← Research
·10,663 words·85 sources

Privacy Gateways and PII-Redaction Layers for AI Coding Agents

A market map of every product claiming to keep source code private from AI coding assistants — and the five-property intersection none of them occupy.

AI PrivacyCoding AgentsRegulatoryMarket Analysis

Published by Arif Adito

Privacy Gateways and PII-Redaction Layers for AI Coding Agents

Verdict up front. A local-first, reversible-tokenization proxy purpose-built for Claude Code is a real gap — a productization gap, not an invention gap, and real only inside four conditions that can be stated precisely. The redaction-and-restore algorithm for Claude Code's exact wire format has been independently implemented at least five times, one of them validated live against Anthropic's API with restoration disabled to prove the provider received only placeholders [1] [2] [3]. What does not exist anywhere in the record, as of August 2026, is a product combining coding-agent-specific reversibility with local-first architecture and the enterprise packaging a regulated bank's procurement function requires.

The four binding conditions: (1) architecture — a network proxy at ANTHROPIC_BASE_URL, complemented by but never replaced with Claude Code hooks, and never a third-party cloud gateway; (2) scope — secrets and structured identifiers at high confidence, names and contextual personal data explicitly best-effort, because the best independent benchmark of open-source detectors reports an average F1 (the harmonic mean of precision and recall) of 0.542 and near-total collapse on non-Latin scripts [4] [5]; (3) buyer — Pakistan first (two independent regulatory hooks, one mandatory), Indian telecom licensees second (an absolute licence-level transfer ban), Bangladesh third (loud regulator demand, no statutory hook, so the pitch inverts to approval-enablement); (4) business model — a regional regulated-vertical wedge whose realistic endgame is acquisition or partnership, not global horizontal scale.

Remove any one condition and the adversarial case wins. The strongest surviving objection is not technical: certification, support and per-jurisdiction compliance packaging — the cost structure that makes this niche unattractive to Palo Alto and SentinelOne — is the cost structure a small entrant must also pay. The window is two to three years, and the kill criteria are stated in advance.

1. The Solution Landscape: Open-Source and Commercial Privacy Layers

A privacy gateway sits between a developer's machine and a model provider's API and inspects what is about to leave. Tools either block the request, redact it (a card number becomes a placeholder), or tokenize reversibly — placeholder out, real value restored on the way back, so the terminal still shows working data. DLP (data loss prevention) is the enterprise category these descend from; PII means personally identifiable information. Sort the market by where in the traffic path a tool sits: placement determines what it can physically see and physically rewrite.

1.A. Five architectural families

Detection libraries. Microsoft Presidio is the baseline — MIT-licensed, spanning analyzer, anonymizer, image redaction, structured data and a CLI [6], now moving to independent community governance [7]. Its reversibility is narrower than integrators assume: only encrypt has a matching decrypt, while replace, redact, hash and mask are one-way, and Presidio "does not store or maintain stateful sessions," so referential integrity across calls is the caller's problem [8]. OpenAI's Privacy Filter is the other substrate: a 1.5-billion-parameter sparse mixture-of-experts token classifier, 128,000-token window, Apache-2.0 [9].

LLM gateways with guardrail plugins. LiteLLM, Kong, Cloudflare, Portkey, TrueFoundry and Bifrost share one shape: proxy the provider API, attach a detection plugin, act on findings. LiteLLM's catalogue is broadest — Presidio, Lakera, Bedrock, Pangea, Model Armor, plus a hide-secrets type [10]. Portkey substitutes numbered placeholders such as {{EMAIL_ADDRESS_1}} that preserve referential identity within a conversation, but states twice that "redaction is irreversible by design" [11]; TrueFoundry writes generic asterisk masks that make two distinct values indistinguishable to the model [12]. Bifrost is the most sophisticated, offering runtime_reversible, where the mapping is stored encrypted alongside the log row behind a reveal permission and never exported downstream [13].

Enterprise vaults and AI-DLP platforms. Skyflow's LLM Privacy Vault is the clearest production-grade reversible tokenization in the corpus: deterministic tokens, detokenization on the response path gated by fine-grained access control [14]. Nightfall's own Anthropic sanitization tutorial exposes masking parameters but no reversible detokenization in the same flow [15]. Zenity announced Cursor, Claude Code and Copilot coverage in January 2026 and can "redact outputs, block a coding assistant call, or present in-context guidance," but frames the problem as MCP governance and prompt injection, not tokenization [16]. Prompt Security, the other coding-assistant-native vendor, was absorbed into SentinelOne on 5 September 2025 [17].

Claude Code hooks and plugins. cc-redact does one-way type-preserving redaction of ENV, JSON, YAML and TOML at Read time [18]. claude-code-privacy-guard blocks rather than rewrites, because "Claude Code's UserPromptSubmit hook API doesn't support rewriting or replacing the prompt" [19]; claude-code-redaction-hooks states that reversal "is not currently possible" [20]. Three authors converging independently on non-reversible designs is three discoveries of the same API constraint.

Local network proxies at ANTHROPIC_BASE_URL. The family that addresses the question, hobbyist-tier by adoption. PrivAiTe scans message content, tool-call arguments parsed as JSON down to bare numeric leaves, and multimodal text, restoring real values on the return path including in streaming responses [1]. rdx does the same interception with deterministic SHA-256 tokens and a reverse map held only in process memory [2]. claude-privacy-tool runs Privacy Filter fully offline with mappings encrypted on local disk at 0600 [3]. mcp-server-conceal is a Rust MCP proxy doing one-directional Faker substitution [21]. Commercially, anonym.legal ships a hook-based tokenize/detokenize pair with session-scoped reversibility [22], and Sonomos ships on-device one-way redaction in Locke 1.0 while stating that "reversible tokenization is planned shortly after 1.0" [23].

1.B. One substrate, one failure distribution

The diversity is packaging diversity, not detection diversity. Kong's PII Sanitizer calls an external anonymizer service [24]; TrueFoundry's guardrail is "powered by Azure AI Language PII Detection" [12]; Occludra's architecture diagram reads Your App → Occludra Gateway → Presidio (PII scan) → LLM Provider [25]. Nobody in the gateway tier builds proprietary named-entity recognition; they resell it. So when Presidio misses a name, four "competing" products miss it simultaneously — and when an independent benchmark finds Presidio failing 36% of reversibility round-trips because "its internal tokenization produces character offsets that do not precisely match the original text" [4], that defect propagates into everything that wrapped the framework instead of writing its own span aligner. Differentiation lives at the plumbing layer — where the scan runs, what surfaces it covers, whether it can restore — and at the detector, only if the entrant will build one.

1.C. The maintenance record of the purpose-built cohort

GitHub API metadata, rather than README claims, is unflattering. rdx was created 27 March 2026 and last pushed 31 March 2026 — four days of work, then dormancy, at 3 stars. claude-privacy-tool was created and last pushed the same day, 23 April 2026, at 14 stars. mcp-server-conceal has been dormant since 24 July 2025. Only PrivAiTe shows continuous investment — roughly 167 commits over three months, CI workflows, a security policy, a public benchmark repository — and it is three months old with one visible maintainer and 27 stars [2] [1]. Optimistically, four developers independently found the same unmet need in five months; pessimistically, a market with real pull produces sustained contribution and at least one commercial fork. What the record settles is that none is deployable by a regulated institution: no single sign-on, no role-based access control, no exportable audit trail, no SOC 2 or ISO attestation, no SLA, no company to hold liable.

1.D. Consolidation, and what the incumbents already claim

Palo Alto Networks announced its acquisition of Protect AI on 28 April 2025 at an intended price north of $500 million — a company that had itself rolled up Laiyer AI, SydeLabs, Rebuff and Huntr — and launched its own Prisma AIRS platform the same day, signalling that it is building in-house as well as buying [26]. SentinelOne completed its Prompt Security acquisition on 5 September 2025, and Portkey now brands as the PRISMA AIRS AI Gateway [17] [11].

The claim that most directly undercuts a "nobody serves Claude Code" pitch is already in market: Nightfall states it provides "real-time DLP built directly into developer tools including Cursor, Claude Code, and VS Code," monitoring "MCP requests, tool calls, and sensitive data movement in real time," and distinguishes itself from competitors that inspect MCP only at the network layer and "often miss local stdio workflows entirely" [17]. It is unverified against independent testing and specifies no mechanism. But a new entrant competes against the claim the buyer reads in the RFP response, not against a verified one.

