duty of confidentiality.
US professionals use AI tools every day.
of law firms have no written AI policy.
of therapists have entered patient data into public AI.
open-source tools answered "should this leave the device?" — until Shield.
A classifier, not an enforcer.
Microsoft Presidio detects general PII — names, SSNs, credit cards. It knows nothing about privilege markers, psychotherapy notes, or MNPI. Shield extends Presidio with 30 domain-specific recognizers and returns three things your app can act on. You keep the routing decision.
Entities + confidence
Every match, its category, character span, and a calibrated confidence — Presidio's 50+ PII types plus Shield's domain recognizers, deduplicated.
Score + sensitivity level
A profile-weighted 0–100 score mapped to NONE / LOW / MEDIUM / HIGH / CRITICAL. Weights are composable across profiles; the higher weight wins.
Routing suggestion
An advisory verdict — CLOUD_OK, REDACT_CLOUD, or LOCAL_ONLY. Privilege and MNPI always force LOCAL_ONLY; PHI is REDACT_CLOUD at minimum.
The same three lines, across three regulated worlds.
Pick a domain. Shield runs the same pipeline; the profile decides what counts as sensitive and how heavily it weighs. Hover any redaction bar to see the entity behind it.
Per our conversation with outside counsel at Davis Polk regarding the SEC investigation, this memo is privileged and confidential.
Everything sensitive, gated at the source.
Shield returned a CRITICAL sensitivity score of 94, so the advisory verdict is LOCAL_ONLY. Your app decides what to do with that — route local, redact, or send.
// Example inputs and outputs are illustrative of documented behaviour. Load multiple profiles at once for cross-domain matters.
Three layers. Two of them never touch the network.
Layers run in strict order and each can only refine what came before. Layer 3 is opt-in, localhost-only, and fires only when the score is genuinely ambiguous.
Regex + NER
The Presidio engine with 30 custom recognizers as first-class citizens. Overlapping spans are deduplicated by length, then confidence, then category priority.
● zero network callsContext-aware rules
Confidence boosting via co-occurrence — “privileged” near “counsel” inside a character window is stronger evidence than either alone. Entities are immutable.
● zero network callsLocal LLM
Localhost Ollama only — never a cloud API. Profile-tuned prompts, structured JSON output, retry with graceful fallback. Disabled by default; air-gapped-safe.
◆ localhost Ollama · never cloud| Score | Level | Routing suggestion |
|---|---|---|
| 0 | NONE | CLOUD_OK |
| 1–20 | LOW | CLOUD_OK |
| 21–50 | MEDIUM | REDACT_CLOUD |
| 51–80 | HIGH | REDACT_CLOUDLOCAL_ONLY |
| 81–100 | CRITICAL | LOCAL_ONLY |
// Any PRIVILEGE or MNPI entity forces LOCAL_ONLY regardless of score. PHI is REDACT_CLOUD at minimum.
Ten recognizers each. Composable by design.
A profile bundles recognizers, context rules, and scoring weights for one domain. Load one, or several — a firm handling healthcare litigation loads legal and therapy together.
Attorney-client privilege
Privilege markers, counsel communications, work-product doctrine, and litigation-sensitive content.
- PRIVILEGE_MARKER
- COUNSEL_COMMUNICATION
- WORK_PRODUCT
- SETTLEMENT_TERMS
- CASE_NUMBER
- LAW_FIRM_NAME
- LITIGATION_MARKER
- COURT_FILING
- BATES_NUMBER
- EXECUTIVE_NAME
HIPAA PHI & clinical risk
Protected health information, psychotherapy-note indicators, diagnosis codes, and clinical risk flags.
- PATIENT_NAME
- DATE_OF_BIRTH
- DIAGNOSIS_CODE
- CLINICAL_RISK_FLAG
- SESSION_MARKER
- INSURANCE_ID
- MEDICATION
- PROVIDER_NAME
- SSN
- PSYCHOTHERAPY_NOTE_MARKER
MNPI & deal terms
Material non-public information, M&A activity, deal terms, fund information, and insider markers.
- MNPI_MARKER
- MA_ACTIVITY
- DEAL_VALUE
- LEVERAGE_RATIO
- FUND_INFORMATION
- INSTITUTION_NAME
- FINANCIAL_TERMS
- DISTRIBUTION_RESTRICTION
- INSIDER_MARKER
- CARRY_TERMS
Where a sensitivity gate changes the workflow.
Representative deployment patterns for the three profiles. Each puts Shield in front of an AI step so privileged content is caught before it can be sent.
An internal chatbot that can't leak a memo
A note-taking assistant that keeps HIPAA posture
Deal chatter that stays inside the wall
Illustrative deployment patterns, not customer testimonials. Shield is a classifier — routing and enforcement are performed by the consuming application (e.g. ogentic-router).
From three lines to a deployed service.
Shield ships as a library, a CLI, an MCP server, and a FastAPI service — plus runnable examples for custom recognizers. Everything below is real API surface.
from ogentic_shield import Shield
shield = Shield(profiles=["shield-legal"])
result = shield.analyze(
"Per our conversation with outside counsel at Davis Polk "
"regarding the SEC investigation, this is privileged."
)
result.score # 94
result.sensitivity_level # CRITICAL
result.routing_suggestion # LOCAL_ONLY# analyze text with a Rich table
$ ogentic-shield analyze "privileged and confidential" \
--profiles shield-legal --output table
# pipe JSON into anything
$ cat memo.txt | ogentic-shield analyze --output json# per-item error containment, parallelized
results = shield.analyze_batch(documents)
# non-blocking, for a responsive UI
async for chunk in AsyncShield().analyze_stream(text):
render(chunk)# five async tools over the Model Context Protocol shield.analyze # classify one string shield.analyze_batch # classify many shield.redact # mask detected spans shield.unredact # restore from a token map shield.profiles # introspect what's loaded
# Railway-ready sensitivity endpoint
POST /analyze # {text, profiles} -> score, level, route
GET /health # readiness probe
GET / # service banner + endpointsclass GDPRRecognizer(PatternRecognizer):
"""Your domain, your recognizers."""
PATTERNS = [Pattern("eu_id", r"...", 0.9)]
# drop it into a profile and score alongside the built-ins
Shield(profiles=[my_profile]).analyze(text)Shield detects. The rest of the primitives compose around it.
Seven Apache-2.0 libraries that snap together into a privacy-first pipeline — and form the foundation for Sotto, OgenticAI's product for regulated professionals.
shield → router → audit · classify, then route, then log. Together they form a complete open-source stack for privilege-protected AI — the foundation for Sotto ↗.
Install it. Analyze in three lines.
Requires Python 3.10+ and a spaCy model for NER. No account, no key, no telemetry.