REDACTRA — Protect Sensitive Data Before AI

REDACTRA is a self-reported Thai-first privacy gateway for managed AI web apps, designed to tokenize sensitive data on-device before sending prompts to external services like GPT-5.6. The project claims to intercept and process prompts locally using detectors for Thai identifiers, then only pass policy-eligible requests to an LLM for semantic risk assessment. It is presented as a solution to the dilemma organizations face when allowing AI use without risking data leakage.

The author states that REDACTRA operates with a local agent and browser guard, uses GPT-5.6 only after privacy checks, and includes reversible tokenization. The system is built using React/Vite, Node.js, TypeScript, Manifest V3, and OpenAI's Responses API. It is described as a proof-of-concept submitted to the OpenAI 2026 hackathon.

The description states that REDACTRA is a privacy gateway for managed AI web apps, operating as a local agent and browser guard. It intercepts prompts before they are sent to external services such as GPT-5.6, using local detectors to identify Thai-sensitive data.

It includes:

• A Manifest V3 Browser Guard
• A Loopback Node.js Local Agent with an origin allowlist, policy engine, in-memory token vault, response guard, and SHA-256 audit chain
• Integration with the OpenAI Responses API, using structured outputs and store: false
• Thai language packs for enterprise and healthcare use cases
• A Reversible placeholder tokenization system, restored only within the originating session

The product is described as a PoC submitted to the OpenAI 2026 hackathon, built with tools including React/Vite, Node.js, TypeScript, FastText, and Codex.

Inference: The system appears to be designed for organizations that want to allow AI use while preventing sensitive data from leaving their local environment. It separates detection from LLM evaluation, placing the latter only after privacy checks.

The description states that REDACTRA is a Thai-first local privacy gateway for managed AI web apps. It positions itself as an alternative to either:

• Uncontrolled copy-and-paste of sensitive data into AI tools
• Blocking AI entirely

It claims to offer a visible and testable path for handling sensitive data, with a focus on Thai identifiers and locally meaningful risk.

The author also states that the novelty lies in:

• The combination of Thai-first language packs
• Reversible local tokenization
• Executable privacy evidence (as opposed to architecture diagrams)

Inference: REDACTRA is positioned as a privacy control tool for AI use, not a general-purpose AI platform or service. It emphasizes local processing and policy enforcement, with LLMs used only in a limited, controlled way.

The description states that REDACTRA is designed for:

• Thai healthcare
• Financial
• Legal
• HR
• Contact-center teams

These groups are said to want to allow employees to use managed AI web apps without copying raw identifiers into external services.

Inference: The target customer segment appears to be enterprise users in regulated industries, particularly those in Thailand, who are concerned about data privacy and compliance when using AI tools.

Not evidenced.

The description does not include any information on:

• Revenue model
• Pricing structure
• Monetization strategy
• Customer acquisition or retention plans

Inference: There is no evidence of a business model beyond the PoC submission. The project is presented as a hackathon entry, with no indication of commercial intent or pricing.

The description includes:

• Manifest V3 Browser Guard
• Loopback Node.js Local Agent
• OpenAI Responses API with structured outputs and store: false
• Thai language packs for healthcare and enterprise
• Reversible placeholder tokens
• React/Vite Proof Console
• Integration request capture proving no OpenAI calls are made for sensitive data

It also mentions:

• Use of FastText for detection
• Deterministic evaluation fixtures
• Executable zero-call integration tests

Inference: The technical stack suggests a browser-based privacy control system, with local processing and limited LLM involvement. The use of structured outputs and deterministic fixtures implies an emphasis on reproducibility and testability.

Not evidenced.

The description does not include:

• Customer data
• Revenue or ARR
• Adoption metrics
• Product usage statistics
• Deployment history

It is described as a PoC submitted to the OpenAI 2026 hackathon, with no indication of real-world use or product maturity beyond that.

Inference: There is no evidence of traction, adoption, or commercial deployment. The project remains in early-stage development.

Not evidenced.

The description does not mention:

• Competitors
• Market positioning relative to other privacy tools
• Prior art or similar solutions
• Industry benchmarks or market size

Inference: No competitive context is provided. It is unclear whether REDACTRA is addressing a known gap in the market or if it is a novel concept.

1. Unverified claims: The description is self-reported and unverified.
2. No evidence of traction or adoption: The project is described as a hackathon PoC with no commercial deployment.
3. Use of GPT-5.6: The author states that GPT-5.6 is not a real model (as it does not exist), but the description still refers to it, which may be misleading.
4. No pricing or monetization strategy: No indication of how the product would generate revenue.
5. Limited scope: The focus on Thai identifiers and specific use cases may limit scalability.

Inference: REDACTRA is a conceptual privacy tool, not a proven product. Its lack of real-world deployment, traction, or business model raises significant risk for commercial viability.

1. What is the actual technical architecture and how does it differ from generic AI gateways?
2. How are false negatives in detection handled, and what is the risk tolerance level?
3. Is there any evidence of real-world testing or pilot use cases beyond the PoC?
4. What is the plan for scaling beyond Thai identifiers and into other markets?
5. Are there any commercial partnerships or customers already engaged with REDACTRA?
6. How does the system handle edge cases where detection fails or is uncertain?
7. What are the plans for integrating with existing enterprise AI platforms or tools?