Inline AI data security · cloud data discovery

Catch sensitive data before it reaches your models.

Send AI requests through slim.io’s gateway and each one is scanned for PII, PHI, payment data and secrets before it is forwarded to OpenAI, Anthropic or Gemini, in under 50 ms server-side at P99 (measured: 42.7 ms). Findings are flagged by default and secrets are redacted; your rules decide what is redacted, masked, tokenized or blocked. Inline scanning is enabled per account.

Get a Demo Read the docs
Example data — scan of customer_records.txt
Scan Audit Policy
1Patient MRN: 4820571, phone +1 (416) 555-0142
2Card 4012 8888 8888 1881, DOB: 11/03/1978
3SIN 046-454-286, MBI: 1EG4TE5MK73
4Driver's License: A1234-56789-01234, IP 203.0.113.7
5IBAN DE89 3704 0044 0532 0130 00, email tom@acme.co
6Name: Sarah Kim, SSN 078-05-1120 (well-known test value, flagged)
Records scanned
14,832
PII detections
ssn412
credit_card89
email3,201
mrn892
iban156
phone1,044
Policy
3 policy violations
Two places to look

Customer records, medical data and financial information now travel to LLMs inside prompts, retrieved context and tool calls. slim.io scans that traffic inline, and scans the files at rest in your cloud, SaaS and database sources.

3Model providers behind the proxy: OpenAI, Anthropic and Gemini
<5 msMedian engine time per inline scan, measured
<50 msServer-side P99 for inline scans, measured
Inline scanning

AI requests, scanned inline by slimio.

Requests sent through slim.io’s proxy are scanned before they are forwarded to the model, and any text can be checked through the scan API. Inline scanning is enabled per account. Findings are flagged by default and secrets are redacted; your rules decide what is redacted, masked, tokenized or blocked.

EXAMPLE DATA POST /v1/proxy/{provider}/…
3,841 requests/hr 247 entities caught P99 <50ms server-side
Time
Source
Type
Action
ms
Entity Map
Waiting for intercept…
surface
policy
action
latency
18
Entity types in the catalog
16
Cloud, SaaS, and database connectors
3
Regulations with dedicated detection or workflows
7
Actions for AI gateway rules, from allow to block
Connectors

Scan where your data already lives

Point slim.io at cloud storage, SaaS apps, or databases. Cloud storage scans need no agent in your environment.

☁
Azure Blob
S3
AWS S3
G
Google Cloud
✉
OneDrive
SP
SharePoint
SF
Salesforce
▱
Slack
GD
Google Drive
PG
PostgreSQL
My
MySQL
❄
Snowflake
Or
Oracle
MS
SQL Server
D2
DB2
MT
Microsoft Teams
Db
Databricks
Detection

Context-aware PII detection

Not just regex. slim.io combines pattern matching with context-aware confidence scoring and checksum scoring (Luhn, mod-97, ABA) to reduce false positives.

Identity & Finance
SSN
SIN
Card
IBAN
SWIFT
Routing
Passport
DL
Health & Personal
MRN
MBI
Health
DOB
Name
Email
Phone
Address
Network
IP
MAC
18 entity types · 170+ detection rules
The catalog covers 18 common entity types, from national IDs and payment data to health identifiers. Behind them are 170+ detection rules, grouped into classifiers you can switch on or off; the default classifier settings enable a subset. Five industry packs (healthcare, finance, government, education and retail) add further identifiers through the industry detection API.
View full entity catalog
LLM Assist — example scope configuration
ENTITY_RESOLUTION cross-record dedup · Soundex + BIN OFF
MULTILANG up to 75 languages · lingua detector OFF
CODE_CONTEXT ±2000-char window · prose/code/config/data ON
BORDERLINE edge-case review · opt-in OFF
byollm: endpoint: https://your-llm.internal
Scoring + LLM Assist
Base confidence per entity type, boosted or penalized by surrounding keywords. An optional LLM Assist layer can then review detections in four separate scopes: cross-record entity resolution, multilingual text (up to 75 languages), code and config files (±2,000-char context window), and borderline edge cases. Each scope is enabled separately, and all are off by default. An OpenAI-compatible LLM endpoint of your own can be configured with our team.
How scoring works
Input: 078-05-1120
redact ***********
mask [SSN]
tokenize_fpe 904-37-5120
block refused (HTTP 422)
Redact, mask, tokenize or block
AI gateway rules pick an action per finding: redact overwrites every character, mask swaps in a type label such as [SSN], tokenize replaces the value with a format-preserving or deterministic token, and block refuses the request before it reaches the model.
Redaction reference
Token vault — FF1 AES-256 (FPE)
078-05-1120
→
slim_AgEBAQdz9mQ4xKv7
jane@acme.co
→
slim_AgECAR1pWc8sNe0u
+1 416 555 0142
→
slim_AgECAg6hTq2LbX9y
NIST FF1 AES-256 Deterministic scope Per-tenant keys
Enterprise token vault
Vault tokens are integrity-protected slim_ tokens. For fixed-shape numeric identifiers (SSN, SIN, phone, US passport, monetary amounts) the value inside can be encrypted with NIST FF1 (AES-256); other types use deterministic or randomized tokens, per policy. Per-tenant key derivation.
Token vault reference
Intercept flow

One layer between your apps and the model.

