Sigil swaps keys, credentials and customer data for inert handles before a single byte leaves your side. The model does the work — it never learns your secrets.
Give AI your work. Not your keys.
Try to make the AI leak.
The prompt is loaded with sensitive data. Send it, then push the model to reveal it — it can't. It only ever sees tokens.
Real gateway · real model · real audit receipts. Nothing you send reaches the model in the clear.
PII enters in four places. Sigil guards all four.
Most tools only clean the user's prompt. But private data also arrives from retrieval, from tool results, and from the model's own output. Sigil tokenizes every hop.
Input
The prompt your user or agent sends. The one place most tools stop.
RAG / retrieval
Context pulled from your knowledge base and vector stores, full of real records.
Tool results
Data returned by function calls, APIs and databases mid-conversation.
Output
The model's response — re-checked before it reaches a log, a channel, or a human.
Deterministic tokens are stable across hops, so the same person maps to the same token everywhere — without ever exposing the value.
Unleash a real agent on real PII. Watch Sigil win.
A live coding agent is handed a customer record and one job: copy everything into a drop folder. Sigil scrubs the record before the agent ever exists — so the only thing it can leak is a safe handle. Flip the switch and see the difference.
Paste any record with (fake) PII, then unleash the agent and watch whether it leaks. Leave it empty to fall back to the sample.
Protected — the agent only ever sees safe handles. Whatever it leaks is a token.
Ana Souza CPF: 529.982.247-25 Email: ana.souza@example.com Phone: +55 11 98765-4321 Message: Please update my email and confirm my record is current.
Sigil scrubs the record before the agent ever exists.
The agent drops files here. Nothing yet.
Redact without breaking the response.
Deterministic tokenization keeps the answer intact. Measured across a 109-test benchmark of real agent tasks.
91–96% answer-quality retention across the benchmark. Confidential-paste figure: Cyberhaven.
Built for the people who sign off on the risk.
LGPD & GDPR
Redact regulated personal data before it reaches a third-party model. Purpose-built for the BR/EU privacy regime.
Data residency
Run in São Paulo or self-host in your own VPC. Real identifiers never leave your perimeter.
Centralized audit trail
Every scrub emits a tamper-evident receipt — what was tokenized, when, and under which policy.
Mint a sandbox key and run the real API.
No account, no sales call. Verify you're human, get a key, and scrub your first payload from the terminal.
curl -s https://sigil.labs.khal.ai/v1/scrub \
-H "Authorization: Bearer sk-pii-YOUR_SANDBOX_KEY" \
-H "Content-Type: application/json" \
-d '{
"messages": [
{ "role": "user", "content": "João Almeida (CPF 123.456.789-09) — rotate our OpenAI key sk-live-9f8a7b6c5d4e3f2a1b0c." }
]
}'Mint a key to inject it into this snippet.
Sandbox key lasts 24h with a daily quota. Your sandbox mappings are encrypted and auto-purged in 15 minutes.
Keys live in this browser only. Whoever holds the key controls it — revoking removes it here and at the gateway.
Try to leak your own data.
You'll lose. Type a real payload in the demo, or mint a sandbox key and prove it from your terminal.
The sandbox is the free tier of usage-based pricing →