Cloud.ru Open-Sources Guardrails Filter for Data Protection When Working with LLMs

Cloud.ru has released the source code of Guardrails Filter, a transparent reverse proxy between clients and large language model providers that removes sensitive data from model requests and restores it in responses. The tool detects and masks personal data, API keys, bank card details, SNILS, INN, OGRN, and other information types using over 260 built-in rules based on regular expressions and checksums. The operation is performed in microseconds and does not require machine learning inference. Two deployment options are available: a standalone Go service (a single Docker image, three ports) and an ext_proc sidecar for Envoy, which centrally applies protection to all requests crossing the boundary. Guardrails Filter supports storing placeholders in memory, Redis, or PostgreSQL with encryption capabilities, and restores data even in streaming Server-Sent Events (SSE) responses and tool calls. It includes a web console with logging, Prometheus metrics, and Grafana dashboards, as well as a test mode called Ghost Mode. Average precision ranges from 92% to 99.9%, recall from 75% to 87%, and F1-score from 82% to 93%. The tool is already used internally within the Cloud.ru Evolution Foundation Models platform.