Product · Developer Tools
Cryptonym
The Privacy Layer Between Your Application and Every LLM
- Built for
- Engineering & Compliance Teams
- Modules
- 8
- Stack
- 5
- Detection Engine
- Policy Engine
- Transform Actions
- Local Encrypted Vault
- Hash-Chained Audit Log
- Egress Verification
- Streaming Rehydration
- Coordination Service
- Rust
- Python
- Node
- WASM
- Apache-2.0
Cryptonym is a runtime privacy broker that detects, classifies and replaces sensitive data before a prompt leaves your process, then restores the original values in the response. The model does its job and never sees who the data belongs to. Two lines of code get you an eight-stage pipeline: intercept, detect, classify, decide, transform, store, verify egress, rehydrate. Nineteen entity classes are recognised, from names, emails and cards to Emirates ID, IBAN, SWIFT BIC, MRN, ICD10, JWT and private keys, and seven transform actions cover surrogate, token, format-preserving, generalise, keyed hash, drop and block. It runs in-process with no proxy to operate and no network call in the default path, backed by a locally encrypted vault with envelope keys, a hash-chained append-only audit log and a declarative versioned policy engine. Written in Rust with Python, Node and WASM bindings, Apache 2.0, pre-alpha with phase 1 in progress.
- Detect, transform and rehydrate PII around any LLM call in two lines
- 19 entity classes including Emirates ID, IBAN, SWIFT BIC, MRN, ICD10 and API keys
- 7 transform actions: surrogate, token, format-preserving, generalise, keyed hash, drop, block
- In-process by default, no proxy and no network call on the hot path
- Fail-closed egress verification: no plaintext in requests, logs, traces or metrics
- Local vault with envelope keys and per-record crypto-shred for erasure requests
- Sub-3ms median added latency per KiB, 0.98 direct identifier recall
- GDPR, UAE PDPL, DIFC DPL, PCI DSS 4.0, ISO 27701 and HIPAA policy packs