divelai closed beta

Use any AI.
Leak nothing.

Divelai sits on the wire between your systems and every LLM API, vendor, and offshore processor. It classifies sensitive fields, replaces them with reversible tokens before the request leaves your boundary, and puts the real values back in the response.

Request access See how it works

Closed beta · inline, not batch · reversible, not destructive · every transformation logged for auditors

POST api.openai.com/v1/chat/completions unprotected

Runs in your browser. Nothing typed here is transmitted or stored. Sample data is synthetic.

One hop, both directions

Requests leave your boundary sanitized and come back rehydrated. The model, the vendor, and the processor never hold a value they were not cleared to hold.

Divelai in the request path Your systems send raw data to Divelai. Divelai sends sanitized, tokenised data across the trust boundary to AI providers, vendors, and processors. Their response returns to Divelai still tokenised, and Divelai rehydrates it before returning it to your systems. Green marks the legs where data has been sanitized. Your systems app · warehouse · tickets logs · documents Divelai detect · tokenise · log AI providers and vendors LLM APIs · analytics · BPO trust boundary raw sanitized tokens returned rehydrated
Green marks the legs where every sensitive span has been replaced. Only green legs cross the boundary.

Four things it does

Detection

Pattern, ML, and policy classification of sensitive fields across text, documents, tables, and logs.

Sanitization

Redaction, reversible pseudonymisation, format-preserving masking, or synthetic substitution — per field.

Deployment

Drop-in proxy in front of a provider, SDK call, gateway sidecar, or fully self-hosted in your VPC.

Governance

Policy as versioned config, immutable audit log, data-flow maps, and evidence your auditor accepts.

Change the base URL

The proxy speaks the provider’s own protocol. Point your existing client at Divelai, keep your existing request and response shapes, and sanitization happens on the wire. Tokens in the model’s reply are rehydrated before your code sees them.

If you would rather sanitize explicitly than transparently, the SDKs expose the same engine as a direct call.

Quickstart

SDK languages available at launch [CONFIRM]

# Same client, same payloads. One base URL.
from openai import OpenAI

client = OpenAI(
    base_url="https://proxy.divelai.com/v1",
    api_key=os.environ["OPENAI_API_KEY"],
    default_headers={"x-divelai-policy": "tickets@v4"},
)

# PII leaves as [EMAIL_7f2a]; the reply is rehydrated.
reply = client.chat.completions.create(
    model="claude-opus-5",
    messages=[{"role": "user", "content": body}],
)

Frameworks this addresses

Divelai supports the data-minimisation and disclosure controls in each of these. It does not make an organisation compliant, and we will not tell your auditor that it does.

These are frameworks Divelai helps you meet, not certifications Divelai holds. We hold none, and there are no badges on this site — see the trust center.

GDPR CCPA / CPRA HIPAA PCI DSS SOC 2 ISO 27001 NIST AI RMF EU AI Act

See the control-by-control mapping

Added latency, p50

[CONFIRM]

Published only with a reproducible methodology and the harness used to produce it.

Added latency, p99

[CONFIRM]

Measured at the proxy, excluding provider time, on stated hardware.

Sustained throughput

[CONFIRM]

Requests per second per node, with payload size distribution stated.

Questions we get asked

What does Divelai do?

Divelai is a sanitization layer that sits between your systems and any LLM API, vendor, or offshore processor. It detects sensitive fields in a request, replaces them with reversible tokens before the request leaves your boundary, and restores the real values in the response.

Does using Divelai make my organisation compliant?

No. Divelai supports specific controls under GDPR, HIPAA, PCI DSS, ISO 27001 and other frameworks — data minimisation, masking, egress control and audit evidence. Compliance is a property of your programme, and your counsel and assessor decide what satisfies a requirement.

Can sanitized data be turned back into the original?

Yes, for the reversible transforms. Tokenisation and synthetic substitution store a mapping in a vault you control, and Divelai rehydrates values on the return leg before your application sees them. Redaction and format-preserving masking are one-way by design.

Does Divelai work with any AI provider?

Yes. The proxy speaks the provider's own protocol, including streaming, so you change a base URL rather than rewriting your integration. SDKs and a gateway sidecar are available where you would rather sanitize explicitly or cover non-AI destinations too.

Can Divelai run inside our own infrastructure?

Yes. On the self-hosted plan the whole engine and the token vault run in your own VPC or data centre, and no payload, token, or mapping reaches infrastructure Divelai operates.

Is Divelai generally available?

No. Divelai is in closed beta. Access is granted deployment by deployment so every early team gets direct engineering support, and engagements start as a bounded pilot with agreed success criteria.

Is Divelai SOC 2 or ISO 27001 certified?

No. Divelai holds no third-party security certifications and displays no badges. We can complete your security questionnaire, walk your team through the architecture, and sign a DPA. If your process requires a current SOC 2 Type II report before signing, Divelai cannot meet that requirement today — the trust center says so plainly.

How much does Divelai cost?

Divelai is quoted per deployment, because throughput, deployment mode, detector coverage and assurance requirements vary enormously. The pricing page sets out exactly what shapes a quote and how the process runs.

Bring the AI you already chose.

Tell us what leaves your boundary today and we will show you what Divelai would have caught, then quote against your actual deployment.

Request access Read the trust center