Seal locally
Detectors replace credentials, tokens, connection URIs, emails, IPs, and identifiers with random aliases.
Privacy firewall for Paritok
Your context can shrink.
Your secrets shouldn't travel.
VaultTok replaces credentials and PII inside your browser, sends only safe aliases to Paritok's hosted GPU, then restores every protected value locally—with a receipt.
01 Browser-local vault02 Fail-closed restoration03 O200k token receipt
RAW DATA BOUNDARY
10 detectors armed
0 values egress
aliases verified
The vault never crosses the dotted line.
Live privacy proof
See exactly what leaves the browser.
Ready
No raw context has left.
Run the synthetic case to create a redaction manifest, compression result, and fail-closed restoration proof.
IP address
__VT_IP_01_••••••••__Email address
__VT_EMAIL_02_••••••••__Assigned credential
__VT_CRED_03_••••••••__GitHub token
__VT_GITHUB_04_••••••••__AWS access key
__VT_AWS_05_••••••••__Public demo: use synthetic data only. Raw values are protected in your browser before the request is created.
The privacy boundary
Compression without blind trust.
Paritok remains the semantic compression engine. VaultTok adds the missing control plane around hosted inference.
→safe aliases only
Compress with Paritok
The hosted 4B model receives useful context and intent—but none of the locally vaulted values.
→guarded response
Verify & restore
Every alias must survive. If one disappears, VaultTok fails closed to the original context and reports zero savings.
Why it matters
The safest token is the one a third party never sees.
10secret and PII detector classes
With overlap resolution and no raw values in the receipt.
100%required alias survival
One missing alias activates a transparent, zero-savings fallback.
0credential values in egress
The server rejects residual sensitive values before Paritok is called.