1.E. Vendor-native controls: three products, three different holes

Claude Code. Commercial accounts are not trained on by default and standard retention is thirty days [27]. Zero data retention (ZDR — a contractual arrangement under which prompts and completions are not stored after the response returns) is sales-gated per organisation, not included in standard Enterprise [28]. Anthropic's eligibility table marks MCP connector, code execution, Files API, batch processing and managed agents ineligible for both ZDR and HIPAA readiness, with Claude Code itself listed under what HIPAA readiness does not cover; session transcripts cache in plaintext on local disk, defaulting to six years of local retention absent a custom setting [29] [27]. Enabling ZDR automatically disables Claude Code on the web, cloud sessions, Artifacts, feedback submission and remote control at the backend, regardless of what the client displays [28].

Cursor. Privacy Mode enforces zero-retention agreements across providers, but even with a customer's own key requests still route through Cursor's backend for final prompt building; only US residency is live; and single sign-on, bring-your-own-key, custom base URLs, MCP connectors and Slack-triggered agents are explicitly carved out of any residency guarantee [30].

GitHub Copilot. Content exclusion is a path-based glob list with zero content inspection — the REST API stores nothing but a repository-keyed JSON map of path patterns [31] — so it cannot redact anything inside an included file, and Copilot CLI and Agent mode in Chat do not support content exclusion at all [32]. The most agentic surface is the one the control does not reach.

1.F. The structure of the landscape

Counting products is the wrong instrument; a three-way filter is the right one. Filter for coding-agent traffic and Skyflow, Portkey and most AI-DLP vendors drop out. Filter for reversibility and Cloudflare, Portkey, Zenity, Nightfall and every hook-based tool drop out. Filter for local-first architecture and Cloudflare, Portkey and Kong's control-plane-dependent deployment drop out. What survives all three is a set of open-source projects whose combined star count is under seventy.

Capability and enterprise-readiness are anti-correlated here, and not accidentally. Occludra gates single sign-on, role-based access control, security-monitoring export and hash-chained write-once audit logging to a paid cloud tier, arguing those features need distributed shared state a single self-hosted node cannot provide correctly [25] — a competitor conceding, against its free-tier interest, that part of the enterprise checklist is architecturally hostile to purely local deployment. Any local-first product must accept a reduced checklist or design a control plane that distributes policy without distributing data.

2. Coverage of Coding-Agent Traffic: Streaming, Tool Calls, Code Context, and Reversible De-tokenization

A coding agent is not a chatbot with a code theme, and it differs in four ways that each map onto one rubric axis. It streams its response token by token over server-sent events (SSE), so output-side controls face a latency-versus-safety choice. It emits structured tool calls — JSON payloads instructing the harness to read a file, run a command, or query an MCP (Model Context Protocol) server — whose arguments carry data the visible message text never shows. It ingests code context: files, diffs, logs, stack traces, all out-of-distribution for detectors trained on prose. And the developer needs real values back, which is why irreversible redaction is a usability dead end here in a way it is not for chat compliance.

2.A. The rubric applied

Solution Streaming (SSE) Tool-call payloads Code context Reversible de-tokenization Deployment
PrivAiTe Restores in-stream; live-validated against the Anthropic API [1] Parses tool_calls[].function.arguments to bare numeric leaves Scanned, except system (CLAUDE.md) Yes — per-request in-memory mapping Local proxy / Docker
rdx Proxy at ANTHROPIC_BASE_URL [2] All API traffic; hooks mode adds per-tool rules Entropy + context detectors Yes — deterministic SHA-256, in-memory only Local proxy or hooks
claude-privacy-tool Hook + MCP, not a stream-path proxy [3] MCP server for Desktop, hook for Code 8 PII categories incl. IBAN Yes — mapping encrypted on disk at 0600 Fully offline
Claude Code hook tools n/a [20] PreToolUse stops an outbound tool call @file mention bypasses entirely No — "un-redacting responses not implemented" Local hooks
LiteLLM guardrails Tool-call response checks on streaming /v1/messages merged Dec 2025 [33] Yes, post-Dec-2025 Presidio-based; Claude CLI gets log-masking only [10] Partial — only tokens echoed verbatim Self-hosted
Kong AI Gateway Streams proxied and logged; prompt body limit 512KB [34] Not documented [24] Generic Yes — restoration, 17 entity categories Enterprise licence + cloud control plane
Cloudflare AI Gateway Buffers full SSE before scanning; time-to-first-token grows by full generation time [35] Raw JSON text only; base64 not decoded Official Claude Code integration [36] No — flag or block only Cloud edge (traffic transits Cloudflare)
Portkey / PRISMA AIRS Not documented Yes Generic, 5 detection backends No — "irreversible by design" [11] Cloud + self-host
TrueFoundry Skips output guardrails on stream: true [37] MCP pre/post-tool hooks [12] Generic No — asterisk masks Managed
Bifrost Buffers for output rules [13] Yes Names coding agents as its target gap Yes — runtime_reversible Self-hosted Go gateway
Skyflow LLM Privacy Vault Not documented for agents Not documented No IDE/CLI/code language Yes — deterministic, access-gated [14] Vault SaaS, 100+ country residency
Nightfall Claims real-time in-IDE [17] Claims MCP request/tool-call monitoring Claims developer-tool coverage Masking, not detokenization [15] SaaS + endpoint agent
Zenity Runtime mediation [16] Yes — MCP-centric Yes Not described SaaS
Sonomos Locke 1.0 On-device pre-egress Not specified Yes Planned, not shipped [23] On-device
Presidio n/a (library) n/a No code-specific recognizers Encrypt/decrypt only; 64% round-trip integrity [4] Library or HTTP server
Copilot content exclusion n/a n/a Path globs, no inspection [31] No GitHub-native; CLI/Agent unsupported
Anthropic ZDR n/a MCP / code execution excluded [29] Local plaintext transcripts persist n/a Contractual, sales-gated

In the reversible de-tokenization column the incumbent field collapses; in the coding-agent specificity column the reversible field collapses. Both collapses have mechanical causes.

2.B. Streaming: the asymmetry that decides the architecture

Compliance-grade output scanning does force buffering. Cloudflare states that DLP-scanned streaming responses are not delivered incrementally, so time-to-first-token grows by the full generation time [35], and a controlled 512-trial comparison quantifies the tradeoff: complete buffering and full-prefix scanning each detected 128 of 128 configured violations, while chunk-local scanning with no cross-chunk memory detected 38, missing two-thirds of boundary-spanning violations [38].

All of that concerns open-ended detection on generated output. A tokenization proxy's outbound problem is different in kind: replacing known placeholders with known originals from a mapping it created moments earlier — bounded string matching over a finite session-scoped token set, solved by holding back a few trailing characters so a placeholder cannot split across a chunk boundary, at effectively constant cost. PrivAiTe records exactly this, restoring values in content, tool calls, reasoning traces, refusals and audio transcripts, streaming included [1]. Detection on streams forces buffer-or-miss; restoration on streams is cheap, and that asymmetry is the mechanical reason incumbents fail coding agents where a tokenization proxy does not.

The inbound side bears the cost instead. Restoration carries no compliance weight — nothing leaks when a placeholder fails to restore; the user sees [EMAIL_1]. Inbound detection carries all of it: agent CLIs resend the entire conversation every turn, so without a detection cache per-request scrub time peaked at 42 seconds with Claude Code and 72 seconds with Codex, against a 1-to-3-second median with the cache enabled — and the cache retains salted hashes and span metadata for up to thirty minutes, a timing side-channel across shared credentials [1]. Those are user-experience costs paid before egress, not safety gaps.

Anthropic's protocol reference bounds the design from both sides. Claude Code counts every relayed byte including SSE ping and comment lines and aborts a stream silent for 300 seconds by default, so buffering for detection risks the abort during long thinking pauses [39]; the rollout checklist requires gateways to stream server-sent events without buffering, keep-alive pings included [40]. The vendor has specified away the buffering DLP architecture and permitted the holdback restoration architecture.

2.C. Tool calls: least protected, and not architecturally special

Agentic tool-call traffic is the least-protected surface across incumbents. Anthropic's ZDR states that "data processed by third-party tools, MCP servers, or other external integrations is not covered" [28]; Cursor carves MCP connectors out of its residency guarantee [30]; Kong's sanitizer documentation contains no tool-call handling [24]. LiteLLM only gained guardrail checks on tool-call responses across streaming /v1/messages in a pull request merged 15 December 2025 — reliable coverage for the exact protocol Claude Code speaks is roughly eight months old [33].

