Chat Guardian: Service Description for GRACE
Safe Online · prepared for 2021.ai · July 2026
Service description
Chat Guardian is a risk-detection service that screens content for personal data before it reaches a language model. Like the other services on GRACE it runs as a containerized application with its own API, so it can be embedded in the LLM API or called independently by any service that needs a risk verdict.
Each prompt is passed to Chat Guardian before the LLM receives it. The service returns a verdict, and only content that passes is forwarded. Content in which personal data is detected is stopped, and the user is informed that the request cannot be forwarded to the model.
The detection engine is the same one used in Safe Online's DataMapper product, repackaged for local execution. It runs as a pipeline: language recognition, entity recognition for structured identifiers, keyword indexing and candidate extraction, context analysis, and confidence scoring. Structured identifiers — national personal identity numbers, passport numbers, driver's licence numbers, payment card numbers and tax identification numbers — are recognized by country-specific format rules and validated by checksum where the format permits. The Danish CPR number, for example, is validated against its Modulus-11 checksum, so a string that merely resembles a CPR number does not produce a finding. Special categories of personal data under GDPR Article 9, and criminal-offence data under Article 10, are handled differently: the text is indexed and matched against per-language keyword dictionaries covering health, ethnic origin, religious beliefs, political beliefs, trade union affiliation, race, sexual orientation and criminal offences, after which the context surrounding each match is analysed to establish whether the keyword is used in a sensitive personal sense or a generic one. A keyword match on its own is not treated as a finding.
Importantly, no external service is contacted at any point in this process. Both the embedding model and the scoring model run locally within the container; the cloud embedding service used by DataMapper has been replaced by a local open-source model. No prompt, no document and no extracted text leaves the customer's environment, the service operates without an internet connection, and results are not persisted to any database — each request is evaluated and discarded. Because the service holds no state between requests, it scales horizontally and can be replicated behind the LLM API without coordination.
Chat Guardian is delivered as a self-contained Linux x64 build and is driven by configuration: the countries whose identifier formats should be active, and the languages whose keyword dictionaries should be loaded. The current release covers structured identifiers for the nine countries supported in DataMapper, and Danish and English keyword dictionaries for the special categories.
Current release and roadmap
The present release accepts text input and returns a binary verdict: content is either approved and forwarded to the model, or rejected and not forwarded. Rejection is unconditional — there is no user-override path in this release, and the verdict does not identify which category or entity triggered it. Planned for the following iteration: processing of file attachments using local OCR, a detailed verdict identifying risk type and triggering entity, per-deployment keyword customization, and a configurable policy allowing a warning with user confirmation as an alternative to unconditional blocking.