TokenShield⢠Enterprise AI Privacy WAF & Surrogate Vault
TokenShield provides mathematical and cryptographic guarantees that sensitive dataâcredentials, GitHub PATs, API keys, private keys, financial records, and PIIânever leaves your sovereign perimeter in plaintext when interacting with cloud or local AI models.
A closer look
TokenShield⢠(:8443) is nTrust.aiâs enterprise AI Privacy & Security Web Application Firewall (WAF) and cryptographic token vault. Designed for LLM applications, coding assistants, and autonomous multi-agent pipelines, TokenShield sits directly between your applications and AI providers, inspecting and transforming prompts in microseconds.
Traditional redaction tools break model comprehension by replacing words with ugly placeholders like [REDACTED]. TokenShield introduces a 3-Stage WAF Adoption Pipeline (Observe → Dual/Split Smart Protect → Enforce) and Context-Preserving Synthetic Surrogatesâswapping sensitive entities with realistic, type-preserving fictional values while maintaining an encrypted local SQLite surrogate map (vault.db).
Operators can dynamically select from a Card-Based NER/NLP Detection Engine Matrixâincluding Smart Guard (Local Ollama SLM), GLiNER Zero-Shot NER, Microsoft Presidio / spaCy NLP, and Ultra-Low-Latency Native Regexâwhile streaming zero-PII redaction receipts directly into TrustAuditâ˘.
đ Live Portal & Dedicated Deployment
TokenShield is deployed and live at tokenshield.ntrust.ai. Explore the interactive sandbox, test real-time prompt obfuscation, and inspect how zero-trust tokenization shields your organizationâs proprietary intelligence.
Visit tokenshield.ntrust.ai →What you get
Card-Based Multi-Engine NER & SLM
Switch seamlessly between Local Ollama SLM (Smart Guard), GLiNER zero-shot NER, Microsoft Presidio/spaCy NLP, and Aho-Corasick/Regex secret scanners.
Synthetic Entity Swapping
Replaces sensitive entities with realistic, context-preserving surrogates (valid-looking names, IPs, keys, and emails) so LLM reasoning remains 100% intact.
3-Stage WAF Adoption Pipeline
Progress smoothly from Observe (audit-only) to Dual/Split Smart Protect (side-by-side validation) to full Enforce mode with candidate rule commits.
Transparent Tool Rehydration
When agents trigger authorized tool invocations (bash, SQL, git, APIs), TokenShield detokenizes arguments back to original values in local RAM prior to execution.
Differential Privacy & Salt Rotation
Tokens are derived using epoch-salted HMAC hashes to prevent frequency analysis attacks, with scheduled salt rotation and encrypted vault.db storage.
Universal /api/v1/agent/config Mesh
Exposes live privacy posture telemetry to TrustGuard (:8091), sanitizes threat reasoning prompts for TrustBrain (:8092), and streams PIPEDA/GDPR proofs to TrustAudit (:8093).
Who itâs for
- Enterprises adopting Generative AI, Copilot, and multi-agent systems with confidential data.
- DevSecOps teams preventing credentials, API tokens, and source code from leaking to cloud LLMs.
- Regulated healthcare, finance, and legal organizations subject to GDPR, HIPAA, and PIPEDA.
- SecOps teams tunneling high-sensitivity threat telemetry through TrustBrain.
Production Deployment & Technical Specifications
- Standalone or Bundled Sidecar: Deploys in 60 seconds on port
:8443via Docker/Podman or runs bundled inline with Spine & TrustBrain. - 3-Stage WAF Adoption: Progress from Observe (audit-only) to Smart Protect (dual/split validation) to full Enforce mode.
- Multi-Engine NER & Surrogates: Switch between Local Ollama SLM, GLiNER zero-shot NER, Presidio NLP, and Aho-Corasick/Regex with encrypted local surrogate mapping.
- Zero-Latency Tool Rehydration: Automatically detokenizes authorized local tool calls in memory while streaming GDPR/PIPEDA proofs to TrustAudit.
Simple, transparent plans
Every plan includes real-time prompt interception, synthetic surrogate mapping, and continuous audit trails.
- Up to 1,000 active vault tokens
- Core regex credential interceptors
- Observe & Enforce modes
- Standard 7-day token retention
- Community support
- Up to 10,000 active vault tokens
- Presidio NLP & GLiNER zero-shot NER
- Synthetic entity surrogate generation
- Automatic tool call rehydration
- Custom regex & keyword rules
- Dedicated support channel
- Unlimited active vault tokens
- Smart Guard Local Ollama SLM engine
- Candidate commit firewall architecture
- Immutable cryptographic audit logs
- On-premise sovereign deployment
- 24/7 SLA & custom NLP model tuning
Questions about TokenShield or sovereign deployment? Contact our security specialists and we’ll respond within one business day.
Protect your AI prompts with TokenShieldâ˘.
Visit our live application at tokenshield.ntrust.ai or run the one-line installer in your private environment today.