GDPR Shield adds a personal-data classification gate to any LLM, AI agent, or text workflow that sends text through its HTTP API. It classifies IBANs, tax IDs, national identifiers, credentials, and review-worthy patterns across 10 European countries. No LLM calls. No input-text retention.
$ curl -X POST shield.promptandbuild.de/v2/classify
Start for 29 EUR
IBAN · Tax ID · BSN · Personnummer · NIF · Rijksregister · PESEL · Codice Fiscale
Watch the API identify European personal-data patterns, return a clear decision, and keep the original text out of logs and storage.
The engine is evaluated with versioned regression, adversarial, Unicode-evasion, API, database, startup, concurrency, and webhook-security suites.
Text pipelines process customer messages, support tickets, form submissions, and AI agent outputs. Personal identifiers slip through into logs, analytics, training data, and third-party services.
LLM inputs and outputs regularly contain names, IBANs, and ID numbers. Without a filter, personal data flows into prompts, logs, and downstream systems.
Customers paste account numbers, tax IDs, and personal details into chat and email. Agents forward these into tickets, analytics, and reporting tools.
Batch processing moves text between systems. A single unfiltered field can propagate personal data across databases, data warehouses, and backups.
Add a single API call to your pipeline. The response tells you whether the text contains personal data and what kind.
Scan AI agent outputs before they reach production. Flag text classified as DETECTED for human review. Automate what you can, escalate what you must.
Check log entries before they hit your logging infrastructure. Classify and tag entries so personal data can be handled according to your retention policies.
Classify incoming text from forms, chat, and email. Route messages containing personal identifiers to appropriate handling workflows.
Every text is classified into one of three tiers. Mathematical checksums (Mod97, Luhn, Elfproef) validate identifiers. Humans only review what the system marks as uncertain.
Contains verified personal data. IBAN validated via Mod97, credit card via Luhn, tax ID via country-specific checksum. High confidence.
Potentially contains personal data. Two capitalized words in sequence, address-like patterns without full context. Flagged for human decision.
No configured identifier was detected. This is not proof that the text contains no personal data; choose a policy that matches your risk.
Built for teams that process European text and need to know what's in it before it moves downstream.
The managed API runs on German infrastructure. Input text is processed in memory and is not written to application logs or the database. Metadata is pseudonymized for security and billing. An AVV/DPA is available for business customers.
IBANs are validated with Mod97. Credit cards with Luhn. Dutch BSN with Elfproef. Polish PESEL with weighted checksums. Pattern matching plus mathematical proof reduces false positives.
Each country module knows its own ID formats, address patterns, and salutation conventions. Not a generic regex list, but country-specific detection logic covering 10 EU/EEA countries.
No LLM inference and no third-party classifier calls. The engine uses deterministic patterns and checksum functions; end-to-end latency still depends on your network and deployment region.
Each country module combines format rules, context checks, and the applicable validation algorithms. Not every data category has a mathematical checksum; uncertain matches are returned as REVIEW.
Mod97Luhn IBAN, Tax ID, SSN, license plate, ID card
Mod97 social security number, business registration, health insurance card, identity card
Elfproef BSN, KvK, postal code, driver's license
Mod23 DNI/NIE, corporate tax ID, social security number, passport
Checksum Codice Fiscale, Partita IVA, ID card
Weighted PESEL, NIP, REGON, identity card
Mod97 SOCIAL_SECURITY_NUMBER, VAT_ID, tax number
Mod97 National register, enterprise number, eID
Weighted NIF, citizen card, social security number, passport
Luhn Personnummer, org number, passport
Shield is intentionally narrower than a full enterprise DLP suite and easier to adopt than operating and tuning a generic open-source toolkit.
| Capability | Generic cloud PII API | Self-hosted toolkit | GDPR Shield |
|---|---|---|---|
| Ready-to-use managed API | Yes | Customer operated | Yes |
| Ten European country modules | Varies | Requires configuration | Included |
| National checksum validation | Varies | Recognizer dependent | Built in |
| No LLM inference | Service dependent | Possible | Guaranteed by design |
| No input-text retention | Policy dependent | Customer controlled | Managed-service default |
| Automatic masking or tokenization | Often available | Often available | Not yet; classification only |
Send JSON, get a classification. Pass country codes to scope the detection. Multiple countries in a single request.
Shield Starter is available now: subscribe, receive your API key by email, and start classifying. The Agent Safety Bundle is available through coordinated early access.
Secure payment via Stripe. Invoice delivered automatically.
Early-access bundle. We confirm fit and onboarding before activation.
No. Shield is a technical classifier that supports data-handling controls. Compliance depends on your purpose, legal basis, processes, contracts, retention, access controls, and the rest of your system.
No. CLEAR means no configured identifier or review pattern was detected. Apply a policy that matches the risk of your workflow and retain human review where the consequences are high.
The managed API processes input text in memory and does not write it to application logs or the database. Pseudonymized metadata is retained only where needed for security and billing.
Not currently. The API classifies the text and returns categories so your workflow can block, route, tag, or transform it. Automated masking is a planned extension.
Yes. API v2 is the recommended English contract. API v1 remains available for backward compatibility while existing clients migrate.