AI data masking inside your environment.
Herkus installs and validates the sensitive-data protection path inside the customer VPC. The customer selects the data, policies and AI provider; Herkus does not receive or independently process customer production data.
What stays customer-side
- Original personal, commercial and application-specific values
- Model and application credentials
- The mapping between original values and controlled substitutes
- Rules that decide whether a value may be restored
- Validation results and audit evidence for the protected call
What the external model receives
The model receives the masked representation and only the context approved for the task. For example, a request can replace a customer name, company, account reference and email address with consistent substitutes while preserving the relationships the model needs to draft a renewal summary.
The provider does not need the original values to perform that task. After the result returns, the customer-side path validates it and restores only the values allowed by policy.
Where the masking layer can sit
The integration point is selected around the real application. It may be placed in the application service, at a controlled API boundary or in a dedicated component inside the customer VPC. The right choice depends on the software architecture, provider interface, data formats, latency requirements and operating controls.
What Herkus handles
Herkus provides a custom implementation service rather than a public upload portal. We review one AI workflow, define the data boundary, adapt detection to the customer's languages, terminology and business entities, configure the protection policies, deploy the integration and validate the complete path with the customer team.
This approach is suitable for software companies, AI product teams, system integrators and enterprises that need to connect sensitive business text to an external model without building the entire masking layer themselves.
How the customer-side PoC works
- Select one representative AI-enabled application or workflow.
- Define the sensitive-data categories, languages, expected model task and boundary conditions.
- Prepare the customer-specific entities, masking, consistency, validation and restoration rules.
- Install the protected path inside the customer VPC.
- Run realistic tests and review both model usefulness and protection evidence.
The initial PoC request is sent by email. Do not include production data, credentials or sensitive samples in that message.
Frequently asked questions
What stays inside the customer environment?
The intended design keeps original sensitive values, customer credentials, replacement mappings, restoration decisions and audit evidence under customer control.
What does the external model receive?
The external model receives the masked content and only the context that the application has approved for the task.
Does a customer-side PoC require uploading production data to Herkus?
No. The PoC is installed and validated inside the customer VPC. Herkus does not receive or independently process customer production data. Initial email discussions should not contain production data, credentials or sensitive samples.
Related: what AI data masking means · PII masking before LLM calls · Herkus AI Data Masking
Bring one workflow. Herkus handles the masking details.
Tell us what the application does, what data it processes and which model it uses. We will define the customization scope and propose a VPC validation path.
Please do not send production data, credentials or sensitive samples by email.