The privacy layer between your people and AI

Use any AI. Keep your people private.

Names, IDs and contact details become tokens before a prompt or file reaches the model, and come back in the answer — a PII gateway for LLMs, hosted in the EU.

Invented example. Pseudonymisation, not anonymisation.

One field to deploy

Change the API address. Your SDK, provider and prompts stay as they are.

Hosted in the EU

Hosting and every sub-processor in the EU or EEA.

Nothing from requests kept

The mapping travels with the request and stays with you.

Priced per character

No limit on users, no seat fee, the same quality on every plan.

one engine · two ways in

Start where your AI is already used.

for teams using AI chat

The browser add-on

Your people keep their chat window. Personal data is masked before Send and put back in what comes back.

  • Masks before Send, by keyboard or mouse.
  • A file is previewed before it is attached: click a mask to remove it, select text to add one.
  • A file the chat gives back is restored in your browser.

Get the add-onWith every paid plan

for developers & AI agents

The API gateway

Put OBVELO in front of the model your product already calls. Change one base URL, keep your SDK and your provider key.

client = OpenAI(
    base_url="https://api.obvelo.com/v1",
    default_headers={"x-obvelo-key": os.environ["OBVELO_KEY"]},
)
  • Chat, messages and responses APIs, and MCP for agents and their tools.
  • One person, one token across turns. Thread IDs and cursors are left alone.
  • Word, Excel, PowerPoint and email keep their format. A PDF or a scan comes back as masked text.

Read the docsSDKs for TypeScript, Python and .NET

Built for regulated work: Healthcare → Public administration →

files, ai agents and mcp

Documents stay documents. Agents keep their structure.

Masked inside the file. Word, Excel, PowerPoint and email come back in their own format, the author and comments included. A PDF or a scan comes back as masked text.
Safe for agent loops. Tool results are masked value by value; IDs, threads and cursors pass through, so the agent keeps working.

how pseudonymisation works

The model keeps the context. You keep the person.

01

Detect

Rules for national IDs, health numbers and bank details across jurisdictions, and a name model that runs inside our network.

02

Replace

Each value becomes a token. The same person keeps the same token, inflected or shortened. [Person 1]

03

Restore

The answer comes back with the real values in place, from a mapping that stays with you.

Try it on the live gateway

text only · up to 500 characters · examples left today: 3

your application sends
0/500 characters

Edit the invented example, or paste your own made-up text, then send it through the real engine.

the model receives

The masked text appears here — exactly what a model would receive.

0 values replaced · one person, one token · namespace hidden on screen, hover a token to see it whole

your application gets back

The same text, restored from the mapping in the answer.

Restored from the mapping you keep — pseudonymisation, not redaction.

The text goes to the gateway, is masked by the full engine — 668 rules and the name model — and comes back; nothing from it is stored. The demo is limited to 3 examples a day per visitor and to short texts; your own lists, files and full-length requests need an account. Please use invented data. Business references such as ACC-448120 stay readable on purpose: they identify a file rather than a person, and the model needs them to answer. Your own formats can be added to the list of values to mask.

Pricing

EUR, net · billed per character · pay yearly and save 10%

free

0EUR / mo

1 M characters · 60 req/min · 1 key · unlimited users · traffic stops at the cap · no card

Start free

paid plans

starter

49EUR / mo

or 529.20 EUR / year, billed annually — save 10%

characters10 M
overage 1M5.90
req / min300
keysunlimited
usersunlimited
own formatsyes
any provider via proxyyes
OCR pages / mo1 000
self-hostedon request
Choose starter

standard

119EUR / mo

or 1285.20 EUR / year, billed annually — save 10%

characters50 M
overage 1M2.90
req / min600
keysunlimited
usersunlimited
own formatsyes
any provider via proxyyes
OCR pages / mo3 000
self-hostedon request
Choose standard

pro

349EUR / mo

or 3769.20 EUR / year, billed annually — save 10%

characters200 M
overage 1M2.20
req / min3 000
keysunlimited
usersunlimited
own formatsyes
any provider via proxyyes
OCR pages / mo10 000
self-hostedon request
Choose pro

enterprise

By contract.

Contact us

Pay for a year, pay 10% less. Starter, Standard and Pro can be paid annually: twelve months at the monthly fee less 10%, invoiced and paid up front. You choose monthly or annual when you open the account and whenever you change plan; a change of billing period takes effect when the current period ends. Free has nothing to discount, and Enterprise and self-hosted installations are on an annual contract agreed with you.

No user limit on any plan. A plan limits the number of keys — systems — and the volume of characters, never the number of people. The browser add-on comes with every paid plan, with no seat price.

The hard cap is on by default. Traffic stops rather than producing an invoice you did not expect; you switch overage on deliberately.

Your own provider key on every plan (BYOK). Through the SDK you call any model provider on any plan. Through the proxy, traffic on Free goes to the instance's provider; on every paid plan you set your own provider address per key.

Every feature is on every paid plan. From Starter up, custom formats, agent loops, a provider address per key, the browser add-on, OCR and any number of keys are included; plans differ in volume only — characters, the price of a character above them, requests a minute and the size of a request.

Scans are billed as text. OCR reads a scanned page and the characters it finds count towards your plan like any others; the page figure on a card is a monthly cap that protects the reading service, not a price.

Detection quality is identical on every plan. A cheaper plan is less volume, never weaker protection. The free plan needs no card.

See exactly what reaches the model.

Try it free, or tell us what you need — pricing, running it in your own infrastructure, a pilot on your documents.