The engineering finding cuts against the fashionable framing. Once a proxy parses the body as JSON, tool calls are not architecturally distinct: of the PII PrivAiTe detects in plain text, 100% is also removed from tool-call JSON, so end to end its tool-call leak equals its detection misses [1]. Anthropic's own engineering writing describes a harness that tokenizes intermediate tool results before they enter model context and untokenizes them via its own lookup table — presented as something a developer building an MCP client must implement, not a shipped Claude Code feature [41]. There is no tool-call moat; there is a detection problem that surfaces in tool calls, which incumbents miss because they scan messages[].content and stop.

2.D. Code context: two blind spots that belong to the agent, and one audited absence

Two gaps are properties of Claude Code itself and cannot be engineered around at the hook layer. First, @-mention expansion bypasses every hook: Claude Code inlines the file contents into model context outside the hook pipeline, so the body never appears in UserPromptSubmit or in a PreToolUse/PostToolUse on Read, and the hook sees it only if the model echoes it back — by which time the leak has happened [20]. A second, independent codebase documents the identical failure [18]. Second, the system prompt is a live channel even the best proxy declines to scan: PrivAiTe passes the Anthropic system field through as-is, and Claude Code injects CLAUDE.md and project context there, so anything sensitive in project instructions reaches the provider unredacted by design [1]. Anthropic's changelog shows redaction work scoped to display and telemetry surfaces — terminal echo of MCP configurations, feedback and bug share bundles, OpenTelemetry log events — never to general PII on the outbound inference path [42].

Third, an audited absence: no benchmark measuring PII or named-entity detection precision and recall on a source-code corpus exists in the accessible literature. Secret-detection benchmarks cover secrets only [43]; every general PII benchmark uses prose or chat corpora [4] [44]. The mechanism for code-specific breakage is understood by analogy — a variable named bob_account_id sits squarely in the named-entity false-positive distribution — but has never been measured. The single most important axis for a coding-agent-specific product is the one on which nobody has published a number.

2.E. Reversibility: a solved primitive, an unreliable wired product

The vault primitive is mature. Presidio's deanonymizer walks entities backwards from the end of the text, because ciphertext is longer than plaintext and front-to-back processing would invalidate later offsets [45]; Skyflow detokenizes deterministically under access control [14]; Kong ships restoration [24].

What is unsolved is wiring it correctly into agentic streaming traffic. A filed and reproduced LiteLLM bug showed a Presidio guardrail masking a user's name in the gateway's own debug logs — "My name is <PERSON>" — while AWS Bedrock's model-invocation log, the actual wire record, carried the raw "My name is Bobby," and the model's response leaked the name back [46]. A gateway's own logs are not evidence that redaction reached the wire, and only one implementation in this corpus claims verification against the provider's received payload with restore disabled [1].

The best thing purchasable today is Kong — the only enterprise-licensed product combining restoration, streaming and a named Claude Code integration — and it loses twice for the target buyer: its own Claude Code tutorial configures the AI proxy and file logging without attaching the sanitizer plugin at all [34], and its deployment requires a cloud control plane, reintroducing the foreign-processor dependency the regulatory analysis shows to be disqualifying. The best thing that exists at all is a three-month-old repository with one maintainer.

3. Compliance and Data-Residency Requirements in Regulated Non-US Enterprises (Banks and Telcos, Especially South Asia)

Regulated buyers assess a control on two independent axes. Residency asks whether data may physically leave the jurisdiction and under what approval. De-identification credit asks whether transforming data before it leaves changes the legal analysis. Tokenization is a de-identification instrument that in some jurisdictions produces a residency result and in others produces nothing; averaging four countries into one requirement is what produces the inflated claims that discredit this category.

Jurisdiction / sector Binding instrument Cross-border posture De-identification hook Honest claim
Pakistan — banks SBP Framework on Outsourcing to CSPs (2023) Material offshore workloads need case-by-case SBP approval [47] Explicit. Section R names tokenization; CSPs must not access or control it "Satisfies Section R by construction"
Pakistan — telcos PTA CTDISR-2025, gazetted 29 Oct 2025 Critical infrastructure data stays in Pakistan absent prior written approval (Reg 83) [48] Explicit and mandatory. Reg 42(2)(i): licensee shall apply masking or pseudonymization "Implements a mandated control"
India — telcos DoT Unified Licence (to 31.03.2024) Absolute. 39.23(viii) bars transferring subscriber accounting or user information outside India [?] None needed — the prohibition is on the act "Keeps the prohibited payload off the wire"
India — banks DPDPA 2023 + DPDP Rules 2025 + RBI outsourcing direction Permissive default; transfer allowed until a restricting order issues [49] None. No pseudonymisation framework in the Act [50] Risk reduction only
Bangladesh — banks BB Cloud Computing Guideline (Mar 2023) Sensitive customer data cannot be hosted cross-border without prior BB approval [51] Permissive only. "May consider the use of appropriate masking" "Makes case-by-case approval winnable"
Bangladesh — telcos BTRC licensing guidelines No cross-border transfer restriction found [?] None Weakest case in the set
Singapore — banks MAS Outsourcing Guidelines (Banks), Dec 2023 Overseas arrangements must not impede MAS supervision [52] Partial. Anonymised/encrypted data excluded from "customer information" Scope reduction, not exemption
EU benchmark EDPB Guidelines 02/2026 (draft) n/a Adverse. Reversible schemes are pseudonymisation, not anonymisation [53] Never claim exemption

3.A. Pakistan: the architecture is named in regulatory text, twice

For banks, the State Bank of Pakistan's Framework on Outsourcing to Cloud Service Providers contains the single most useful sentence in this question. Regulated entities "may implement tokenization to minimize the data footprint," and "shall also ensure that the CSPs do not have access or control over the tokenization solution" [47]. The second clause is architecture-discriminating rather than merely permissive: a local proxy satisfies it by construction, while a cloud gateway — Cloudflare's edge, a hosted Kong control plane — hands the tokenization mechanism to precisely the class of provider the clause excludes. The same framework requires case-by-case SBP pre-approval before banks, microfinance banks and designated payment operators outsource material workloads offshore. Routing prompts and code context to a US-hosted LLM API is very likely material-workload offshore outsourcing, which makes the tokenization layer the lever that changes what must be approved.

For telcos, the Pakistan Telecommunication Authority's Critical Telecom Data and Infrastructure Security Regulations (CTDISR), gazetted 29 October 2025, are stronger because mandatory. Regulation 42(1)(f) requires data-privacy controls when deploying "chatbots, large language models (LLMs), generative AI tools, or equivalent technologies," and states that "uploading of sensitive data while using these technologies be avoided at all cost." Regulation 42(2)(i) uses shall: where PII or sensitive data is shared with external parties, the licensee "shall apply appropriate protection techniques, including but not limited to data masking, pseudonymization, or equivalent measures." Regulation 42(3)(a) names source code as a first-class DLP-protected category alongside PII, financial information and intellectual property, with monitored channels including collaboration tools and file transfer. Regulation 83 requires critical-infrastructure data to be stored and processed within Pakistan absent prior written approval, and Regulation 84 names "LLM/AI applications" among emerging technologies requiring a pre-deployment security impact assessment submitted to the Authority [48].

No clause names "AI coding agent," and none needs to. Those four clauses jointly imply — an inference, not a finding — that an engineer at a Pakistani operator running Claude Code against a codebase containing subscriber identifiers performs simultaneously an external share of PII, an upload of sensitive data to an LLM, an egress of source code through a monitored channel, and a cross-border processing event requiring prior written approval [48].

The counterweight is enforcement, not text. Pakistan has no enacted general data-protection law; domestic analysis notes the Personal Data Protection Bill "has not even passed yet," and the National AI Policy 2025's privacy provisions rest on non-binding guidelines with undefined enforcement [?]. Hook-rich, enforcement-thin.

3.B. India: the sector inversion

For banks the case is weak. Rule 15 of the DPDP Rules 2025 confirms a permissive default — transfer outside India is allowed unless the Central Government issues a restricting order, and none had issued [49] — with Section 16(2) preserving stricter sectoral rules [54]. The Act creates no sensitive-data category and "does not articulate any framework for anonymisation or pseudonymisation" [50]. Two supportive-sounding claims must be retired. "RBI credits tokenization" is a category error: the Reserve Bank's tokenisation regime is a card-payment scheme performable only by the authorised card network or issuer, with no textual bridge to AI data flows [55]. "RBI has AI rules" is premature: the operative instrument is a draft Guidance on Regulatory Principles for Model Risk Management released 24 June 2026 [56], whose substance is governance — board-approved frameworks, kill-switch arrangements, human-in-command oversight — and which reserves that "further requirements, if any, applicable to AI models may be issued later" [57]. Demand exists without a hook: RBI's FREE-AI committee survey found coding assistants listed among "applications under development," and 85% of respondents — 68 of 80 — asked for a regulatory framework, citing "use of external LLMs" and "cross-border data flow" [58].

