shim AI gateway for PII masking and API governance

What does shim actually do?

shim is an AI gateway that sits between your application and a model provider. Instead of sending a customer's email or an API secret straight to the model, your backend sends the request through shim. When its configured privacy policy detects a sensitive value, the gateway replaces it with a placeholder and restores the value in the response your application receives.

This makes it relevant to platform engineers adding AI to business software and teams reviewing what leaves their systems. The website also offers shim-cli for developer machines. The gateway and CLI have different deployment paths and protection boundaries, so choose the part that matches your traffic.

How reversible PII masking works

A request containing a synthetic email can reach the provider with an email placeholder instead. Repeated instances of the same value reuse a placeholder within that request, helping the model work with relationships without needing the original identifier. Client-facing responses can then restore those values.

Documented categories include emails, telephone numbers, cards, IBANs, Turkish national IDs, US SSNs, API keys, private keys, database connection strings and network addresses. Detection has limits: the gateway documentation says English person names are not yet detected. Test representative synthetic examples rather than treating masking as a guarantee that every sensitive value will be found.

Connect a backend and verify one request

1. Create a shim gateway key and configure the selected provider's credentials. These are separate credentials; keep the shim key on your backend.
2. Follow the native API integration documentation. The OpenAI example uses https://api.getshim.tech/v1 with a shim key; Anthropic and Gemini retain their documented native request formats.
3. Select an approved model, enable the intended tenant privacy policy and set an output-token limit appropriate to your request.
4. Send a harmless test containing made-up identifiers. Check the returned answer, restoration behavior and recorded usage before expanding the workload.
5. Review admission errors. Unapproved models can fail before inference; configured rate or quota limits can return HTTP 429.

Compatibility covers documented endpoints, including OpenAI Responses and Chat, Anthropic Messages and Gemini generateContent. The docs explicitly exclude provider-to-provider translation, routing and failover. They also exclude OpenAI Responses background execution. With scrubbing enabled, opaque image, audio and file inputs are rejected; the homepage's document-conversion messaging should not be read as universal file support.

Keep budgets and audit evidence alongside requests

shim checks admission rules before calling the selected provider, then settles actual token usage and cost. Organization, team and request-tag budgets help attribute spending to the workload that caused it. RPM/TPM controls, daily or monthly quotas and repeat-loop protection address different ways usage can grow.

Audit records expose request lifecycle, model, usage, cost and privacy facts. Verification and evidence reports support investigation, while optional oversight workflows record human decisions. These are governance tools; the reports do not certify regulatory compliance.

Use shim-cli with realistic client expectations

The free Apache-2.0 CLI runs locally on macOS and Linux with Python 3.10 or newer, without a shim account. The official Claude Code route installs the CLI, runs shim demo claude, previews shim install claude --dry-run, installs the hook and checks a new session with shim doctor claude.

Protection depends on the client. Claude Code can mask eligible file and tool content, while typed Claude Code and Codex prompts are reported by default and can be blocked in enforce mode rather than rewritten. Copilot CLI can mask typed prompts, but its tool traffic and Codex tool traffic are not inspected. VS Code does not mask. Windows is unsupported and WSL is unverified.

For Claude Code, shim audit counts exposure in local history without printing the sensitive values. shim watch -- claude observes a session's traffic, tokens and spend. Detection remains best-effort.

Free quotas, enterprise deployment and data handling

Verified on October 20, 2026, the official Developer offer is $0 with both 1 million tokens and 1,000 requests per month. Enterprise deployment, usage and support are quoted individually. These gateway allowances do not establish that upstream model inference is included; check the current official pricing and your provider's billing.

The privacy policy says raw prompt and response bodies are processed transiently rather than stored in durable request records. An important exception is encrypted, tenant-bound restoration mappings for OpenAI Responses continuations, which may remain in Redis for up to 30 days. Enterprise on-prem deployment keeps gateway data off shim's infrastructure, while requests still go to the model provider you select.

Frequently asked questions

Is shim free and open source?

The CLI is free under Apache-2.0. The hosted gateway has monthly Developer limits, and Enterprise requires a quote. Do not apply the CLI's licence to every hosted component.

Which personal data can it mask?

The documentation lists financial identifiers, contact details, certain national identifiers and secrets. Coverage depends on the detector, policy, input and CLI client; it is not a complete data-loss prevention boundary.

Can I send any model request or upload any document?

Use the documented provider endpoints and approved models. Scrubbing rejects opaque files, images and audio, and the gateway does not automatically translate or fail over between providers.

Official resources

• Security architecture and deployment details: review credential storage and operational boundaries.
• shim-cli source, licence and issues: inspect supported clients and release-specific behavior.