AI Data Shield
AI Data Shield identifies and protects sensitive data fed into applications such as AI agents and memory stores. It uses data classification to identify the sensitive data and protection tools such as tokenization and masking to protect it, according to a rules-based policy you configure. Protected values are restored on the way back for the applications your policy permits.
In this section
Section titled “In this section”- Registering an Application – Create the identity Shield authenticates, and scope what it can reach.
- API Payload Classification – How ALTR finds sensitive data in a payload and what it reports.
- Shield Policy – Author the rules that decide what gets protected, how, and who can restore it.
- Protecting and Restoring Data – The two calls your application makes.
- Shield Log – Review every decision, one record per finding or token.
How Shield Works
Section titled “How Shield Works”Your application sends a payload – one piece of text – through the AI Data Shield software development kit (SDK). In a single call, ALTR:
- Runs a collection of classifiers over the text. Each sensitive value it locates is a finding, carrying the classifier that matched and the value’s position.
- Applies your Shield policy to each finding: tokenize it, mask it, or leave it in the clear.
- Returns the findings, which the SDK splices back into the payload – leaving you text that is ready to send onward.
Restoring is a separate call. The SDK extracts the tokens from the text and submits them to ALTR, which returns the values policy allows. Denied tokens are left in place.
Classification does not protect – policy does. A finding no rule protects is reported and left in the clear.
What You Configure
Section titled “What You Configure”| Object | Purpose |
|---|---|
| An application | The identity Shield authenticates. Holds the registered public key and the collections it may use. |
| A collection | The classifiers ALTR runs over a payload. |
| A Shield policy | The rules deciding what gets protected, how it is stored, and who can restore it. |
Your application sets its collection when it constructs the client, from the list it is scoped to. See Registering an Application.
Shared with Data Classification
Section titled “Shared with Data Classification”Shield runs the same collections and classifiers as Data Classification, so a collection you already built works here. Three caveats, because a payload is not a column:
- Only Regex Pattern Match, Google DLP, and Amazon Comprehend conditions can produce a finding. See API Payload Classification.
- Sample size and Minimum Match Threshold have no effect. A payload arrives whole.
- A Google DLP or Amazon Comprehend condition sends the payload to that service for inspection. A regular expression is evaluated inside ALTR. Both services run under ALTR’s own credentials – there is nothing for you to configure.
Tokens and the Tokenization APIs
Section titled “Tokens and the Tokenization APIs”Shield tokens are not interchangeable with Vaulted Tokenization or Critical Tokenization tokens. Separate storage, separate policy, separate format – neither surface restores the other’s values.