For telcos, India flips to the strongest jurisdictional case in the question. Clause 39.23(viii) of the Department of Telecommunications Unified Licence — the contract every Indian operator signs — states that the licensee "shall not transfer the following to any person/place outside India: a. Any accounting information relating to subscriber (except for international roaming/billing)... and b. User information" [?]. Not a risk-tiered approval pathway: an absolute prohibition with two narrow carve-outs, enforced as a licence condition. Nothing in that clause mentions AI, which is what makes it powerful — an engineer in Mumbai pasting a subscriber-bearing log into an unproxied Claude Code session is not creating a supervisory finding, she is breaching a licence condition today, under text predating generative AI and therefore containing no AI-specific safe harbour. Adjacent clauses require that the chief security officer and core-network administrators be resident Indian citizens, so the operator of any gateway inside an Indian licensee is subject to personnel constraints: a local-first architecture the licensee runs itself is compatible; a managed service operated from abroad is not.

3.C. Bangladesh: the loudest demand, the weakest hook

The residency mandate does not live in the ICT Security Guideline, as is often assumed. Version 4.0 (2023) contains no residency language, and its sole AI clause requires only that sensitive information be "challenging to reveal" within AI systems, with no mechanism specified [59]. It lives in the Guidelines on Cloud Computing of March 2023: customers' financial and other sensitive data "cannot be hosted in cross-border public/hybrid cloud," and in exceptional cases only "subject to the prior approval of Bangladesh Bank." The same guideline classifies national identity number, date of birth, passport, taxpayer identification number, credit-card data, biometrics and bank account numbers as Sensitive PII requiring classification before any cloud migration, and requires disclosures of PII to third parties to be recorded — what, to whom, at what time — subject to prior Bangladesh Bank approval [51]. That recording duty reads directly onto sending code context to a third-party LLM API. But the only masking clause is permissive and narrow — the organisation "may consider the use of appropriate masking where the risk of data confidentiality breach is high" — and never mentions tokenization, reversibility or AI traffic.

That gap is what the June 2026 action reportedly patches. On 28 June 2026 Bangladesh Bank is reported to have ordered officials and employees to stop inputting confidential or sensitive banking information into AI platforms, effective immediately, naming ChatGPT, Gemini, Claude, Grok and DeepSeek, requiring prior approval for official AI use, extending to personal use of work information, and citing the risk of transferring financial data outside the country. This must be labelled honestly: the item is a secondary aggregator's rewrite; the primary circular appears to have been an internal office order with no public publication, and the originating newspaper article was unreachable at fetch time. Treat it as medium confidence pending primary text [60].

At face value it is the most concrete demand evidence in the question — a central bank acting as though vendor-native controls do not resolve its concern, with no carve-out for regional hosting or zero-retention agreements. Read adversarially, it is worse than neutral: "no confidential data in AI tools regardless of platform," plus prior approval before any official AI use, plus no personal-use exemption, is a purchasing freeze on the category that includes the proposed remedy, whose only opening — undefined case-by-case approval — is a bespoke, relationship-driven sale rather than a product motion.

Nor is there a statutory hook. No tokenization or pseudonymisation concept exists in any Bangladeshi instrument, and the Personal Data Protection Ordinance 2025 is organised around a four-tier classification with localisation for the sensitive tiers, not around de-identification [61]. Paying foreign vendors was never the blocker — Bangladesh Bank opened outward remittance for cloud services in October 2024; only sensitive-data hosting is residency-gated [62].

The loudest demand signal and the weakest legal hook coincide in one country, so the pitch must invert. In Pakistan it is "this control is named in your regulator's text." In Bangladesh it is "this produces the recorded, auditable evidence of what left and in what form, so your case-by-case approval becomes answerable."

3.D. The comparators: Singapore's carve-out and the EU's closing door

Singapore's Monetary Authority supplies a real but narrower hook. Footnote 4 of its Outsourcing Guidelines defines customer information as excluding data "anonymised or encrypted in a secure manner such that the identities of the customers cannot be readily inferred" [52] — a scope reduction out of one disclosure-control regime, not an exemption from data-protection law. Its December 2024 thematic review found Singapore banks already mitigating data-security risk through private clouds or on-premise servers, data loss prevention tools, limits on Generative AI access to sensitive information and "establishing input and output filters as guardrails," while naming Claude models explicitly [63]. A regulator observing that this functional slot is already filled with commodity tooling in the region's most mature market is both validation of the pattern and evidence against needing a bespoke product.

The EU is not a target market but is the benchmark sophisticated compliance functions apply, and two authorities pull opposite ways. The Court of Justice in EDPS v SRB (C-413/23 P, 4 September 2025) held that pseudonymised data is not automatically personal data for all parties: identifiability is assessed from the recipient's perspective, and if the recipient cannot realistically re-identify, the data falls outside GDPR scope in their hands — the strongest authority a tokenization vendor can cite, though the same analysis warns it is "not a blank cheque" [64].

Against it, the European Data Protection Board's Guidelines 02/2026 on Anonymisation — adopted 7 July 2026 for public consultation only, open until 30 October 2026 — state at paragraph 91 that "encryption is, by its very nature, intended to be reversible and differs from anonymisation," and require assessing whether entities with access could still decrypt "with means reasonably likely to be used, even if they do not currently have the decryption key" [53]. A token vault holding a reversal map is architecturally the same object, and the chain-of-means doctrine holds that an entity's means include "taking advantage of means that are available to another entity," so the test is not whether the LLM vendor holds the key but whether it could reasonably obtain it. Pseudonymised data shared with a processor remains personal data even where the processor cannot identify the individuals, to prevent controllers circumventing obligations by outsourcing to third parties lacking re-identification means [65] — exactly the structure of a bank sending tokenized code context to an LLM vendor. Paragraph 92 adds that re-identification is becoming cheap enough to run on commodity hardware and that agentic AI will further reduce the time and cost required [53]. Under EU-style reasoning, tokenization reduces obligations and risk; it does not reclassify data.

3.E. What vendor-native residency actually delivers

No-training defaults for commercial and API customers are real, and Claude is marketed into regulated finance with Claude Code bundled for modernising trading systems and automating compliance [66], so the "Anthropic bans regulated finance" objection does not survive contact with its own product page.

Residency is where the holes are. ZDR is not residency — "not stored" says nothing about where inference ran [67]. First-party controls offer us or global inference geography only, with US-only inference priced at a 1.1x multiplier and workspace storage at rest US-only and unchangeable after workspace creation [68]. There is no region inside Bangladesh or Pakistan at any hyperscaler; the nearest Claude-serving regions are Mumbai and Hyderabad — and the nearest option defaults wrong. Bedrock's promoted Global cross-Region inference dynamically routes requests from Mumbai to any commercial AWS region worldwide at no premium, while the Regional endpoint that pins processing carries a 10% premium and must be deliberately chosen; CloudWatch and CloudTrail record only the source region [69]. A bank that "chose Mumbai" has not achieved in-region processing unless it opted out of the default. For a Bangladeshi or Pakistani institution, Mumbai is in any case still cross-border, still requiring the prior approval the Bangladesh Bank cloud guideline and PTA Regulation 83 each demand [51] [48].

Write "South Asian regulators require local tokenization for AI tools" and you will be wrong in most of the cells that matter. The defensible claims are narrower and stronger: Pakistan has two independent hooks, one permissive for banks and one mandatory for telcos, both architecturally satisfied by a local proxy and violated by a cloud gateway; India's telecom licence makes unproxied coding-agent use a breach today; Bangladesh has regulator-level demand without a legal hook.

4. Is a Local-First Reversible-Tokenization Proxy for Claude Code a Real Gap?

"Is it solved?" collapses two questions with opposite answers. One camp says five people already built it; the other says nothing deployable exists. Both are right within their own boundary.

4.A. Solved in code; unsolved as a product

Does working code exist that does reversible tokenization for Claude Code traffic including tool calls and streaming? Yes. PrivAiTe validated end-to-end against the live Anthropic API with restore disabled and confirmed the provider received only placeholders, streaming included. Its live-agent benchmark is the strongest quantitative evidence in the field: bare Claude Code sent 24 of 24 planted PII and secret values straight to the provider; through the gateway, 0 of 24 reached the provider on a small fixture and 2 of 24 leaked on a larger realistic session. On a 458-item labelled benchmark its default preset reaches 84.9% span recall against LiteLLM's shipped Presidio guardrail at 70.3% [1]. Those figures are the project's own self-reported measurements; no independent reproduction exists anywhere in the record — itself a finding, and the correct posture toward the numbers.

