Built for the way data actually leaks
Your data never leaves your network
Fully self-hosted on Kubernetes. No SaaS round trip, no vendor cloud, no telemetry carrying record content. A default-deny network policy limits each pod to your brokers.
Accurate on structured data
Every JSON or XML record is parsed and redacted by field name and by content, so
"LastName": "Smith" is caught even though the value matches no pattern.
Fails closed
A record that cannot be processed goes to an access-restricted dead-letter topic, never to the clean one. Exactly-once delivery when you need it.
Change policy without holding your breath
1 · Sign
Rules that cannot be quietly weakened
Redaction rules ship as signed policy bundles. A connector obeys only a trusted signature and a newer version; a forged or rolled-back bundle changes nothing.
2 · Shadow
See the effect before it applies
A candidate policy runs beside the live one on real traffic. You get the difference as counts, by data type, and nobody has to look at the data.
3 · Prove
Evidence an auditor can check
Content-free audit events record what was removed, under which policy, in a hash chain that shows any event altered, removed or reordered.
Measured, not estimated
Throughput per core, end-to-end numbers through Kafka and where the time goes are published with the script that produced them. Run it on your own hardware.