Your AI reads everything
you send it.
Jnvoy decides what it's allowed to see.
A proxy that sits between your application and your model provider. Sensitive data is detected and replaced before it leaves your system. Claude and GPT-4o receive the redacted text, not the original values Jnvoy found. Point your calls at Jnvoy with your Jnvoy key and your own provider key.
Not another AI model. Pattern rules and spaCy, a widely used text-analysis library, decide what to hide. Your own LLM does the rest.
AI is already in your workflow. Your data goes with it.
Companies now rely on AI tools every day, and AI-related breaches keep making the news. Every prompt is a copy of your data leaving your control.
Staff paste company material into chatbots
In 2023 Samsung restricted staff use of generative AI after reports that employees had pasted internal source code into ChatGPT. TechRadar
Unsanctioned AI use shows up in breaches
IBM's 2025 Cost of a Data Breach Report found that one in five organisations had a breach linked to unsanctioned “shadow AI”. Those incidents exposed personal data in 65% of cases, against 53% across all breaches. IBM
Trusted vendors have flaws too
In 2026 Check Point Research showed a ChatGPT flaw that could send parts of a conversation to an outside server without telling the user. OpenAI fixed it on 20 February 2026, and Check Point found no sign it was used in the wild. The safest data is data a provider never received. Check Point
Why I built Jnvoy. I built Jnvoy so that using AI does not mean handing over your people’s, customers’ and company’s data. It is one control point between your applications and the model provider. It replaces personal data and secrets with placeholders before a prompt leaves, puts the real values back in the reply, and keeps an audit log of counts, never text. You can run it on your own servers.
Jeevan Nagaraj, founder
One proxy between your app and the model.
Jnvoy checks every LLM call you route through it before the call leaves for the model provider. Sensitive data is detected, replaced with tokens, and restored in the response. Self-hosted, the original values never leave your own servers. On the hosted service they are held in memory for the request only and never stored.
Your app sends a request
Normal LLM call with real user data.
Jnvoy scans for PII
Presidio and Jnvoy's own rules look for 50 identifier types, inside Jnvoy, with no outside service.
Sensitive data redacted
Replaced with reversible tokens before transmission.
LLM sees clean data
The model receives the redacted text, not the values that were found.
Response restored
Original values restored. Audit log written. Done.
What it catches
Personal data and secrets, wherever they come from. Identifiers are checked against their own check digit, so ordinary numbers are left alone. The full list by country is below.
Coverage by region
Your users, staff and customers are not all in one country. Jnvoy recognises the national identifiers listed here, and you can switch regions on or off with one setting.
All regions are on by default. Restrict them with JNVOY_REGIONS, for example in,au,sg or eu. Each identifier is tested against published sample numbers; we have not yet measured accuracy on real customer data. See the accuracy results. Names are detected best in English and street addresses in UK and US formats. If your country is missing, tell us the identifier and we will add it.
Built for production, not just demos
Built to support teams that handle regulated data. Jnvoy has no SOC 2 or ISO 27001 certification yet. Sensible defaults, and every setting is an environment variable. No vendor lock-in.
Microsoft Presidio detection
NLP-based PII detection with 50 identifier types. National identifiers for 21 countries, from Aadhaar and CPF to NHS and Social Security numbers, each checked against its own check digit.
Exact-match cache
Identical requests from the same API key return the stored answer instantly, with no model call. Matches are exact and scoped to each key, so a changed word or system prompt never returns someone else's answer.
Intelligent routing
Optional. When you switch it on, simple questions go to a cheaper model and harder ones to a stronger model from the same provider you chose. Off by default, so your request always uses the model you named.
Persistent audit logs
Every API call is logged to PostgreSQL, as counts by type. Never stores raw PII. Queryable by date, provider, and PII type.
Compliance report PDF
One endpoint generates a PDF for your compliance team: what was detected and redacted, by type and period, with your company name on it.
API keys and rate limits
Every request needs a key. Client keys call the proxy. Separate admin keys unlock the audit log, reports and cache controls. Per-key rate limits stop runaway usage.
