DataFog — The Privacy Firewall for Agents

The Privacy Firewall for Agents.

DataFog detects and redacts PII locally — in Claude Code hooks, LiteLLM gateways, and Python pipelines — before it leaves your machine.

100% Open source

$pip install datafog

Pick your enforcement point.

Three ways to put DataFog between your data and the model. Everything runs locally, and matched values are never echoed into logs or transcripts.

Python library

Scan, redact, or block PII in prompts, outputs, and pipelines. Regex engine by default; spaCy and GLiNER are opt-in.

$ pip install datafog

>>> import datafog
>>> datafog.sanitize(
...     "Contact ada@example.invalid",
...     engine="regex")
'Contact [EMAIL_1]'

Library docs →

Claude Code

Gates agent tool calls — shell commands, file writes, web requests, MCP tools — and warns the model when prompts or results carry PII.

/plugin marketplace add
    DataFog/datafog-claude-plugin
/plugin install datafog@datafog

# blocked before the tool runs:
✗ Bash denied — SSN in command

Plugin repo →

LiteLLM gateway

An in-process guardrail for any LiteLLM-proxied provider. Redacts or blocks at the gateway, with no sidecar service to deploy.

# litellm --config config.yaml
guardrails:
  - guardrail_name: datafog-pii
    litellm_params:
      guardrail: datafog.integrations.litellm_guardrail.DataFogGuardrail
      mode: ["pre_call", "post_call"]
      action: redact  # or: block

Guardrail example →

More surfaces

The same firewall ships as fogclaw for OpenClaw agents — openclaw plugins install @datafog/fogclaw — and more enforcement points are on the way. Follow the roadmap →

Defaults to the high-precision entity set — EMAIL · PHONE · CREDIT_CARD · SSN. Noisier types, German locale packs, and allowlists are opt-in. Presidio-style entity names are accepted as aliases.

100x+ faster than NER-based scanners.

DataFog's guardrail runs inside your gateway process. The common alternative is a NER service beside it, which adds a deployment to manage and a network hop to every request. Benchmarked on identical payloads and entity types; reproduce it with one command.

	DataFog guardrail	Sidecar scanner (e.g. Presidio)
Deployment	in-process — `pip install datafog`	separate service to run and scale
Extra dependencies	pydantic only	spaCy + language models
Latency per scan	231µs on a 1.2KB document	22.8ms on the same document
Network calls	none	HTTP to the sidecar

Latency figures are medians from the reproducible benchmark suite (Apple M5 Pro, CPython 3.13), measured 103–170x faster than Presidio across payload sizes — python benchmarks/run.py reproduces every number on your hardware. Fair-play note: NER-based scanners catch unstructured entities — names, organizations — that regex alone can't. DataFog ships spaCy and GLiNER engines as opt-in extras for exactly that. This comparison is about speed and where enforcement runs, not recall.