Cloakwall

PII/PHI redaction and tamper-evident audit logging for LiteLLM. Runs in-process — no sidecar container, no external endpoint, no model download.

LiteLLM's open-source guardrail framework supports custom guardrails plus Presidio, but Presidio means deploying and maintaining two extra containers, and audit logs, SIEM export and SSO sit behind the Enterprise licence. Cloakwall gives you redaction and a compliance-grade audit trail as one dependency-free plugin.

guardrails:
  - guardrail_name: cloakwall
    litellm_params:
      guardrail: cloakwall.guardrail.Cloakwall
      mode: pre_call
      default_on: true
      redaction_mode: mask
      audit_path: /var/log/cloakwall/audit.log

user:  "Patient MRN: A1234567, email bob@clinic.org, card 4111111111111111"
model: "Patient <MRN>, email <EMAIL>, card <CARD>"

Install

pip install litellm
git clone https://github.com/Rishikesh-glitch/cloakwall.git
PYTHONPATH=./cloakwall litellm --config cloakwall/examples/config.yaml

Or run the container:

docker build -t cloakwall .
docker run -p 4000:4000 -e OPENAI_API_KEY=sk-... cloakwall

What it detects

Email, credit cards (Luhn-validated), SSN, IBAN, AWS keys, API keys, JWTs, medical record numbers, NHS numbers (modulus-11 validated), phone numbers including international formats, IPv4, and dates of birth.

The validators matter more than the patterns. Without a Luhn check every 16-digit order number gets flagged; without the NHS checksum every US phone number gets labelled a health identifier. Both are the reason teams turn regex redaction off after a week.

Three redaction modes

hash is deterministic under a local HMAC secret set with CLOAKWALL_SECRET. Same person, same token, every request. Without a secret one is generated per boot, so tokens are stable within a run only.

Audit trail

Every entry commits to the SHA-256 of the entry before it. Editing or deleting any line breaks the chain and verification names the line:

chain intact
line 3: entry altered after writing

The log records which entity types were found and how many. It never records the values that were redacted — an audit log that quotes the PII it scrubbed is a second copy of the problem.

SIEM export

export CLOAKWALL_SIEM=splunk          # splunk | datadog | elastic
export CLOAKWALL_SIEM_URL=https://splunk.internal:8088/services/collector
export CLOAKWALL_SIEM_TOKEN=...

Export runs on a worker thread. A slow or unreachable SIEM never adds latency to, or fails, an LLM request — the local log is the system of record.

Air-gapped

The core is pure standard library. Nothing in the redaction, audit or hashing path opens a socket, so it runs unchanged in an isolated cluster. Point LiteLLM at a local vLLM or Ollama endpoint and no data leaves your network at all.

Verify it yourself:

strace -f -e trace=connect python3 tests/test_cloakwall.py

Tests

python3 tests/test_cloakwall.py     # 31 tests, no pytest required

Limitations

Regex detection does not catch contextual PII — a person's name in free text, or a medical condition described in prose. If you need that, Presidio's NLP models are better and Cloakwall is not a replacement for them. What Cloakwall gives up in recall it gains in having no dependencies, no sidecar and no model to ship into an air-gapped environment.

Redaction is one-way. There is no un-redaction path, by design.

Status: working, tested, not yet run in production anywhere.

Licence

AGPL-3.0. Commercial licences for closed-source use are available.