Provider health monitoring
An outage detector tracks each provider's successes and failures and shows them on a health endpoint, so you see a provider degrade before your users do.
Docker stack
One command starts the API and its PostgreSQL audit database, once your keys are set. Self-hostable on your own infrastructure.
Redacts people, not vocabulary
Names, contact details, financial and government identifiers, and credentials are redacted. Company names, places and dates stay readable so answers stay useful. One setting widens the scope when you need it.
Optional second-pass review
A small language model can re-read text that has already been redacted and flag identifiers the rules missed, such as internal codes. Off on the hosted service. Self-hosted deployments can switch it on and run it on a local model with Ollama, so the text never leaves their own machines.
Optional known-phrase injection check
Off by default. A customer who turns it on has every request checked against 31 well-known injection and jailbreak phrases before anything else happens, and a request that matches is blocked and never reaches the model. In our test it blocked about one in five real jailbreak prompts and none that were reworded, translated or split across messages, and it also blocks some harmless requests. It is a tripwire, not a defence. The numbers
Pricing
Start free as a developer. For production or regulated traffic, tell us your volume and we'll quote a plan around it. You use your own model provider account, so Jnvoy never adds a charge for model usage.
Get started
Try it on real prompts and see exactly what gets redacted.
- Community support
- Key issued instantly
For live products
For products with live users and teams with audit duties: protected traffic, your own settings, usage limits you can see and a report you can hand to a customer.
- Response cache & intelligent routing
- Compliance report PDF
- Your own settings: regions and extra data types
- Reply scanning, with an audit trail of what was found
- API key with rate limiting and rotation on request
- Email support
Custom deployment
For custom deployments: run it in your own cloud, add recognisers for your own data formats, and agree a service level.
- Everything in Production
- Self-hosted in your own cloud, so audit data stays with you
- Custom recognisers, built with you
- Service level agreed with you, plus onboarding support
- Dedicated Slack channel
Request a demo
A short call where we run Jnvoy on text like yours and scope a plan around your volume.
Request a demoNo preparation needed. A few sample prompts help.
- Your own text, redacted live
- Paste a sample prompt and see what is found and what replaces it.
- A quote based on your volume
- Tell us your calls per month and providers, and leave with a figure.
- Straight answers on data flow
- Where your text goes, hosted or self-hosted, and what the optional second check changes. The privacy page and security page have the detail.
Second check, when self-hosted
A second AI review of the already-redacted text, for what pattern rules miss: free-text addresses, unlabelled reference numbers, unusual names.
Not switched on for the hosted service. A self-hosted deployment can run it on a local model, so nothing leaves your machines. Adds about a second per request.
Prefer to self-host? Jnvoy is source-available under BSL 1.1. Run it on your own infrastructure, in production, at no charge. The licence only stops you reselling it as a competing hosted service, and each version becomes Apache 2.0 four years after release.
View source on GitHubPoint your calls at Jnvoy.
Already using the OpenAI client library? Change two lines: set the base URL to https://www.jnvoy.com/v1 and use your Jnvoy key, with your own model provider key in an x-provider-key header. Or call the /v1/proxy endpoint directly. Replies come back with the original values restored, and streaming works. Read the 5-minute quickstart.
# direct to Anthropic import anthropic client = anthropic.Anthropic( api_key="sk-ant-..." ) response = client.messages.create( model="claude-haiku-4-5", messages=[{ "role": "user", "content": user_message # raw PII }] )
# through jnvoy: new URL, your jnvoy key, your own provider key import httpx response = httpx.post( "https://www.jnvoy.com/v1/proxy", headers={ "x-api-key": JNVOY_API_KEY, "x-provider-key": ANTHROPIC_API_KEY, }, json={ "model": "claude-haiku-4-5", "provider": "anthropic", "messages": [{ "role": "user", "content": user_message # PII redacted }] } )
The document your auditor is asking for
When a regulator, an auditor or a customer’s security team asks what controls you apply before data reaches external AI models, Jnvoy generates the record automatically. One endpoint. One PDF.
Data protection activity report (sample)
DATA
Your AI is live. Is your data protected?
Source-available. Self-hostable. Works with Anthropic and OpenAI.