Self-hosted data protection for AI · multilingual DLP layer for LLM traffic
The model does the work. It never learns who it was about.
Salus replaces names, ID numbers and account details with consistent tokens before a prompt leaves your network, then puts the real values back in the answer. Your teams keep the AI tools they already use. The provider only ever receives tokens.
31 detection classes9 semantic categories7 in-house modelsmultilingualPDF / Office / imagesOpenShiftSIEM eventsfails closed
Müşteri Ayşe Demir (TCKN 12345678901) mart faturasına itiraz ediyor…
[PERSON_81af3c]TR12 3456 …→[IBAN_c412e8]+2 moreSelf-hosted
Runs in your datacentre or private cloud. Salus the company holds no copy of your data or your keys.
Multilingual
Seven language models we trained ourselves, working across languages, with checksum validators for national identifiers such as TCKN, VKN and IBAN.
Any provider
OpenAI, Anthropic, Google, Mistral or your own model. You keep your contract and your credentials.
Two-way
Answers come back with the real values restored, for the people authorised to see them.
The boundary
Only tokens cross.
Names and numbers never leave. What reaches the model is a typed token; what comes back is restored on your side.
Names and identifiers on the left become typed tokens as they cross the boundary; the answer comes back and the tokens become names again, inside your network.
Why tokens
Blocking stops the work. Redaction ruins the answer.
Most tools that protect AI traffic either refuse the prompt or black out the sensitive parts. Both keep the data safe. Neither leaves your colleague with an answer they can use, so people go around them.
“Maria Sandoval missed three payments. Her guarantor Erik Lindqvist missed none. Draft a reminder letter to the right person.”
Block
The model receives: nothing. The prompt is stopped.
Your colleague gets: “This request violates company policy.”
Safe, and the work moves to a personal account.
Redact
The model receives: “▮▮▮ missed three payments. Her guarantor ▮▮▮ missed none.”
Your colleague gets: “Dear ▮▮▮, our records show three missed payments.”
No name, and no way to tell which of the two it is for. Safe, and the answer has to be rebuilt by hand.
Tokenise
The model receives: “[PERSON_81af3c] missed three payments. Her guarantor [PERSON_5b90da] missed none.”
Your colleague gets: “Dear Maria Sandoval, our records show three missed payments.”
Addressed to the right person, ready to send. Safe, and the answer is usable as it arrives.
Product and proof
What ships today, counted.
Six things you can install, inspect and measure. Each one is in the current release.
Detection engine
Format rules with checksums (TCKN, VKN, IBAN mod-97, Luhn, IMSI, ICCID, IMEI) and seven in-house language models, each with one job, under fixed versions: the same input always gives the same result. A semantic layer adds nine categories of stated disclosure. CPU only.
- checksums
- 7 models
- verifier
- semantic layer
- deterministic
Language models, trained in-house
Seven purpose-built models, trained by us on our own data, each with one job: finding entities, verifying every candidate in context, reading pages and images, screening and locating stated disclosures. Multilingual, with no provider in the loop.
- entity models
- verifier
- vision
- semantic pair
- multilingual
Documents and images
Protected in place, structure preserved. Scanned pages and photos are read on your servers; signatures, identity documents and faces are blocked outright. Files that cannot be read are refused, never passed through.
- DOCX
- XLSX
- PPTX
- PNG / JPG
- scanned pages
Context store
Per-case opaque tokens. The same person keeps the same token across a conversation, batch or case. Optional format-preserving mode.
- case-scoped
- opaque
- format-preserving
Enterprise delivery
Private OCI Helm chart for OpenShift 4.x, signed release manifest, CycloneDX software bill of materials.
- Helm
- OpenShift 4.x
- signed manifest
- SBOM
Evidence
Security events with stable codes to your SIEM, a PostgreSQL audit store, OpenMetrics, and reviewer feedback on every decision.