Is it solved as something a regulated bank or telco could deploy and rely on? No, and not close. Three of four candidates are dormant single-burst projects, the survivor is three months old with one maintainer, and none carries the enterprise apparatus procurement requires. Even the healthiest self-discloses structural gaps — the unscanned system prompt; relayed-not-managed authentication, so an exposed port with gateway mode on is an open proxy driving requests on the provider account; the detection-cache timing side-channel; the measured 2-of-24 realistic-session leak [1]. Meanwhile the mainstream incumbent treats this traffic as second-class by default: LiteLLM's enterprise example routes by User-Agent so pre-call checks run for one client while Claude CLI gets "only masking in logs" [10] — in a product that has already shipped the masked-in-logs, unmasked-on-the-wire failure [46].

4.B. The interception contract is sanctioned, complete, and the only one that is both

Three independent evidence bases converge on the same architecture. From the hook-API side, Anthropic's reference states that UserPromptSubmit "can't replace the prompt; it only injects additionalContext alongside it," and directs redaction use cases to PreToolUse for outbound tool inputs and PostToolUse for inbound results; the rewrite channels that exist are updatedInput on PreToolUse and on PermissionRequest, and updatedToolOutput on PostToolUse, firing identically across terminal, IDE, Desktop and Claude Code on the web [70]. PreToolUse is also the only event that can stop a tool's outbound network call before it fires [20]. The prompt path is proxy-only; the tool path is not. Hooks complement the proxy; they never replace it.

From the security-boundary side, Claude Code's configuration-level deny rules govern only its built-in file tools and recognised Bash commands, not arbitrary subprocesses — demonstrated live by a one-line Python invocation printing a .env file past a configured deny rule. The sandbox, the real OS-level control, does not exist on native Windows, defaults to a read policy still exposing ~/.aws/credentials and ~/.ssh/, has a network filter that does not inspect TLS, and fails open when it cannot start unless explicitly configured otherwise [71]. Redaction at that layer inherits the same fail-open modes.

From the regulatory side, SBP requires that the cloud service provider not have access to or control over the tokenization solution [47], and PTA Regulation 83 requires prior written approval for cross-border processing of critical-infrastructure data [48]. A cloud gateway inserts a second foreign processor and is disqualified by construction; Cloudflare's integration is explicitly an edge proxy through which traffic transits [36].

The three lanes meet at a local network proxy at ANTHROPIC_BASE_URL — and that point is not a hack. Anthropic publishes a gateway protocol reference specifying API formats, headers that must forward unchanged, and streaming and keep-alive requirements [39], an admin rollout checklist [40], and a developer connection guide covering every surface [72]. The vendor has documented the doorway it does not itself walk through.

4.C. The empty intersection, verified from both sides

The gap is the intersection of five properties, and no product in the corpus holds all five as of August 2026: coding-agent-specific wire handling (Anthropic Messages format, tool-call JSON, streaming restoration); reversible de-tokenization with a locally held mapping; local-first architecture with no second foreign processor; enterprise packaging (single sign-on, role-based access control, exportable audit, an SLA, certification evidence); and regional compliance packaging mapped to named regulator clauses.

Every entity with coding-agent reversibility lacks the enterprise layer — PrivAiTe self-disclaiming "local pseudonymization, not anonymization" and "you remain the data controller," rdx dormant at three stars [1] [2]. Every entity with the enterprise layer lacks the capability or the architecture: Skyflow has reversibility and residency but no agent surface [14]; Kong has reversibility and a Claude Code integration but does not join them and needs a cloud control plane [34]; Cloudflare has the integration and no reversibility [35]; Portkey declares irreversibility a design principle [11]; Sonomos has reversibility on a roadmap [23]. The fifth property is the one no platform will supply for structural reasons: none advertises DPDP, Bangladesh Bank, SBP or RBI compliance packaging, and their architectures are cloud-transit by construction — exactly what SBP's CSP-lockout language disqualifies [17] [47].

4.D. Build versus assemble

Reusable without modification: Presidio's analyzer with country-scoped recognizers and multi-model batch processing [73]; its encrypt/decrypt operator pair [8]; the runtime_reversible design pattern, with encrypted mapping storage gated behind a reveal permission and excluded from downstream export [13]; the MCP tokenize/untokenize pattern as Anthropic documents it [41] [74]; and hook-based tool I/O rewriting where it complements the proxy [70].

Five things must genuinely be new. A code-domain fine-tuned detector, because fine-tuning lifts the ceiling — roughly 500 labelled English examples beat zero-shot general models, about 100 for non-English [5], and a fine-tuned LLaMA-3.1 8B reaches F1 0.9852 on binary secret classification over a source-code benchmark [75] — with Bangla and Urdu coverage off-the-shelf models demonstrably lack. An offset-exact reversibility layer, because building naively on Presidio inherits its 64% round-trip integrity [4]. A conversation-aware detection cache, because agent CLIs resend full history each turn. Continuous wire-drift verification: forwarding anthropic-beta and anthropic-version unchanged is load-bearing, since a gateway that rewrites bodies for content inspection breaks the header-to-body-field pairing and produces hard errors on the next capability release [39]; upstream error bodies must forward unmodified, because Claude Code's automatic recovery matches on error wording [40]; and the gateway path needs a web-application-firewall exemption, because prompt bodies carry XML-style tags and source code that trip cross-site-scripting rules [72]. The regulator-mapped audit export — hash-chained tamper-evident logging, SIEM export, key-custody documentation mapped clause by clause to SBP Section R and CTDISR 42(2)(i). That last item is not novel engineering. It is the actual product, dressed as a feature.

5. The Case Against Building It

Two of these arguments should change the product rather than the marketing. Each is followed by the boundary at which it stops applying.

5.A. Detection is the product, and detection is bimodal

The proxy is not the product; the detector is, and the independent evidence on detectors is bad. A practitioner benchmark of five open-source detectors across four datasets in two languages on a shared six-entity label set concludes: "none of these models are good. The best average F1 across four datasets is 0.542. Commercial systems claim 0.92-0.99. That is a big gap." Piiranha, trained on one PII corpus, scored 0.780 on it and 0.169 on financial text — a 78% out-of-distribution collapse [4].

Peer-reviewed evidence agrees. The first systematic third-party evaluation of OpenAI's Privacy Filter across 32 benchmarks in 14 languages found zero-shot F1 0.855 on its home benchmark but 0.04-0.40 on general named-entity benchmarks, with near-collapse on non-Latin scripts — Arabic 0.04, Cyrillic 0.03 [5]. No source measures that model on Bangla. But its model card states language coverage is "primarily English," with performance likely to drop on non-Latin scripts and on "uncommon personal names, regional naming conventions" [9], and the independent evaluation measures 0.03-0.04 F1 on the two non-Latin scripts it did test. Those two sourced facts jointly imply — as an inference, not a measurement — that a Bangla deployment for a Bangladeshi bank should be assumed near-blind until measured. Selling into Dhaka on an unmeasured detection stack is selling a defect.

On code the picture is bimodal in a useful way. Across nine secret-detection tools benchmarked against 818 GitHub repositories, none achieved both high precision and high recall: GitHub Secret Scanner led on precision at 75% with 6% recall, Gitleaks led on recall at 88% with 46% precision [76]. But fine-tuning closes it: fine-tuned LLaMA-3.1 8B reaches F1 0.9852 on binary secret classification [75]. The failure mode most specific to agent traffic is order-dependent and reproducible: secrets in log-shaped key=value lines are detected in isolation and missed once roughly one preceding line of log-shaped context sits in front of them [1] — and pasting raw application logs is the most common coding-agent traffic shape [77].

Boundary: this annihilates any product marketing "zero leaks" or "your PII never leaves," but does not touch a product scoped to secrets and structured identifiers with published recall numbers and named blind spots. The buyer's comparison is not against perfection but against 24 of 24 planted values reaching the provider unproxied [1].

5.B. Lossy restoration is worse in code than in chat

Presidio's 64% round-trip integrity composes with the coding-agent use case into a distinct failure class. A lossy restore in chat produces an awkward sentence; in a coding agent it produces a diff applied to a source file with a corrupted span — silently, inside a bank's codebase. It is fixable by post-processing spans to align with source text [4], but "fixable" means the builder owns a span-alignment layer the upstream framework does not provide.

