BiVelio ShieldKeeps personal data and secrets out of ChatGPT, Claude and any other AI — caught and swapped before they ever leave your device or your servers. A free browser extension for people; a self-hosted gateway for developers and teams.
Available on Chrome, Edge & Brave · Firefox & Safari coming
Works with ChatGPT (OpenAI) & Claude (Anthropic)In plain words
Four ideas, four short animations. This is the whole product.
Open ChatGPT or Claude and write the way you always do — with your email, your ID number, your IBAN or your card if you need to. Nothing about how you work changes.
Before a single byte leaves your browser, BiVelio Shield spots those sensitive values and swaps them for anonymous tokens. It all happens on your machine, not on a server.
The AI provider receives the tokens instead of your real data — never the email, the number or the document. What's yours stays with you.
When the reply comes back, the extension restores your real values on screen. The conversation reads normally; the trail left in the cloud stays anonymized.
The animations illustrate the idea. The technical detail — and the proof — is further down.
Measured, not claimed
Every figure comes from running the engine over thousands of real test values, not from a promise. Skeptical? Reproduce them yourself with make benchmark. Here's what they mean for you:
And we're just as clear about what we don't do: names and free-form text are handled by the optional AI layer. The 4.875% we publish is what leaks without it; with it, none of the 800 test values did — on a synthetic corpus, so we still do not promise zero.
What those figures cover: the deterministic layer over the 15 entity types the benchmark corpus scores — structured identifiers and secrets — across 1,000 labelled documents. The structured detector that ships carries many more types the corpus does not score, and these numbers say nothing about them. Names, postal addresses and free text are NOT in the corpus: they are handled by the optional NLP layer, which runs on a gateway and never in the browser — your own self-hosted one, or the names service BiVelio operates for your organization. Throughput depends on the machine and its load — run it on your own before quoting it.
And on the adversarial track — the same values written the way people actually write them: glued to a stray digit, prefixed with Nº, in another script's digits, or carrying an interior combining mark — precision falls to 0.987–0.994 depending on the seed, and recall to 0.9989. What does not move on any seed is the pair that matters for a DLP frontier: residual leak 0.00% and partial-leak surface 0.
Why this matters
A support ticket, a contract, a spreadsheet of customers, an API key in a stack trace. Pasted into ChatGPT or Claude on a busy afternoon, it becomes a disclosure to a third-party provider under that provider's terms.
Personal data that stays on your machine needs no processing agreement, no transfer assessment and no breach notification. Redaction before the request is the simplest control there is.
An API key or a private key that reaches a model is compromised the moment it leaves. BiVelio blocks those sends outright and tells you which key it was.
Tokens keep the structure of your text, so the model can reason about a customer, an IBAN or an email without ever seeing the real value. The reply is restored on your screen.
Pricing
The browser extension's deterministic core is free, forever — no account. Pro adds the value-free report and the self-hosted gateway for your own apps. Team adds attachment redaction, the names layer on the service BiVelio operates, and what an organisation needs to roll it out to every seat. Per seat, in EUR.
The browser extension for ChatGPT and Claude on the web, with the same checksum-validated engine as the paid plans.
No licence and no seat check-in.
Billed per seat. Or €39 / seat / yr (save ~19%).
Extension and gateway on one licence · seats from 1
Billed per seat. Or €79 / seat / yr (save ~18%).
Minimum 5 seats · for a whole organisation
A seat is an active machine or service identity, not a person — billed per seat on your subscription.
Prices exclude VAT. BiVelio Shield is business software: a valid EU VAT number is required at checkout, and the reverse charge applies.