- SIEM
- audit store
- OpenMetrics
- reviewer feedback
Every item above is in the current release.
How it works
Four steps. One of them leaves your network, and it carries tokens.
Detect
Language models, format validators and a vision model running on your own servers find the sensitive values in text, documents and images.
Tokenise
Each value becomes a typed token such as [PERSON_81af3c]. The same person keeps the same token for the whole case, so the model can still follow who did what.
Your AI call
Your application calls its own provider with its own credentials. Salus does not call the model for you. Only tokens cross the boundary.
Restore
When the answer returns, Salus puts the real values back inside your network, for users who are authorised to see them.
What it detects
Grouped by what a reviewer would ask about.
Text, PDF, Office documents and images. Classes are configured per deployment and measured per class on your own data before go-live. Signatures, identity documents and faces are blocked rather than tokenised. The semantic layer masks stated disclosures about a person in nine categories, on top of the core result.
Full detection dictionaryIdentity and organisation6
- Person name
- Organisation
- TCKN11 digits, two-step checksum
- Passport number
- Date of birth
- Vehicle plateTurkish plate grammar
Contact and location7
- Phone number (MSISDN)Numbering-plan check, E.164 and national formats
- E-mail address
- Postal address
- Location
- Coordinates
- Identifying URL
- IP addressIPv4 and IPv6 syntax
Financial and government identifiers5
- IBANCountry length and structure, mod-97 check
- Payment card numberLuhn check, 13 to 19 digits
- Tax number (VKN)10 digits, checksum
- Bank account number
- Customer or subscriber number
Telecom and device3
- IMSI15 digits, MCC and MNC structure
- ICCID19 or 20 digits, Luhn check
- IMEI15 digits, Luhn check
Credentials, international and sector identifiers7
- Foreign identity, tax and social-security numbers
- Driving licence numbers
- MAC addresses
- Credentials
- Domestic banking formats
- Healthcare identifiers
- Crypto-asset addresses
Signatures, identity documents and faces3
- Handwritten signatures
- Identity documents
- Faces
Customer-defined1
- Your own identifiers
Semantic layer 9
Optional and complementary. Masks a stated disclosure about an identifiable person; generic statements pass unchanged. It only adds protection; it never removes or re-types what the core found.
- Health
- Religion or belief
- Sexual life
- Age or gender
- Nationality or citizenship
- Marital or family information
- Employer or occupation
- Salary or financial circumstances
- Location in free text
Where it fits
Two ways to put Salus in the path.
Integrate it into the applications you build, or deploy it around the ones you don't control. Both run on the same engine, with the same tokens and the same rules.
In the applications you build
Call Salus from your code, your AI gateway or your batch jobs: protect before the provider call, restore after it. If protection cannot complete, the request stops and nothing is sent.
- In-house assistants and copilots
- The AI gateway you already run
- Analytics and batch jobs over customer data
- Agents and automated pipelines
Around the applications you don't control
For the AI tools your teams use directly, Salus is deployed on managed endpoints and protects what is typed or attached, without changing the application.
- Browser-based AI services
- Desktop AI applications
- Documents and attachments
- Optional human review before anything is sent
Security and compliance
Reviewed like any other system inside your perimeter.
Because that is where all of it lives. Controls are named and numbered, frameworks are mapped, and nothing is claimed as certified.
Controls
- Named control catalogue, SC-01 onward
- One decision record per request
- Stable reason codes
Published with the datasheet.
Frameworks · mapped
- OWASP Top 10 for LLMs
- NIST AI RMF
- ISO 27001 Annex A
- KVKK
- BTK traffic data categories
Mapped, with evidence aligned. Not certified.
Deployment
- On-premises
- Private cloud
- Isolated network with a mirrored registry
Containers, CPU, PostgreSQL state.
Data
- No Salus-side copy
- No keys leave your environment
- No telemetry home
Nothing on our side to breach or subpoena.
Control
You run it. You hold the keys.