Utility destruction is the mirror failure, and unmeasured on code. Type-based redaction is "context agnostic and may raise two issues: over disclosing untyped sensitive context and over removing answer bearing spans," backed by a 3,167-sample benchmark across 11 tasks where a contextual-integrity-guided rewriter achieves up to +10.1 average utility over on-device baselines at matched privacy [78]. Naive redaction of "Wire $X from John Smith's Goldman Sachs account to Jane Doe" collapses into "[PERSON]'s [ORG] account to [PERSON]," ambiguous about source and destination; unique numbered placeholders mitigate it [37]. For code, no tool in this corpus publishes a test result on whether redacted-then-restored code still parses or executes — the load-bearing product-quality question, launched unmeasured at a buyer segment whose procurement function exists to reject unmeasured claims.

Compliance value is a property of a specific regulator's definitional text, not of the technique. That text exists in SBP Section R and CTDISR Regulation 42(2)(i), and nowhere else among the target jurisdictions as a mandate [47] [48]. A total addressable market of "Pakistani banks and telcos with active Claude Code deployments" is not obviously venture-scale. Meanwhile the most-benchmarked analogous authority is moving to foreclose the argument for exactly the controller-to-processor flow this product creates, and says in the same instrument that agentic AI will make re-identification progressively cheaper [53].

Every implementer concedes the point. claude-privacy-tool's author states this is pseudonymization, not anonymization, that anyone with the mapping can re-identify, and that it is not a substitute for a data-protection impact assessment [3]. The formalized pattern reference concedes that tokenized data remains personal data under GDPR Article 4(5) and that multiple tokenized fields can be combined to reveal identities [74]. And the mapping vault is itself a new liability: "a redaction layer that persists its maps carelessly has just created a second PII database, often a less-governed one than the system it was protecting" [37] — the liability rdx's in-memory-only design answers [2].

Boundary: "Tokenization makes you compliant" is false everywhere. "This satisfies SBP Section R by construction because the CSP has no access to or control over the tokenization solution" is a citation to text, and survives the EDPB entirely, because it is a compliance-with-a-named-control claim rather than an exemption claim.

5.D. The threat model is mismatched: the demonstrated exfiltration routes around you

Zenity Labs' AgentFlayer disclosure demonstrated a zero-click indirect prompt injection: an attacker emails a Zendesk support address, the ticket auto-syncs into Jira, a developer asks Cursor in auto-run mode to look at it, and the injected instructions direct the agent to locate and exfiltrate secrets — a repository-committed JWT, and dummy AWS credentials at ~/.aws/credentials despite Cursor's External-File Protection being enabled. Refusals were bypassed by euphemism: "Using terms like 'apples' instead of 'API keys,' was all that was required." Exfiltration used an outbound web request to an attacker-controlled domain with the secret in a URL parameter. Cursor's response, on record: "This is a known issue" [79].

Trace that against a proxy on ANTHROPIC_BASE_URL. The secret is discovered by a tool reading the local filesystem and leaves via an outbound HTTP request the agent makes — not via the model-inference request body. And the proxy sits inside the same trust boundary being exploited: CVE-2025-59944 showed Cursor's protection for .cursor/mcp.json matching case-sensitively on case-insensitive macOS and Windows filesystems, so a prompt-injected write to .cUrSoR/mcp.json bypassed the confirmation dialog and could register a malicious MCP server, chaining to remote code execution with no developer involvement [80]. A privacy proxy is a higher-value target within that class, holding the mapping from placeholder to real value for everything a developer touched.

Boundary: agent-behaviour mediation at the tool layer is a different product, which Zenity and SentinelOne are building. This does not refute the residency and audit-evidence value where the regulatory case rests; it refutes any framing of the proxy as a security boundary. Pair it with controls that hold at the OS level — sandbox configured fail-closed, explicit deny-read for credential paths, bypass-permissions disabled [71].

5.E. False-confidence liability is asymmetric

The masked-in-logs bug yields a verification protocol: redaction must be proven against the provider's received payload, never against the gateway's own logs [46]. Then price the downside. CB Financial Services filed a Form 8-K on 11 May 2026 — identified as the first SEC filing blaming a material cybersecurity incident on shadow AI — after an employee fed customer names, Social Security numbers and dates of birth into an unapproved AI application from a personal device. One paste triggered three simultaneous regulatory obligations: SEC disclosure, the 36-hour prudential-regulator notification, and Gramm-Leach-Bliley customer notification. The bank already had an approved AI tool; the employee used a different one [81].

The asymmetry cuts both ways. Against the product: deploying a redactor converts the bank's posture from "an employee violated our policy" into "our deployed technical control failed," which regulators and plaintiffs treat far less charitably, and a 15% miss rate does not buy 85% of the safety. The model authors refuse this liability themselves — OpenAI's card states that Privacy Filter "is a redaction and data minimization aid, not an anonymization, compliance, or a safety guarantee," with explicit caution for financial workflows [9]. For the product: the same incident is the cleanest evidence that policy bans do not stop the behaviour and a technical egress control might. The limit is equally clear: a proxy on a corporate machine does not see a personal laptop, which is where that breach happened.

5.F. The maintenance tax against a moving target

Anthropic states plainly that it "doesn't endorse, maintain, or audit third-party gateway products," and that a gateway "becomes infrastructure your organization operates" [82]. The wire contract itself warns that "a gateway that rewrites or redacts request bodies for content inspection breaks the pairing the same way stripping does, so inspect without modifying" — the vendor's own protocol contract instructing gateways not to do the one thing this product must do, with hard 400 errors as the failure mode on the next capability release [39]. Hook payload schemas drift between releases with no release-note entry, forcing at least one project to ship a live verification harness [20]. And routing through a gateway costs an enforcement path outright: Anthropic's Server-Managed Settings, the option requiring no device management and working on BYOD machines, is explicitly incompatible with a custom ANTHROPIC_BASE_URL [83].

Boundary: a cost argument, not a viability argument. It sets a floor on engineering commitment and disqualifies anyone planning to ship and walk away — precisely why three of four open-source candidates went dormant. But a shared, versioned, continuously-tested wire-fidelity layer is exactly what enterprises pay for rather than maintain in-house.

5.G. Bans are not budgets, and the cost structure is symmetric

Bans do not create markets in the shape people assume. Samsung banned generative AI company-wide in May 2023 after an engineer leaked source code to ChatGPT, and JPMorgan restricted ChatGPT in February 2023, followed by most of Wall Street [84]. But the canonical resolution was not a redaction layer: Morgan Stanley "restricted public ChatGPT use for employees but partnered with OpenAI in 2023 to deploy a proprietary internal version" [85]. Banks respond to a ban by procuring a sanctioned deployment. And nothing in the record shows any South Asian bank or telco evaluating a coding-agent privacy proxy in a formal vendor-risk process — an audited absence rather than evidence of rejection, but an absence a business plan cannot assume away.

Then the decisive one: the same cost structure that excludes the platforms excludes a small entrant. A regulated bank's vendor-risk process is designed to reject exactly this shape of dependency — a young company, single-digit headcount, no certification, holding a decryption key for national-identity-class data. Building the certification layer to clear that bar is a multi-year, seven-figure exercise before first revenue, during which Nightfall, SentinelOne and Palo Alto ship "good enough" into the same accounts on existing paper [17] [26]. The buyer's shortlist is assembled by a security chief whose incumbent's answer to "do you cover Claude Code?" is already yes; whether that yes is technically equivalent is beside the point, because it is sufficient to avoid a net-new vendor-risk assessment, which is the actual competitor.

Boundary: the consolidation half refutes a global horizontal play completely and narrows the viable strategy to a regional regulated-vertical wedge with acquisition as the realistic endgame, because platforms' cloud-transit architecture is structurally incompatible with the CSP-lockout requirement that defines the wedge. The cost-symmetry half does not narrow: it is why the verdict is conditional rather than enthusiastic, and it converts "cannot secure a design partner within two quarters" into a kill criterion.

5.H. What the case collectively establishes

None of these arguments refutes the gap. Collectively they impose binding constraints: no global horizontal ambition; no "zero leaks" or blanket-PII marketing; no anti-training pitch, since commercial and enterprise accounts are not trained on by default [27]; no "tokenization makes you compliant" claim; build assuming Anthropic may close the hook and ZDR gaps, making residency, audit evidence and key custody rather than proxy-necessity the load-bearing value; and treat the proxy as one control among several rather than as a boundary. A product built inside those constraints is smaller and duller than the one a founder would prefer to build. It is the one the evidence supports.

6. Opinionated Synthesis

The gap is real; it is not the gap most people describe; and the conditions under which it is worth pursuing are narrow enough to state as a table and falsifiable enough to abandon on evidence.