Same detection engine everywhere. The difference is where it runs and what it can reach.
| Shield · Free | Shield · Pro | Gateway · Self-hosted | |
|---|---|---|---|
| Where redaction runs | Your browser | Your browser | Your infrastructure |
| Works with | ChatGPT, Claude (web) | ChatGPT, Claude (web) | Any OpenAI / Anthropic SDK |
| Structured identifiers — IBAN, cards, IDs, emails, phones, IPs | Yes | Yes | Yes |
| API keys & secrets blocked outright | Yes | Yes | Yes |
| GDPR Art. 9 special-category lexicon | Yes | Yes | Yes |
| Attachments — PDF, Word, Excel, PowerPoint, text | No | Team plan | Team plan |
| Names, addresses, free text (NLP layer) | No | Any paid plan — on Pro against a gateway your administrator configures, and on Team against the names gateway BiVelio operates, with nothing for anyone to configure | Local models |
| Custom dictionaries — codenames, clients, projects | No | No | Yes |
| Dashboard with value-free counts | No | Yes | Yes |
| Account required | No | Licence | Licence |
| What reaches BiVelio | Nothing | Seat check-in (no content) — and, on the Team plan, the text of each message to the names gateway BiVelio operates (on Pro, to your organization's own gateway), which answers with positions and stores nothing. Off from the dashboard on Team; on Pro, and under a managed policy, by removing the gateway from that policy | Value-free counts (optional) |
| Price | Free | €4 / seat / mo + VAT | €4 (Pro) · €8 (Team) / seat / mo + VAT |
Pro, Team and the gateway share one subscription: a seat is a machine or a service identity, and the same licence token works in the extension and in the gateway.
Who it is for
Pick the one that matches how you work. All three run the same checksum-validated detection and the same fail-closed rules.
You work with other people's data every day and you want to use AI without becoming the weak link. Install the free extension and keep working exactly as before.
Get the free extension →Give every seat the same protection, add attachment redaction for PDF, Word and Excel with Team, and see value-free counts of what was kept out of the cloud in the dashboard.
See team pricing →Run the self-hosted gateway inside your perimeter and point your OpenAI or Anthropic SDK at it. One line of configuration, four endpoints covered, everything else denied.
Read the developer track →How it works
The same pattern in both products. The provider only ever receives placeholder tokens; the real values never cross the line.
Add BiVelio Shield to Chrome, Edge or Brave in one click. Nothing to configure.
Open ChatGPT or Claude and write normally — the extension runs quietly in the background.
Emails, cards, IBANs, IDs and secrets are auto-redacted, then restored in the reply. Redaction runs on your machine, before your prompt is sent.
No code, no server, no account. Install the free extension and your sensitive data is redacted right on your machine — before it ever reaches ChatGPT or Claude.
Firefox & Safari comingTry it live
Paste a support ticket, a code snippet, a customer record. Watch sensitive values get pseudonymised or redacted before they'd reach the model, then restored on the way back — all in your browser. Nothing you type leaves this page.
195 / 20,000
Hola, soy Marta y necesito ayuda con mi cuenta. Mi correo es [BV:EMAIL:ee14950f10] y mi teléfono [BV:PHONE_ES:27278110ce]. Adjunto mi DNI [BV:SPANISH_DNI:3524006bcd] y el IBAN [BV:IBAN:9629b822e9] para la verificación.
Hola, soy Marta y necesito ayuda con mi cuenta. Mi correo es marta.ruiz@empresa.es y mi teléfono +34 612 345 678. Adjunto mi DNI 12345678Z y el IBAN ES9121000418450200051332 para la verificación.
This runs the gateway's deterministic layer (checksum-gated IDs, IBAN mod-97, Luhn, secrets) ported to your browser — the same algorithms the server runs, with 0 values leaving your device. Names & free-text PII are the licensed NLP layer, not shown here.
For developers & teams
Self-hosted, fail-closed DLP between your services and any LLM. Point your OpenAI/Anthropic SDK at it — nothing sensitive reaches the provider.
Two commands in your terminal and you see it: sensitive data goes in, replaced data comes out. The same command then works in your scripts and CI.
$ pip install bivelio-privacy-gateway
$ echo "IBAN ES91 2100 0418 4502 0005 1332" | bpg scan
IBAN [BV:IBAN:49993624f2]Your AI traffic goes through your own gateway, in your infrastructure: it replaces sensitive values before forwarding each request to the provider and returns them restored in the response. For your code it is one line: the address.
client = OpenAI(
base_url="https://bpg.internal/v1",
)If anything fails, the request does not leaveDENY
What it catches
Structured identifiers are checksum-validated, so false positives stay near zero. Secrets are treated as incidents, not personal data.