Requests routed through slim.io are scanned inline, then forwarded, transformed or refused according to your rules.

Chat app
prompts
RAG pipeline
retrieved context
Agent
tool calls
Support tool
summaries
slimio
scan · transform · block
0 intercepted
OpenAI
gpt models
Claude
anthropic
Gemini
google ai
Other models
via the scan API
Architecture

From request to decision in under 50 ms.

Server-side P99, measured. Each request routed through slim.io is classified, scored and acted on inline. The figures below are example data.

slim.io — inline pipeline (example data)
EXAMPLE
OpenAI
via proxy
Anthropic
via proxy
Gemini
via proxy
Scan API
POST /v1/scan
slim.io gateway
P99 <50ms server-side
SSN
97% conf · 12.8k today
Credit Card
checksum · 34.3k today
PHI
MRN, MBI · 2.3k today
PII
email, phone · 67.9k today
TOKENIZE
45.2k today
REDACT
8.4k today
BLOCK
1.2k today
ALLOW
892k today
3.8M
requests scanned
91.1k
PII findings
45.2k
tokenized
<50ms
P99 server-side
1.2k
blocked
Policies

Governance rules as code

Write rules over your scanned assets in YAML. Evaluating a policy reports each violation with its rule, severity and action.

policy.yaml
name: no-public-unencrypted version: 1 kind: access_control scope: providers: [aws] rules: - condition: "asset.publiclyAccessible == true" action: alert severity: critical - condition: "asset.encrypted == false" action: alert severity: high
Evaluation result · example data
rules[0] · alert
asset.publiclyAccessible == true · critical
2 violations
rules[1] · alert
asset.encrypted == false · high
0 violations
total_evaluated: 148
compliant_count: 146
violations: 2
Architecture

How slimio processes your data

Connector
Azure, S3, PG...
→
Stream
chunked, UTF-8
→
PII Detect
18 entity types
→
Risk Score
aggregate
→
Policy
violations
→
Action
alert, log
Chunked scanning
Content is scanned in chunks with a 512-byte overlap, so a value that straddles a boundary is still found.
Idempotent findings
Each finding is written under a stable ID, so a retried or resumed scan updates it instead of counting it twice.
Honest coverage
If a scan reaches its finding limit, the result is marked truncated instead of reported as complete.
Capabilities

What slim.io does today

Capability
Detail
Inline AI request scanning
A proxy for OpenAI, Anthropic and Gemini, plus a scan API; enabled per account
Chunked scanning with overlap
512-byte overlap between chunks
Context-aware confidence scoring
Keywords near a value raise or lower its confidence
Checksum scoring
Luhn, mod-97 and ABA check digits
Policy-as-code (YAML)
Validate, dry-run and deploy through the API
16 native connectors
Cloud storage, SaaS and databases
GDPR Article 15 and 17 APIs
Subject lookup and export; erasure after a confirmation step
Signed erasure receipts
Ed25519, verifiable offline
Bring your own LLM for LLM Assist
An OpenAI-compatible endpoint, configured with our team
Compliance

Three regulations. Dedicated detection or workflows for each.

HIPAA
Detects medical record numbers, Medicare Beneficiary Identifiers, Medicaid IDs and Canadian provincial health card numbers when they appear next to a label such as MRN, MBI, Medicaid or Health Card.
GDPR
Article 15 subject lookup and export, and Article 17 erasure of a subject from slim.io’s records, through the DSAR API.
PCI-DSS
Detects Visa, Mastercard, Amex, Discover, Diners and JCB card number formats, with Luhn checksum scoring.
Privacy Rights

GDPR Article 15 & 17, built in.

Data subject requests through the DSAR API. slim.io compiles a subject’s access record from the findings in your scanned sources, and erases the subject from slim.io’s own records after a confirmation step.

Art. 15
Right of Access
Query by email, SSN, phone, or customer ID. slim.io aggregates a SubjectAccessRecord from findings across your scanned cloud, SaaS, and database sources. Rate-limited per tenant. HMAC-hashed subject identifiers.
POST /api/v1/dsar/lookup
Art. 17
Right to Erasure
Request a confirmation token, then erase: the subject’s findings are anonymized in place and matching vault tokens are revoked. Each erasure that changes records writes an erasure-ledger row that is kept, never deleted, and carries a signed receipt.
POST /api/v1/dsar/erase
Proof
Signed Receipts
Erasure receipts are Ed25519-signed. Receipts exported in an offboarding bundle verify offline with slim-receipts-verify — no network call, no dependency on slim.io infrastructure being reachable.
slim-receipts-verify bundle.zip
Learn more about GDPR Article 15 & 17

See it on your own data

Connect a source, run a scan, and define policies in YAML.

Get a Demo Contact us
REST API · 18 entity types · 16 connectors · 3 regulations · GDPR DSAR (Art. 15 + 17)