6.A. The conditional verdict

Build — narrowly, conditionally, with the claims pre-committed. The decision holds if and only if all four conditions hold; violating one converts the build into one the evidence refutes.

Condition Why it binds
Local network proxy at ANTHROPIC_BASE_URL, optionally complemented by PreToolUse / PostToolUse hooks Only the proxy sees the prompt path; hooks cannot rewrite prompts but can rewrite tool inputs; config-layer controls are not a boundary; a cloud gateway inserts the second foreign processor the regulator excludes [70] [71] [47]
Scope: secrets and structured identifiers at high confidence; names and contextual PII best-effort and labelled as such Detection is bimodal — best open-source average F1 0.542, non-Latin collapse to 0.03-0.04, but fine-tuned code-domain secret detection reaches F1 0.985 [4] [5] [75]
Buyer order: Pakistan (either sector) → India-telco → Bangladesh-bank Pakistan has two explicit hooks, one mandatory; India-telco has an absolute licence prohibition; Bangladesh has demand and an approval process but no hook [47] [48] [?] [51]
Model: regional regulated-vertical wedge; endgame acquisition or partnership, not independent global scale The market is consolidating into platforms with distribution and certification a point tool cannot match — but their cloud architecture cannot satisfy CSP-lockout [26] [17]

Deprioritise Indian banks entirely: the DPDP Act gives nothing, RBI's tokenisation regime is a different regulatory object, and leading with a weak legal argument in the region's largest market poisons the well. If the conditions cannot be met, the alternative is not a smaller version of the same company; it is a secrets-only internal egress logger — regex plus validation and checksums, where detection genuinely performs near-ceiling — run as an internal tool, marketed to nobody, generating audit evidence while the regulatory picture resolves.

6.B. The pitch differs by country, and saying so is the credibility

  • Pakistan, telco: "Regulation 42(2)(i) says you shall apply masking or pseudonymization when sharing PII externally, and 42(3)(a) puts source code in your DLP scope. This implements both and produces the impact-assessment evidence Regulation 84 requires before you deploy an LLM application." [48]
  • Pakistan, bank: "Section R permits tokenization and requires that your cloud provider not control it. A local proxy satisfies that by construction; a cloud AI gateway does not." [47]
  • India, telco: "Clause 39.23(viii) prohibits transferring subscriber user information outside India, full stop. Your engineers perform that act every time they paste a log. This keeps the prohibited payload off the wire." [?]
  • Bangladesh, bank: "No clause says tokenized egress is compliant. What exists is a cross-border prohibition with a prior-approval exception, a duty to record PII disclosures to third parties, and a June 2026 order requiring approval before AI use. This produces the disclosure record that makes your approval request answerable." [51] [60]
  • India-bank, Singapore, EU: do not lead with compliance. Sell risk reduction and audit evidence, or do not sell [50] [52].

6.C. Claims permitted and forbidden

Permitted: satisfies SBP Section R by construction; implements CTDISR Regulation 42(2)(i); keeps subscriber identifiers off the wire; produces an exportable, tamper-evident record of what left and in what form; measured recall of X% on log-shaped agent traffic with these named blind spots.

Forbidden: "zero leaks"; "your PII never leaves"; "makes you GDPR-compliant"; "anonymises your data"; "stops Anthropic training on your code"; "South Asian regulators require this." The first two are refuted by the best implementation's own 2-of-24 realistic-session leak [1]; the next two by paragraph 91 of the EDPB draft [53]; the fifth by the no-training default [27]; the last by the fact that the mandate exists in one country's telecom regulation and nowhere else.

Two disclosures belong in the datasheet rather than the FAQ. The blind spots: @file expansion, unscanned system prompt and CLAUDE.md, local plaintext transcripts, and surfaces that cannot be gateway-routed at all — Claude Code in Slack and on the web are Anthropic-hosted, and the WebFetch domain-safety preflight always calls Anthropic directly regardless of gateway configuration [72]. And the verification protocol: proof against the provider's received payload, never gateway logs.

6.D. What the next two to three years change

Anthropic controls the timetable. Two product changes would materially weaken the thesis: extending ZDR to MCP and tool-call traffic, and adding a prompt-rewrite channel to the hook API. Both are plausible — the hooks surface has already gained a tool-input rewrite channel that did not exist when the first hook-based redactors concluded rewriting was impossible [70] — but the changelog contains zero occurrences of "PII" and zero of "zero data retention," with every redaction entry scoped to display or telemetry surfaces [42]. Note the asymmetry: a prompt-rewrite channel would weaken proxy necessity without weakening proxy sufficiency, and would not touch residency, audit evidence or CSP-lockout, which are the load-bearing parts of the regulatory case.

The regulatory trajectory is toward more hooks, not fewer. PTA already requires pre-deployment security impact assessments for LLM applications [48]; RBI has signalled that AI-specific requirements "may be issued later" while its draft model-risk guidance moves through consultation, with 85% of surveyed entities asking for exactly that guidance [57] [58]; Bangladesh's framework is still consolidating [61]. Each pending instrument is a chance to move a jurisdiction from demand-without-hook to hook — and the counter-risk is symmetrical, since a Bangladesh Bank circular carving out Bedrock-regional plus ZDR would eliminate the opportunity in a single document.

The substrate commoditizes while the adversary improves. Privacy Filter is Apache-2.0 and runs on a laptop, and fine-tuned XLM-RoBERTa surpasses its zero-shot performance with roughly 500 labelled examples [9] [5] — good for safety, bad for any startup whose only asset would have been the detector. Meanwhile the EDPB has stated in a regulatory instrument that agentic AI will reduce the time and cost of re-identification, and its chain-of-means doctrine counts capabilities a recipient could obtain rather than only those it holds [53]; composition effects already mean multiple tokenized fields can be recombined [74]. A tokenization product whose privacy claim is static will be less true in three years through no fault of its engineering, so the strength of the scheme has to be maintained — periodic re-assessment, token-space rotation, documented technical, organisational and legal barriers to re-identification — which is what the CJEU's reasoning requires organisations to document and revisit [64].

One further force is easy to misread as a competitor. Anthropic's code-execution-with-MCP architecture reduced token usage in its worked example from 150,000 to 2,000 — a 98.7% reduction — by having agents write code that filters intermediate results before they reach the model [41]. That moves more data handling into an execution environment the model never sees: simultaneously the best long-term argument for tokenization at the harness layer and a warning that the surface a network proxy sees may shrink as agents do more work locally.

The regulatory tailwind strengthens through 2027 while the vendor-native and platform headwinds strengthen too, which argues for a narrow, fast, evidence-led entry into a named vertical in a named jurisdiction, and against a broad platform ambition that would take three years to become defensible and meet Palo Alto and SentinelOne at the finish line.

6.E. Kill criteria

Abandon if: Anthropic extends ZDR to MCP and tool-call traffic and ships a first-party regional inference option covering South Asia; a certified enterprise gateway ships Claude-Code-specific reversible redaction in a self-hosted, control-plane-free configuration; the primary Bangladesh Bank circular turns out to carve out approved vendor-native configurations, dissolving the demand signal; a design partner in Pakistan or Indian telecom cannot be secured within two quarters; or measured recall on the target languages, Bangla included, cannot be lifted above the general-purpose baseline that independent evaluation already shows collapsing on non-Latin scripts. Strengthen to a firm go if: PTA or SBP issues guidance explicitly blessing a tokenized-egress configuration; a South Asian regulator publishes an approval decision naming the evidence it required; or an independent reproduction confirms coding-agent leak-benchmark results outside their author's own harness.

The single most valuable next fact is the Bangladesh Bank primary circular, because it determines whether the loudest demand signal in the region is a ban with a winnable exception path or a wall.

6.F. The verdict, restated

A local-first reversible-tokenization proxy for Claude Code is a real and currently unoccupied gap for regulated telcos and banks in Pakistan and for telecom licensees in India; a defensible but non-statutory opportunity in Bangladesh, where it sells an audit trail rather than a control; and a solved-or-unnecessary problem everywhere else, including for individual developers, for whom the existing open-source proxies are already a reasonable control. The technology is not the moat — five implementations prove that. The moat is the regulator-mapped audit evidence, the local-first architecture a cloud competitor structurally cannot copy, and the discipline to claim only what measured recall supports.

