How it works
Exactly what the agent does.
One pipeline, whatever the provider and whatever the mode. Here is what it recognises, what it writes instead, and what it gives back.
On the workstation · The request
What the provider receives · The request
On the workstation · The response
What the provider receives · The response
Stand-ins keep the exact shape of the original and carry a deliberately invalid checksum: no generated national ID, IBAN or card number can point at a real person. A secret never gets a stand-in: it always travels as a token, even in stand-in mode. That is what makes restoration safe — no value put back can be mistaken for a live key.
What the agent recognises
The catalogue is ordered, and the order is part of the correctness: the specific pattern must reach a value before the broad one, or a provider key prefix gets swallowed by a generic match. Where a checksum exists — the French NIR, SIREN and SIRET, the IBAN, payment cards, the NHS number, the ABA routing number — it decides alone: fifteen digits failing the key are not a weak match, they are not a match, and no setting can turn them into one. National sets load on demand, and none load by default: reading one country’s data with another country’s patterns is worth less than reading none of it.
- Contact details and identity
- Email, phone, postal address, postcode, date of birth, licence plate
- National identifiers
- France: NIR, SIREN, SIRET · United Kingdom: NHS number, NINO · United States: SSN, EIN, ABA routing number
- Always on, whatever the locale
- IBANs from every issuing country, payment cards, IPv4 and IPv6 addresses, ISO dates, database identifiers
- Secrets
- Keys for some twenty providers, AWS keys, GitHub, GitLab, Slack and npm tokens, PEM private keys, JWTs, connection strings, plaintext passwords and session cookies
Two ways to replace a value
The mode applies fleet-wide and is reported in the heartbeat, so the CISO can see at a glance that no endpoint has drifted from it. It changes without restarting the agent — as do the loaded locales, the secret level and every category taken separately — for the length of one exchange you want to look at closely. A category switched off lets the value leave in clear, and the heartbeat names it straight away. Whatever must hold across a restart belongs in configuration, never on a command line.
Token — [EMAIL_1]
The value becomes a numbered variable. The prompt stays unambiguous for a model that has to juggle identifiers, and restoration is complete on the way back. This is the mode to pick when the output feeds a machine.
Stand-in — margaux.lefeuvre@example.net
The value becomes another value of the same shape. The prompt stays prose, which models handle far better than a string of markers. Stand-ins are indexed, never random: the same original always yields the same stand-in within a session.
The exception: secrets
A secret never gets a stand-in: it always travels as a token, including when the rest of the fleet runs in stand-in mode. That is deliberate, and it is what makes stand-in mode safe. Restoration works by matching text — a stand-in is recognised by its own shape in order to be replaced. If a secret could be given a stand-in, that path would be able to mint a plausible-looking key inside a response; because a secret only ever exists as a token, it can only be put back where the vault actually recorded a value. So a secret is restored like any other value, and that is intended: your tool has to get back the key it asked for. What Neverseen guarantees is not that a key never comes back, but that no key is ever invented. Nor can a secret be switched off, whichever name it is called by. A key recognised by its prefix — “sk-ant-”, “gsk_” — is masked whatever happens; for everything else, a strength level decides. Weak masks down to ordinary words and drowns source code; strong masks only what nobody typed by hand, and is the level to run at while reviewing code.
The session vault
In memory
The mapping lives inside the agent process. Nothing is written to disk, nothing crosses the network.
Encrypted
AES-256-GCM with a per-machine key, generated at install time and never transmitted.
Short-lived
A session expires after thirty minutes of inactivity. The mapping goes with it.
Collision-free
Every generator has a known capacity and never wraps past it: two originals can never share a stand-in.
Providers and streaming
The agent exposes a local address to your tools and routes to the configured provider using your own keys. Switching providers is one configuration line, not an integration rewrite. Streaming responses are rehydrated line by line by the same pipeline as JSON responses — streaming is not a side path where masking quietly relaxes.
Supported providers
- Anthropic
- OpenAI
- Google Gemini
- Mistral
- Groq
- Together
- DeepInfra
- xAI