piighost

Anonymize PII before it reaches the LLM

piighost is a Python library for building PII anonymization pipelines. It swaps personal data for stable placeholders the model can reason about, then restores the real values for your tools and your users. Your agent code does not change.

Get started GitHub

Hi, this is Patrick Dupont from Acme Corp. My order #ACME-9123 should be delivered to 12 rue de la Paix, Paris. You can reach me by email at patrick.dupont@acme.com or by phone at +33 6 12 34 56 78.

The problem

You should not have to choose between good models and data privacy

Hosted clouds leak raw data

OpenAI, Anthropic, and Google ship the best models on the market. But every byte of context you send them, including raw user PII, leaves your jurisdiction the moment the request hits the wire. A single prompt becomes a data export.

Local models trade quality

Self-hosting keeps the data inside your network, but you give up part of the state of the art and you take on the GPU bill and the patching. The privacy gain comes with a permanent operational cost, and the model you can run is rarely the model you wish you were running.

Compliance does not wait

GDPR, HIPAA, and data-residency rules apply whether or not your stack was built with them in mind. Sending raw PII to a third party is a liability you cannot undo once a request has left, and it forces every later product decision through a legal review.

Bans throw away the upside

Some teams respond by banning hosted LLMs outright. That protects the data, but it also forfeits the productivity gains everyone else is capturing, and people route around the ban anyway by pasting work into personal accounts the company cannot see.

Why piighost

More than a PII detector

Finding sensitive data is the easy part. piighost gives you everything around it: detectors you compose, placeholders you can undo, consistency across a whole conversation, and a pipeline you run on your own terms.

Composable detectors

Combine regex, NER, and LLM detectors in a single pipeline and keep the ones you trust. Built-in chunking splits long documents, so even large files are fully covered.

Reversible, transparent tokens

Every value becomes a stable placeholder and is restored automatically. Your users and your tools always see the real data, while the model only ever sees the placeholder.

Consistent across a conversation

The same value keeps the same placeholder for a whole conversation, across every message, tool call, and agent. Nothing drifts, so the model never loses track of who is who.

Config-driven and self-hosted

Describe a whole pipeline in one config file and run it entirely on your own infrastructure. Nothing leaves your walls, and there is no extra service to trust.

How it works

A layer between your agent and the model

User message

Hi, this is Patrick Dupont. Could you forward this to Marie Lambert and Jean Moreau? My email is patrick.dupont@acme.com, and you can also cc marie.lambert@acme.com. The case ID is #ACME-9123.

piighost runs your detectors over the message and reports every PII span it finds: names, emails, identifiers, anything the model does not need to see. Overlapping detections from multiple detectors are arbitrated by confidence before anything is replaced.

The ecosystem

One privacy layer, many projects

Start with the library. Reach for the server, the chat demo, and the proofreader as you grow.

piighost

The core library. Build PII anonymization pipelines for AI agents.

Learn more

piighost-api

A REST server that hosts one piighost pipeline behind HTTP.

Learn more

piighost-chat

A demo chatbot that anonymizes messages before the LLM sees them.

Learn more

piighost-proofreader

An LLM CV proofreader that anonymizes documents before any LLM call.

Learn more

<<PROJECT_NAME:2b1f4a>>

More to come.

<<PROJECT_NAME:7c43e9>>

More to come.

<<PROJECT_NAME:9af0d2>>

More to come.

<<PROJECT_NAME:1e8c75>>

More to come.

<<PROJECT_NAME:f30b86>>

More to come.

Quick start

Drop it into your agent framework

Add piighost to the framework you already use. Your agent code stays the same.

uv add 'piighost[langchain,gliner2]'
from langchain.agents import create_agent

from piighost.components.detector.ner import Gliner2Detector
from piighost.pipeline import ThreadAnonymizationPipeline
from piighost.integrations.langchain import PIIAnonymizationMiddleware

# Any detector works: regex, NER, or an LLM. Here a GLiNER2 NER model.
detector = Gliner2Detector("fastino/gliner2-multi-v1", labels=["PERSON", "LOCATION"])
pipeline = ThreadAnonymizationPipeline(detector)
middleware = PIIAnonymizationMiddleware(pipeline=pipeline)

agent = create_agent(
    model="openai:gpt-5.6-terra",
    tools=[lookup_city],
    middleware=[middleware],
)

# The model only sees "<<PERSON:1>>"; lookup_city still receives "Patrick".

Frequently asked questions

Why anonymize instead of self-hosting the model?
Self-hosting is a valid choice and gives the strongest confidentiality: no third party can read the content, by construction. The cost is that everything moves onto you (the GPU bill, security, patching, logging) and the model you can run yourself is usually weaker than the best hosted ones. Anonymizing keeps that quality: only placeholders like <<PERSON:1>> leave your infrastructure, so the leakage risk is neutralized whichever provider you use. It is one layer, not a silver bullet. The Philosophy page walks through the full tradeoff.
What do I need to run piighost in production?
At minimum, the piighost library and a pipeline. Install it with the extras your detectors need: pip install 'piighost[config]' is enough for a regex-only pipeline; add transformers, gliner2 or llm per detector, and cache for a shared Redis mapping. Save your pipeline as a TOML file and load it with load_pipeline. Classic NER and GLiNER download an ONNX model on first use and run on CPU; regex needs nothing more; the LLM detector needs a provider and an API key. When several processes need one shared endpoint, deploy piighost-api instead of embedding the library.
Can I use piighost with Claude Code?
piighost is model-agnostic, so it works with Anthropic's Claude the same way it works with any provider. It runs at the data layer: you anonymize text in your own code before the model sees it, so only placeholders like <<PERSON:1>> ever reach Claude, and the real values are restored in the reply. Wrap any Claude call you make from Python, directly or through LangChain, Pydantic AI or LlamaIndex. There is no dedicated extension for the Claude Code CLI itself, since piighost protects the prompts and data you send, not the tool you send them with.
Can I use piighost with LangChain, Pydantic AI or LlamaIndex?
piighost ships integrations for LangChain, Pydantic AI and LlamaIndex. You wrap your pipeline in the provided helper (middleware, hooks or a node anonymizer) so PII is replaced before the model runs and restored afterward. The model only ever reasons over placeholders like <<PERSON:1>>, never the real values.
Is piighost GDPR compliant, and how do stable placeholders work?
piighost performs reversible pseudonymization in the GDPR sense, which supports compliance but does not replace your own legal review. Stable placeholders mean the same entity always maps to the same token (Patrick becomes <<PERSON:1>> everywhere), so the model keeps context while the real value stays out of its reach.
Does my data stay local? What is actually sent to the model?
Only the anonymized text is sent to the model, with every detected value replaced by a placeholder such as <<PERSON:1>>. The mapping from tokens back to real values stays on your side and is never sent. After the model responds, piighost restores the original values locally so your users see the real data.

Ship AI features without shipping user data

Install piighost, wire your detector, and keep PII out of the model.

Read the docs Star on GitHub