Noirdoc Shield

Noirdoc Shield inspects inbound requests on German infrastructure before any data leaves the gateway towards a model provider. Depending on your protection filters, Shield either redacts detected values in-place with fixed category placeholders such as [PERSON] or [IBAN], or blocks the request before forwarding with HTTP status code 403 (shield_violation).

Flow

Noirdoc Shield uses a stateless one-way design:

1. Inspect on German infrastructure: the gateway extracts text segments from the request (including inline UTF-8 text attachments under 4 MiB) and runs your organisation’s active protection filters before opening a request to the model provider. Inspected fields (Shield) lists the exact fields per endpoint.
2. Block or redact in-place: if a filter configured with block matches – by default secrets and prompt injections – the gateway rejects the request before forwarding with status code 403 and error code shield_violation. Matches from filters configured with redact are replaced in-place by fixed placeholders such as [PERSON], [IBAN] or [CUSTOM].
3. Forward sanitised input: only the sanitised text reaches the model provider. Unlike legacy masking, Shield stores no mapping table in Redis and injects no system prompt into the conversation.
4. Stream directly: the gateway passes the model’s response straight through. There is no reverse substitution in the model’s output and zero sentence-buffering latency during streaming.

When all inspectable content in the request has been checked by Noirdoc Shield, the response carries X-Noirdoc-Shield: redacted=<n> (the number of redacted spans, 0 when nothing matched) and X-Noirdoc-Masked: true. If a non-enforced request includes attachments that Shield cannot inspect as text alongside text fields, the text fields are still inspected and redacted, and the response carries X-Noirdoc-Shield: partial; redacted=<n> and X-Noirdoc-Masked: false.

Detection is automated and reduces the risk of accidentally transmitting secrets, personal data and prompt injections, though it does not replace reviewing what your application sends.

Protection filters

Under Models → Shield (and via /v1/shield/policy), admins configure five independent protection filters:

While injection deliberately evaluates only user and tool segments so that your own developer instructions do not trigger false positives, secrets, pii, ner and custom inspect every role in the request.

For the Custom Blocklist (custom_patterns), you can configure up to 100 entries of 2 to 256 characters each:

• Plain strings without a prefix (for example "Projekt Helios") match case-insensitive literal substrings.
• Regular expressions prefixed with re: (for example "re:AZ-[0-9]{4}-[0-9]{5}") compile as linear-time regular expressions. Look-around assertions and backreferences are not supported, and the pattern must not match the empty string.

Policy and precedence

Under Models → Shield, admins choose the organisation’s Default Setting (mode / shield_policy):

On every request, the gateway evaluates five tiers in order:

1. Active filters check: if all five protection filters are set to off, Shield is inactive. Setting enforced while all five filters are off is rejected with status code 422 (shield_policy_invalid).
2. Organisation enforced: Shield is always active and cannot be turned off by key, tag or header.
3. API key (shield_mode): the key’s Noirdoc Shield setting (On on or Off off) applies; Inherit (inherit) defers to the next tier.
4. Request tags (X-Noirdoc-Tags): if attached tags define shield_mode, any on wins over off; inherit defers.
5. Request header and organisation default: X-Noirdoc-Shield: on or off (case-insensitive) overrides the organisation default; without the header, default_on activates Shield and default_off leaves it inactive.

On organisations running Noirdoc Shield, X-Noirdoc-Mask continues to work as a legacy alias for X-Noirdoc-Shield. On pre-existing organisations that are still on legacy masking during the transition period, X-Noirdoc-Mask controls legacy masking while X-Noirdoc-Shield: on explicitly selects Noirdoc Shield for that request. The gateway strips both headers before forwarding.

Files and attachments

Whether requests may carry file, image or audio parts at all is controlled by Allow file and image attachments in requests (allow_file_content) under Models → Shield in Advanced Settings. When turned off, any request containing attachments is rejected with status code 403 (file_content_not_allowed).

When file attachments are allowed and Noirdoc Shield is active for a request, behaviour depends on the attachment format:

• Inline UTF-8 text attachments under 4 MiB (text/*, JSON, XML, CSV, Markdown, YAML passed as Base64 data: URLs or Anthropic text document blocks) are decoded, inspected across all active filters and redacted in-place before forwarding.
• Binary documents, media, external references and large files – including PDF, DOCX, XLSX, PPTX, images, audio, video, files referenced by file_id or URL and inline text of 4 MiB or larger – cannot be inspected by Shield:
  • Under enforced, the gateway rejects the request before forwarding with status code 422 and error code shield_uninspectable_content.
  • Under default_on or selective activation (on without enforced), Shield inspects and redacts all text segments in the request, forwards the uninspectable attachment alongside the sanitised text and returns X-Noirdoc-Shield: partial; redacted=<n> with X-Noirdoc-Masked: false.

Supported endpoints

Noirdoc Shield covers generative model endpoints, retrieval endpoints and a standalone inspection endpoint:

On uninspected endpoints (/v1/audio/*, /v1/images/generations and content-carrying requests on /v1/files and /v1/skills), requests under enforced – as well as requests sending X-Noirdoc-Mask: on, and X-Noirdoc-Shield: on on /v1/images/generations – are rejected with status code 403 (masking_not_supported_for_endpoint) rather than forwarded uninspected.

Billing

Noirdoc Shield is billed at a flat +€0.40 per 1M inspected input tokens across all five protection filters, with no per-filter add-ons.

• When Shield is billed: whenever Shield inspects text – on providers managed by Noirdoc, on your own provider keys (BYOK, deducted from organisation credit or invoiced), on requests stopped with 403 shield_violation (since Shield ran and protected the request) and on standalone calls to POST /v1/shield/inspect.
• When Shield is not billed: when Shield is inactive for the request, on preflight token-counting endpoints (/v1/messages/count_tokens, /v1/responses/input_tokens) or when a request is rejected before Shield runs (such as 422 shield_uninspectable_content).
• Price catalogue: GET /v1/prices exposes the rate under the top-level "shield" field ({"price_input": "0.40", "price_unit": "per1MTokens", "currency": "EUR", "price_currency": "EUR"}), see Models & pricing.

Legacy masking

Pre-existing organisations that already used or configured legacy reversible masking before Noirdoc Shield launched remain on legacy masking during a transition period until 30 November 2026 (2026-11-30T23:59:59Z). Throughout this transition period, every legacy-masked response includes RFC 8594 deprecation headers alongside X-Noirdoc-Masked: true:

Deprecation: true
Sunset: Mon, 30 Nov 2026 23:59:59 GMT
X-Noirdoc-Masked: true

Key behavioural differences between Noirdoc Shield and legacy masking:

During the transition period, legacy organisations can test Noirdoc Shield side by side without switching the whole organisation:

• Per request: send X-Noirdoc-Shield: on (while X-Noirdoc-Mask continues to control legacy masking until the organisation switches).
• Per API key or request tag: set shield_mode to on on selected keys or tags.
• Standalone: call POST /v1/shield/inspect directly.

Admins can switch their organisation permanently in one click under Models → Shield (Switch to Noirdoc Shield now) or by writing to PUT /v1/shield/policy or PATCH /v1/shield/policy (legacy_mask_active: false). Switching is one-way, and the existing policy mode (default_off, default_on or enforced) carries over to Shield. After 2026-11-30T23:59:59Z, all remaining legacy organisations automatically run on Noirdoc Shield.