References

  1. GitHub - crp4222/PrivAiTe: Self-hosted PII redaction proxy for LLM APIs and github.com ↩
  2. GitHub - paroque28/claude-code-redact: Redaction proxy for AI coding tools github.com ↩
  3. GitHub - PasqualePillitteri/claude-privacy-tool: Mask personal data before github.com ↩
  4. Benchmarking Open-Source PII Detection Across Domains (1/2) | Albert Sikkema albertsikkema.com ↩
  5. [2608.02616] OpenAI Privacy Filter: A Cross-Lingual, Cross-Domain PII Evaluation arxiv.org ↩
  6. GitHub - data-privacy-stack/presidio: An open-source framework for detecting, github.com ↩
  7. Presidio is transitioning to a community-owned project - Presidio presidio.dataprivacystack.org ↩
  8. Presidio Anonymizer - Presidio presidio.dataprivacystack.org ↩
  9. openai/privacy-filter · Hugging Face huggingface.co ↩
  10. Guardrails - Quick Start | liteLLM docs.litellm.ai ↩
  11. PII Redaction - Portkey Docs portkey.ai ↩
  12. PII/PHI Detection Guardrail - TrueFoundry Docs www.truefoundry.com ↩
  13. PII Redaction at the Gateway Before Data Reaches Providers www.getmaxim.ai ↩
  14. Generative AI Data Privacy with Skyflow LLM Privacy Vault - Skyflow www.skyflow.com ↩
  15. Anthropic Prompt Sanitization Tutorial | Developer APIs | Nightfall Documentation help.nightfall.ai ↩
  16. Securing Agentic Coding Assistants from IDE to CLI | Zenity zenity.io ↩
  17. Best AI Agent Security & MCP Security Platforms for Data Exfiltration Prevention www.nightfall.ai ↩
  18. GitHub - ShindouMihou/cc-redact: Redact secrets from Claude Code - but keep github.com ↩
  19. GitHub - datumbrain/claude-code-privacy-guard: 🛡️ Claude Code plugin that github.com ↩
  20. GitHub - l-mb/claude-code-redaction-hooks: Hooks for Claude Code to prevent github.com ↩
  21. GitHub - gbrigandi/mcp-server-conceal: Privacy-focused MCP proxy that intelligently github.com ↩
  22. MCP Server - AI Privacy Protection | anonym.legal anonym.legal ↩
  23. Source Code in AI Coding Assistants: Keeping Secrets Out of Copilot, ChatGPT, sonomos.ai ↩
  24. AI PII Sanitizer - Plugin | Kong Docs developer.konghq.com ↩
  25. GitHub - occludra/gateway: Self-hosted AI security proxy. Redact PII, block github.com ↩
  26. Palo Alto Networks to acquire Seattle cybersecurity startup Protect AI – GeekWire www.geekwire.com ↩
  27. Data usage - Claude Code Docs code.claude.com ↩
  28. Zero data retention - Claude Code Docs code.claude.com ↩
  29. API and data retention - Claude Platform Docs platform.claude.com ↩
  30. Privacy and Data Governance | Cursor Docs cursor.com ↩
  31. REST API endpoints for Copilot content exclusion management - GitHub Docs docs.github.com ↩
  32. Excluding content from GitHub Copilot - GitHub Docs docs.github.com ↩
  33. Guardrails API - support LLM tool call response checks on `/chat/completions`, github.com ↩
  34. How to: Route Claude CLI traffic through AI Gateway and Anthropic | Kong Docs developer.konghq.com ↩
  35. Data Loss Prevention (DLP) · Cloudflare AI Gateway docs developers.cloudflare.com ↩
  36. Claude Code · Cloudflare AI Gateway docs (coding-agents integration) developers.cloudflare.com ↩
  37. PII Redaction in LLM Pipelines: Gateway Layer vs Application Layer — Latency www.truefoundry.com ↩
  38. Withholding the Completing Chunk: Deterministic Pair-Completion Guardrails arxiv.org ↩
  39. Gateway protocol reference - Claude Code Docs code.claude.com ↩
  40. Roll out an LLM gateway for your organization - Claude Code Docs code.claude.com ↩
  41. Code execution with MCP: building more efficient AI agents \ Anthropic www.anthropic.com ↩
  42. CHANGELOG.md raw.githubusercontent.com ↩
  43. [2303.06729] SecretBench: A Dataset of Software Secrets arxiv.org ↩
  44. SPY: Enhancing Privacy with Synthetic PII Detection Dataset - ACL Anthology aclanthology.org ↩
  45. Deanonymization | microsoft/presidio | DeepWiki deepwiki.com ↩
  46. [Bug]: Presidio guardrail doesn''t scrub effective request and response · github.com ↩
  47. State Bank of Pakistan — Framework on Outsourcing to Cloud Service Providers www.sbp.org.pk ↩
  48. Critical Telecom Data and Infrastructure Security Regulations 2025 (CTDISR-2025) www.pta.gov.pk ↩
  49. Rule 15 DPDP Rules 2025 – Transfer of Personal Data Outside India | DPDPA.com www.dpdpa.com ↩
  50. The Pragmatic Turn In Pseudonymization: What EDPS V SRB Means For Indian Data techlawforum.nalsar.ac.in ↩
  51. Guidelines on Cloud Computing - Bangladesh Bank (March 2023) www.bb.org.bd ↩
  52. MAS Guidelines on Outsourcing (Banks), December 2023 www.mas.gov.sg ↩
  53. Guidelines 02/2026 on Anonymisation, Version 1.0 (full text PDF) — European www.edpb.europa.eu ↩
  54. Digital Personal Data Protection Act, 2023 DPDPA SECTION 16 WITH INTERPRETATION www.dpdpa.com ↩
  55. Press Releases | Official Website of Reserve Bank of India www.rbi.org.in ↩
  56. Press Releases | Official Website of Reserve Bank of India www.rbi.org.in ↩
  57. RBI Draft Rules Push Kill Switches, Human Oversight for Bank AI Models www.medianama.com ↩
  58. RBI FREE-AI Committee Report — Framework for Responsible and Ethical Enablement rbidocs.rbi.org.in ↩
  59. Guideline on ICT Security, Version 4.0, 2023 - Bangladesh Bank www.bb.org.bd ↩
  60. Bangladesh Bank Bans Confidential Data in AI Tools www.thrumos.com ↩
  61. Bangladesh’s Personal Data Protection Ordinance 2025: key takeaways | The www.thedailystar.net ↩
  62. Bangladesh AI Strategy: Cloud Computing vs Data Centres | The Daily Star www.thedailystar.net ↩
  63. MAS Information Paper — Artificial Intelligence Model Risk Management: Observations www.mas.gov.sg ↩
  64. In a Landmark Decision, EU Court Clarifies When Pseudonymised Data Is Not Personal www.skadden.com ↩
  65. Anonymity is in the eye of the beholder key takeaways from the EDPBs new anonymisation www.twobirds.com ↩
  66. Claude for Financial Services \ Anthropic www.anthropic.com ↩
  67. Claude is allowed in regulated finance, but it has no EU data residency - Amit amitkoth.com ↩
  68. Data residency - Claude Platform Docs platform.claude.com ↩
  69. Access Anthropic Claude models in India on Amazon Bedrock with Global cross-Region aws.amazon.com ↩
  70. Hooks reference - Claude Code Docs code.claude.com ↩
  71. Your Claude Code deny rules are not a security boundary - Amit Kothari amitkoth.com ↩
  72. Connect Claude Code to an LLM gateway - Claude Code Docs code.claude.com ↩
  73. Presidio Analyzer - Presidio presidio.dataprivacystack.org ↩
  74. PII Tokenization - Pattern www.agentic-patterns.com ↩
  75. [2504.18784] Secret Breach Detection in Source Code with Large Language Models arxiv.org ↩
  76. [2307.00714] A Comparative Study of Software Secrets Reporting by Secret Detection arxiv.org ↩
  77. [2512.18608] A Comparative Study of Light-weight Language Models for PII Masking arxiv.org ↩
  78. [2606.04067] Need to Know: Contextual-Integrity-Grounded Query Rewriting for arxiv.org ↩
  79. Security Research | AgentFlayer: When a Jira Ticket Can Steal Your Secrets labs.zenity.io ↩
  80. Cursor Vulnerability (CVE-2025-59944): How a Case-Sensitivity Bug Exposed www.lakera.ai ↩
  81. A bank breaks its silence on its shadow-AI breach | American Banker www.americanbanker.com ↩
  82. Other LLM gateways - Claude Code Docs code.claude.com ↩
  83. Enterprise Security for Claude: A Practical Governance Guide for Engineering www.truefoundry.com ↩
  84. Samsung Bans ChatGPT Among Employees After Sensitive Code Leak www.forbes.com ↩
  85. Companies Banning ChatGPT (2026): The Enterprise Security List moveo.ai ↩