The Sentence Your Vendor Never Sees — a Local-Model Redaction Gateway in Front of Every Cloud AI Call

What you'll do

A data-minimizing AI gateway you own end to end: a written data-classification sheet that says which classes of your own records may cross a vendor boundary at all; a deterministic detector for structured identifiers and a local open model doing the unstructured screening entirely offline; a reversible placeholder map that never leaves your machine and a rehydration step that fails closed on any token it does not recognise; a single audited send function that writes every outbound payload to an append-only ledger before it goes; a canary-and-exact-match leak assertion that fails the run on any raw value in that ledger — no model grading a model; a hand-labelled corpus that gives you a measured miss rate you can say out loud, and a sensitivity ceiling derived from that number rather than from optimism; a fail-closed fallback for when the local screener or the cloud vendor is unavailable; defences against a document that tries to talk your screener out of screening it, including a deterministic sanity floor and an escalation tripwire; a written record of what your vendor's current terms actually say and the date you read them; a human re-identification review that measures whether the redacted text still gives the person away; and four drills you have actually run — a planted identifier the detector misses, the screener killed mid-run, a hallucinated placeholder coming back from the cloud, and an injected instruction in an inbound document.