Runs where you decide
On-premises, private cloud or an isolated environment. Ships as containers, runs on CPU, keeps its state in your own PostgreSQL.
No Salus-side copy
Detection, tokenisation and the mapping back to real values all stay in your environment.
Fails closed
If detection or tokenisation cannot complete, the request is stopped. Nothing goes out unprotected because a step was skipped.
Audit without the data
Every protect and restore is logged for your SIEM. The logs record what happened without reprinting the values you were protecting.
Administration and operations
Operate it like any other system in your perimeter.
A console your administrators sign into with their directory accounts, policies per calling system, a tamper-evident audit trail, metrics your monitoring already scrapes. Nothing new to learn.
Administration console
Web console in English and Turkish. Detection classes on and off, custom rules by keyword or pattern, API keys per calling system, review screen with CSV export.
Your directory, your roles
Administrators authenticate against Active Directory or LDAP; rights follow group membership. Three roles: administrator, rules editor, reviewer. No local privileged accounts, no shared logins. Single sign-on on request.
Policy per calling system
Each caller gets its own key and its own policy: tokenise, suppress, allow or block, per class. Deterministic, versioned, and rolled back with the release.
Tamper-evident audit trail
Write-only: every detection, restoration, configuration change, key rotation and login attempt, with hashes instead of content. Exported as JSON lines with a CEF mapping to your SIEM.
Monitoring you already have
OpenMetrics on every service: request rate, p50 and p95 latency, error rate, detector availability. A Grafana dashboard and a default alert set ship with the release.
Sized for a CPU node
Reference production node: 16 cores, 32 GB RAM, no GPU. Stateless services with replicas for availability; a disaster-recovery instance is covered by the licence.
Models and rules are versioned artefacts pinned to each release. A release is either active or rolled back; nothing retrains silently.
Resources
Written for the people who will review this.
No form, no gate. Download and forward.
Platform datasheet
What ships, how it deploys, what it needs from your environment.
PDF · catalogueControl catalogue and framework mapping
Every control by number, with the framework lines it supports.
PDF · whitepaperTokenisation compared with masking
Why two-way tokens keep the answer usable, and what that costs.
Company
It started with a problem we kept seeing.
AI note takers in every meeting, client files pasted into chat assistants, and organisations that could not adopt any of it because of what the data contained.
An engineer and a lawyer, we saw the same picture from both sides. Teams were already using the best models on real work with no protection at all, because every “safe” alternative was too weak to be worth using. Regulated organisations either looked away or stayed out. Salus was built to remove that choice: the best models available, working on real files, without ever learning who the files are about.
The same problem exists wherever data is sensitive and regulated: banks, telecom operators, insurers, law firms. Salus is built for them, in every language their teams work in. In test with large regulated organisations in Türkiye.
- Language model training and evaluation
- Rust systems and enterprise platforms
- Telecom and banking delivery
- KVKK, contracts and compliance
- Regulated-sector operations
Meet the founders
Software engineer since 2015 and the architect of the detection stack: trains and evaluates the models, owns the benchmarks and the release gates. Previously built AI agent products at Fundamental Research Labs, a San Francisco AI company. Founded Paramosoft in 2020, consulting on cybersecurity and fraud compliance for a participation bank’s digital channels.
Fifteen years building and running enterprise platforms. Wrote the Rust services behind detection, verification, redaction and restore. Before Salus: CRM modernisation and e-SIM provisioning at a national mobile operator, CPaaS microservices at Netaş, technical lead of a video-marketing SaaS. M.Sc. Computer Science.
Salus is a product of Paramosoft Yazılım Hizmetleri Ltd. Şti., Istanbul (est. 2021) · Istanbul and Berlin.
Pilot
Start with one team, one workflow, your own data.
A focused pilot is the fastest way to see what Salus catches in your traffic, and what it hands to the model instead. Tell us the workflow and we will set it up with you.
[email protected]