DNI/NIE/NIF/CIF, IBAN (mod-97), cards (Luhn), ES/AD phones, email, IPv4 — every match validated by its checksum, then reversibly tokenised so the value round-trips: zero data loss.
OpenAI/Anthropic/AWS/GCP/GitHub/Stripe keys, JWT (header-verified), PEM private keys, connection strings. Detected → blocked → treated as compromised.
Multilingual NER (Presidio + spaCy, ensembled with GLiNER) for people and locations with no structural signature — tuned for es · ca · fr · en · pt · de and for no other: in it · nl · pl · tr · id · vi it still runs, and finds fewer names. Layer 01 does not depend on the language.
Codenames, unannounced clients, internal labels — the confidential data no generic model knows about, declared per tenant.
Questions
With the extension, your prompt is redacted inside your browser before the request is sent. The AI provider you chose receives the tokenised version; BiVelio never receives your prompt — unless your organization is on the Team plan, which includes the names gateway BiVelio operates, on Pro the same layer running against your organization's own gateway instead. In that case the text of each message, up to 4,000 characters and never attachments, goes there to find names, comes back as positions and is stored nowhere: memory only, for the length of the request, no disk and no log. The substitution and the restoring stay in your browser. On Team an owner or an administrator switches the layer off from the dashboard; on Pro, and on any install whose gateway comes from a managed policy, that policy takes precedence and the layer goes off by removing the address from it.
Yes. A token such as [BV:IBAN:2e5d8c] keeps the type and the position of the value, so the model can reason about it exactly as it would about a real one. When the reply comes back, the real value is restored on your screen.
The extension does not remove people’s names, postal addresses or free-form text on its own: those have no fixed pattern. On any paid plan — Pro or Team alike — names are looked for on two roads onto the same route: the Team plan carries the address of the names gateway BiVelio operates, signed inside your organization’s licence, and on any paid plan your administrator can set a gateway address in the central managed policy, which takes precedence. Either way the text of each message goes to that gateway and comes back as positions; it reduces the leak of names, it does not eliminate it. On the Free tier it never happens: no gateway is called. It does not protect voice or realtime modes, it does not cover Claude’s Cowork composer, and on the Free and Pro plans attachments are uploaded as-is with a notice — only Team rewrites them. All of this is written in the extension’s privacy policy.
Opting out of training does not stop the provider from receiving, processing and retaining your data under its terms. BiVelio changes what is sent in the first place, so there is nothing to opt out of.
It applies data minimisation before the data reaches a processor: what was never disclosed needs no processing agreement, no transfer assessment and no breach notification. It is a technical measure, not legal advice; your obligations for the data you do send are unchanged.
The send is stopped and the popup tells you that protection was interrupted. Fail-closed means a doubt is resolved by not sending, never by letting the text through.
The extension is for people using ChatGPT or Claude in a browser: install and forget. The gateway is for software: your services point their OpenAI or Anthropic SDK at it and every request is inspected in place. Teams often use both.
Yes. The benchmark that produces them ships with the gateway (make benchmark), and the Playground on this page runs the same engine in your browser so you can test your own text without it leaving the page.
The website and its functions run in Frankfurt, the account database in Frankfurt, and the Sandbox in Germany. Stripe handles payments and Resend delivers invitation emails, both from the United States, and Google receives consent-gated ads measurement from the public pages only. The service privacy policy names all three rather than hide them under a general EU claim.
No. The licence is a signed entitlement verified offline against BiVelio's public key. Value-free usage counts can be reported to the dashboard if you configure it, and never include prompt text or detected values.
Ready when you are
Install the free browser extension in one click, or set up the self-hosted gateway for your app or team.
BiVelio is a member of the NVIDIA Inception Program.
NVIDIA's program for startups building with AI.
About the program