Caveman.PrivacyGuard

Copy Link

With the mass adoption of Large Language Models (LLMs) and generative AI systems within enterprise software, developers face a crucial challenge: how to harness the power of AI without blowing up compliance and user data privacy? Accidentally sending a tax ID, an IBAN or an API access key to an external API can be costly, both in terms of reputation and financial penalties (GDPR first and foremost). The solution is not to block innovation, but to implement a reliable on-premise security gateway.

Protecting data in the age of AI: A guide to Caveman.PrivacyGuard

With the mass adoption of Large Language Models (LLMs) and generative AI systems within enterprise software, developers face a crucial challenge: how to harness the power of AI without blowing up compliance and user data privacy?

Accidentally sending a tax ID, an IBAN or an API access key to an external API can be costly, both in terms of reputation and financial penalties (GDPR first and foremost). The solution is not to block innovation, but to implement a reliable on-premise security gateway.

Enter Caveman.PrivacyGuard, a lightweight, blazing-fast, configurable .NET 8 library specifically designed to detect, assess and mask sensitive data before it leaves the corporate perimeter.

🌍 Universal Coverage: 27 EU Countries in a Single Tool

Validating sensitive data internationally has historically been a regulatory and technical nightmare. Every country has its own standards: the Codice Fiscale in Italy, the Steuer-ID in Germany, the NIR/SSN number in France.

Caveman.PrivacyGuard solves this problem natively. It includes precompiled rules for all 27 European Union countries, combining three levels of verification:

High-performance precompiled regex.
Real algorithmic validators (e.g. Luhn for credit cards, IBAN MOD97 and national checksums).
Shannon entropy analysis to catch high-density random strings (like passwords and tokens).

⚠️ Legal Disclaimer: No software tool replaces the opinion of a DPO (Data Protection Officer) or a formal DPIA, but PrivacyGuard provides the essential technical shield to enable Anonymization by Design.

📐 Risk Architecture: The Privacy Score

Not all data leaks carry the same weight. Finding an isolated string that resembles an ID has a different impact than finding an entire block of text containing names, emails and bank codes next to the word "password".

For this reason the library calculates a dynamic Privacy Score (0-100) based on a precise mathematical formula:

$$Final Score = (BaseScore \times CorrelationMultiplier) + (ContextBoost \times 12) + (DensityBonus \times 18)$$

Risk Threshold Matrix

Score	Level	Recommended Action
0-15	✅ Safe (AI Ready)	Direct submission to the LLM without restrictions
16-35	⚠️ Low	Internal logging + monitoring
36-60	⛔ Medium	Mandatory anonymization before sending
61-85	🚨 High	Isolated sandbox or replacement with synthetic data
86-100	🛑 Critical	Absolute request block, on-premise processing only

🚀 3-Step Integration

The library was designed to be integrated in a few minutes into any ASP.NET Core ecosystem or microservice.

1. NuGet package installation

Bash

dotnet add package Caveman.PrivacyGuard

2. Multilingual Runtime Analysis

The library can vary warning messages and context logic based on the request language:

var analyzer = new PrivacyAnalyzer { EnableAutoMasking = true };

// Analysis in Italian

var resIt = analyzer.Analyze("CF: RSSMRA80A01H501U, email: test@x.com", "it");

Console.WriteLine($"[IT] Risk: {resIt.RiskLevel}\n{resIt.WarningMessage}");

3. Auto-Masking for LLMs

The most powerful feature for those working with generative AI is automatic contextual masking:

var text = "Cliente: Mario Rossi, email mario@azienda.it, IBAN: IT60X0542811101000000123456";

var result = analyzer.Analyze(text);

Console.WriteLine(result.MaskedText);

// Output: Cliente: Mario Rossi, email [EMAIL], IBAN: [IBAN]

⚙️ Extensibility and Extreme Performance

Text analysis libraries often suffer from major memory issues and slow down high-traffic flows. Caveman.PrivacyGuard was built to avoid this problem by leveraging the latest optimizations in the .NET 8 ecosystem:

RegexOptions.NonBacktracking: Protects the application from ReDoS (Regular Expression Denial of Service) attacks.
Zero Redundant Allocations: Efficient memory processing so as not to impact the Garbage Collector.
Thread-Safe: Optimized concurrency management via ReaderWriterLockSlim and internal caching of regular expressions.

YAML-Driven Customization

The internal rules are defined in an embedded rules.yaml file, but can be extended at runtime without having to recompile the library. Custom validators can be registered in just a few steps:

ValidatorRegistry.Register("MY_CUSTOM_ID", value =>

value.Length == 10 && value.StartsWith("XYZ") && value.All(char.IsDigit));

🔐 Ready-to-Use Compliance

At the end of the analysis, the PrivacyAnalysisResult object returns a set of ComplianceFlags that automatically link intercepted violations to international regulatory frameworks such as GDPR (Art.4), PCI-DSS (for financial data) and NIST 800-53. This allows enterprise systems to route logs or block transactions based on internal compliance policies in a fully automated way.

If you are developing an LLM-based enterprise application, anonymization is no longer an optional, but a fundamental requirement.

Caveman.PrivacyGuard is distributed under the MIT license. You can test it, customize it and integrate it into your next .NET project today.

Technologies

.net

Resources

GitHub NuGet MIT

Visit Project

Related Projects