NoPII

NoPII is a reverse proxy for LLM APIs that detects and tokenizes sensitive data before it leaves an application’s environment, then detokenizes the response on the way back. It is described as a PII protection layer for prompts sent to external AI providers, with examples that include names, SSNs, email addresses, and addresses.

Its request flow is presented in three steps. Incoming requests are scanned for PII and each value is replaced with a deterministic, format-preserving token before the request is forwarded. The sanitized payload is then sent to supported LLM providers using the caller’s own API key. When the model response returns, the proxy maps tokens back to the original values and returns the restored response to the application. The product also says it preserves entity relationships across messages, includes context phrase neutralization to prevent LLM safety refusals on tokenized data, keeps a full audit trail for every request, and blocks a request if the tokenization service is unreachable rather than sending PII through.

The site describes one-line integration by changing the base_url to https://api.nopii.co, with no SDK, middleware rewrite, or architecture changes. It states that the service works with OpenAI, Anthropic, Google, xAI, DeepSeek, Mistral, Groq, Together, and Fireworks, and that it supports native SSE streaming for OpenAI and Anthropic. The examples and use cases shown are healthcare, financial services, legal, customer support, and HR and people operations.

NoPII is offered as a managed service and is sign-up free. It is described as built by Enigma Vault, and the infrastructure is stated to be PCI Level 1 and SOC 2 Type II certified, with compliance references to HIPAA, GDPR, SOX, and PCI-DSS.