Open-source PII firewall for AI agents
Keep Nigerian customer identifiers out of your LLM prompts.
Aegis is an OpenAI-compatible proxy that runs inside your network. It swaps BVNs, NINs, account numbers, phone numbers, emails and names for Placeholders before a request reaches an external model, then puts the real values back in the reply. A Wire Tap shows exactly what left.
# What your agent sends to Aegis
- [pre-scrub text stays in your network]
# What the external model receives (Wire Tap)
+ Transfer ₦50,000 to [[PERSON_1]], BVN [[BVN_1]], phone [[PHONE_1]]
# What your agent gets back
+ Transfer initiated to Chinedu Okafor.Transfer to [[PERSON_1]]
[[BVN_1]] · [[PHONE_1]]
entities
03
status
ok
Wire Tap
ready
No Session Map contents.
NDPA 2023 and GAID 2025
How it works
Scrub, locally.
Rules detect phones, BVN/NIN-format numbers, account numbers (with context) and emails. A name gazetteer and a small local model detect person names. Nothing is sent anywhere for detection.
Remember, briefly.
The mapping from placeholder to real value lives in Redis only, with snapshots and append-only logging disabled and a sliding expiry (default 300 s). Same person, same placeholder, across a conversation.
Reinject.
Placeholders in the reply, including inside tool-call arguments, are swapped back before your app sees them. If state is lost, Aegis returns placeholders rather than guessing.
Agent
│ request with identifiers
▼
Aegis
├─ Scrubber → Placeholders
├─ Session Map → Redis, short expiry
└─ Wire Tap → post-scrub evidence
▼
Upstream
│ reply with Placeholders
▼
Reinjector → Agent
One-line integration
Works with the official OpenAI SDK and Anthropic SDK, including streaming and tool calls.
from openai import OpenAI
client = OpenAI(
base_url="http://aegis.internal:8000/v1", # was https://api.openai.com/v1
api_key=os.environ["OPENAI_API_KEY"],
)Evidence (measured, with hardware and date)
| Measure | Result | Source |
|---|---|---|
| Rule layer overhead (60 words) | p50 0.18 ms, p95 0.68 ms | bench_scrub.py |
| Model layer overhead (60 words, 4-core CPU) | p50 429 ms, p95 1271 ms | bench_scrub.py |
| Leak test | 0 leaks / 35 planted entities across 12 prompts | test_no_leak.py |
| Per-type recall and precision (held-out set) | PERSON: 96.9% recall, 61.9% precision | eval_recall.py |
Numbers are from our own sets on the stated hardware. Deliberate evasion (leetspeak, spelled-out digits) is a known limitation. Read the methodology.
Evidence for the people who sign off.
Deploy where your data lives
Runs in your VPC or on-prem. No telemetry leaves your network.
What Aegis does not do