Caveman.PrivacyGuard

Copy Link

With the mass adoption of Large Language Models (LLM) and generative artificial intelligence systems within enterprise software, developers face a crucial challenge: how to leverage the power of AI without compromising compliance and user data privacy? Accidentally sending a tax code, an IBAN, or an API access key to an external API can be costly, both in terms of reputation and monetary penalties (GDPR first and foremost). The solution is not to block innovation, but to implement a reliable on-premise security gateway.

Protecting Data in the AI Era: A Guide to Caveman.PrivacyGuard

With the mass adoption of Large Language Models (LLMs) and generative artificial intelligence systems within enterprise software, developers face a crucial challenge: how to harness the power of AI without compromising compliance and user data privacy?

Accidentally sending a tax code, an IBAN, or an API key to an external API can be costly, both in terms of reputation and monetary penalties (GDPR first and foremost). The solution is not to block innovation, but to implement a reliable on-premise security gateway.

Thus, Caveman.PrivacyGuard was born, a lightweight, lightning-fast, and configurable .NET 8 library specifically designed to detect, assess, and mask sensitive data before it leaves the corporate perimeter.

🌍 Universal Coverage: 27 EU Countries in One Single Tool

Validating sensitive data internationally has historically been a regulatory and technical nightmare. Each country has its own standards: the Codice Fiscale in Italy, the Steuer-ID in Germany, the NIR/SSN number in France.

Caveman.PrivacyGuard solves this problem natively. It includes pre-compiled rules for all 27 European Union countries, combining three levels of verification:

High-performance pre-compiled Regex.
Real algorithmic validators (e.g., Luhn for credit cards, IBAN MOD97, and national checksums).
Shannon entropy analysis to intercept high-density random strings (such as passwords and tokens).

⚠️ Legal Disclaimer: No software tool replaces the advice of a DPO (Data Protection Officer) or a formal DPIA, but PrivacyGuard provides the essential technical shield to enable Anonymization by Design.

📐 The Risk Architecture: The Privacy Score

Not all data leaks carry the same weight. Finding an isolated string that resembles an ID has a different impact than finding an entire block of text containing names, emails, and bank codes alongside the word "password".

For this reason, the library calculates a dynamic Privacy Score (0-100) based on a precise mathematical formula:

$$Final Score = (BaseScore \times CorrelationMultiplier) + (ContextBoost \times 12) + (DensityBonus \times 18)$$

Risk Threshold Matrix

Score	Level	Recommended Action
0-15	✅ Safe (AI Ready)	Direct submission to LLM without restrictions
16-35	⚠️ Low	Internal logging + monitoring
36-60	⛔ Medium	Mandatory anonymization before submission
61-85	🚨 High	Isolated sandbox or replacement with synthetic data
86-100	🛑 Critical	Absolute blocking of the request, on-premise processing only

🚀 3-Step Integration

The library is designed to be integrated in minutes into any ASP.NET Core or microservice ecosystem.

1. NuGet Package Installation

Bash

dotnet add package Caveman.PrivacyGuard

2. Multilingual Analysis at Runtime

The library can vary warning messages and context logic based on the request's language:

var analyzer = new PrivacyAnalyzer { EnableAutoMasking = true };

// Analysis in Italian

var resIt = analyzer.Analyze("CF: RSSMRA80A01H501U, email: test@x.com", "it");

Console.WriteLine($"[IT] Rischio: {resIt.RiskLevel}\n{resIt.WarningMessage}");

3. Auto-Masking for LLMs

The most powerful feature for those working with generative AI is contextual automatic masking:

var text = "Client: Mario Rossi, email mario@azienda.it, IBAN: IT60X0542811101000000123456";

var result = analyzer.Analyze(text);

Console.WriteLine(result.MaskedText);

// Output: Client: Mario Rossi, email [EMAIL], IBAN: [IBAN]

⚙️ Extensibility and Extreme Performance

Text analysis libraries often suffer from significant memory issues and slow down high-traffic workflows. Caveman.PrivacyGuard was created to overcome this problem by leveraging the latest optimizations of the .NET 8 ecosystem:

RegexOptions.NonBacktracking: Protects the application from ReDoS (Regular Expression Denial of Service) attacks.
Zero Redundant Allocations: Efficient memory processing to avoid impacting the Garbage Collector.
Thread-Safe: Optimized concurrency management using ReaderWriterLockSlim and internal regular expression caching.

YAML-Driven Customization

Internal rules are defined in an embedded rules.yaml file, but can be extended at runtime without recompiling the library. Custom validators can be registered in a few steps:

ValidatorRegistry.Register("MY_CUSTOM_ID", value =>

value.Length == 10 && value.StartsWith("XYZ") && value.All(char.IsDigit));

🔐 Ready-to-Use Compliance

Upon completion of the analysis, the PrivacyAnalysisResult object returns a set of ComplianceFlags that automatically link intercepted violations to international regulatory frameworks such as GDPR (Art.4), PCI-DSS (for financial data), and NIST 800-53. This allows corporate systems to route logs or block transactions based on internal compliance policies in a fully automated manner.

If you are developing an enterprise application based on LLMs, anonymization is no longer an option, but a fundamental requirement.

Caveman.PrivacyGuard is distributed under the MIT license. You can test it, customize it, and integrate it into your next .NET project today.

Technologies

.net

Resources

GitHub NuGet MIT

Visit Project

Related Projects