BiVelio Shield: A Local-First, Fail-Closed Data Minimization Layer for Privacy-Preserving Use of Large Language Models

Abstract

The adoption of large language model (LLM) assistants in professional workflows creates a structural privacy problem: users routinely paste personal data, trade secrets, and credentials into systems operated by third parties whose retention and training practices are outside the user’s control. We present BiVelio Shield, a local-first data minimization layer that detects and replaces sensitive content before a prompt leaves the user’s device or the organization’s infrastructure. The system combines a checksum-validated deterministic engine for structured identifiers, a credential scanner for API keys, tokens, and private keys, and a multilingual contextual NLP layer for person and location names, organized behind a fail-closed gate that suspends transmission whenever detection confidence is insufficient. Redacted values are replaced by structure-preserving tokens whose mapping vault remains on the client, so the model retains the ability to reason about the task while the provider never observes the underlying data. Reported evaluation on executable test suites shows full precision and recall on structured identifiers, throughput of approximately 0.39 million characters per second, and coverage of 339 GDPR personal-data types including 15 special categories of Article 9. We analyze the architecture, its alignment with the GDPR principles of data minimization and data protection by design, and its position relative to network DLP, cloud de-identification APIs, and prompt-level defenses.

Keywords: privacy engineering; data minimization; large language models; GDPR; data loss prevention; PII detection; pseudonymization; browser security.

Reported results

Each figure with its scope, from Table 2 and Sections 5.2 to 5.4 of the paper.

• Full precision and recall on checksum-validated structured identifiers, as reported by executable test suites. This follows from the design (an IBAN only counts when its MOD-97 validates, a card only when it passes Luhn); it is not a result on free text.
• About 0.39 million characters per second of redaction throughput: on the order of 10⁵ times faster than human typing (roughly 3–4 characters per second at average professional speed).
• 339 GDPR personal-data types in the detector catalogue, including all 15 Article 9 special categories.
• The contextual layer (L3) is characterized qualitatively: the paper publishes no single recall figure, because its operating point is configurable between precision and recall through the fail-closed gate.

Architecture: three layers and a gate

Detection, the gate and the token vault run on the user’s device (a browser extension) or, for organizational tiers, on a gateway the organization hosts itself. Only the placeholders that replace the data cross over to the model provider.

• L1, deterministic engine: IBANs, payment cards, national identifiers, e-mail addresses, phone numbers and IP addresses, with checksum validation.
• L2, credential scanner: API keys, JSON Web Tokens and private keys, through structural analysis of their encoding. An exposed credential is a block-by-default event.
• L3, contextual PII: person and location names, with multilingual NLP tuned toward precision; low-confidence cases escalate to the gate.
• Fail-closed gate: if any stage is unsure whether a fragment is safe, the prompt is held and the user is asked.
• Structure-preserving tokens: each value becomes a typed placeholder (such as [IBAN_1] or [PERSON_2]) and the mapping stays on the device; when the answer comes back, the values are restored locally. The example values in the paper’s Figure 2 are synthetic.

Tiers

Table 4 of the paper. Prices exclude VAT; annual billing offers reduced per-seat rates.

Licences are verified offline in all three tiers (signed in Pro and Team).

Limitations stated in the paper

• It protects text prompts: real-time and voice modes are out of scope, and attachment redaction is only in the Team tier.
• The exactness guarantees belong to the deterministic layer; the contextual layer is probabilistic and turns uncertainty into user decisions, at the cost of friction.
• A prompt can still carry sensitive context in its meaning (a dispute, an illness, a business relationship); tenant dictionaries mitigate this for known terms, but no layer replaces the user’s judgment.
• The client device is assumed uncompromised: malware that reads keystrokes or the vault is out of scope.
• The GDPR mapping is an engineering analysis, not legal advice.

In BiVelio Factory

This preprint is product 02 on the output dock of BiVelio Factory, where the applications, papers and companies that leave the factory appear. For related reading, the algorithm of the same product: BV-PRGA.

Download and cite

Download the preprint as a PDF (10 pages, 539 KB, with a Spanish executive summary). The product is at privacy.bivelio.com.

How to cite it:

BiVelio Privacy Research Team (2026). BiVelio Shield: A Local-First, Fail-Closed Data Minimization Layer for Privacy-Preserving Use of Large Language Models. Preprint (company technical report, not peer reviewed), BiVelio, October 2026. https://research.bivelio.com/en/papers/bivelio-shield/