# credgate

> credgate keeps Indian personal data (Aadhaar, PAN, GSTIN, cards, UPI, mobile numbers, names and more) out of prompts sent to language models. It detects identifiers with checksums and context words (no model, works offline), redacts or tokenises them, applies a YAML policy per model endpoint, restores tokens in answers, and keeps a hash-chained audit log without the data. There are two packages, R and Python, built from one shared spec, plus a proxy for Claude Code, Copilot, Ollama and OpenAI-compatible clients. Licence: Apache-2.0. Status: alpha.

Use synthetic data only when trying credgate, for example the PAN `ABCPE1234F`, the card `4111 1111 1111 1111` and the mobile number `+91 98765 43210`.

## Install

- Python 3.11+: `pip install credgate`; add the policy editor with `pip install 'credgate[editor]'`.
- R: `install.packages("credgate", repos = c("https://dwarpal.r-universe.dev", "https://cloud.r-project.org"))`. The CRAN release is under review.
- Proxy quick start: `curl -O https://raw.githubusercontent.com/dwarpal/credgate/main/examples/policies/quickstart.yaml`, then `credgate proxy serve --policy quickstart.yaml --audit audit.jsonl --default-endpoint claude`, then `ANTHROPIC_BASE_URL=http://127.0.0.1:8790 claude`.

## Things that trip people (and agents) up

- Pass text, not chat messages. Every function takes a string or a sequence of strings (in R, a character vector). For chat messages, pass the contents: `[m["content"] for m in messages]` in Python. Anything else (a dict, a list of dicts, bytes, a number) is an error in both languages, never read as empty (Python 0.12.1 and later).
- A policy decision's rewritten text is `decision.texts` in Python and `decision$text` in R. In R, a misspelt field such as `decision$texts` silently gives `NULL`.
- Positions: Python spans count from 0, with `end` excluded. R counts documents and positions from 1, with `end` included.
- A span's data class is `span.data_class` in Python and the column `class` in R.
- Policy matches: in Python, `decision.matches` is a tuple of `PolicyMatch(span, action, rule)`. In R, `decision$matches` is a data frame, with the span columns plus `action` and `rule`.
- A policy that tokenises needs a vault: `policy.apply(texts, "claude", vault=credgate.Vault())` in Python, or `policy_apply(p, texts, "claude", vault = cg_vault())` in R.
- `credgate policy test` and `credgate proxy serve --require-tests` look for the tests file beside the policy: `quickstart.tests.yaml` for `quickstart.yaml`.
- The proxy is in the Python package only. R uses it through its URL, for example `ellmer::chat_openai(base_url = "http://127.0.0.1:8790/v1")`.

## Core functions

| Task | Python | R |
|---|---|---|
| Detect | `credgate.detect_pii(text)` | `detect_pii(text)` |
| Preview what would be redacted | `credgate.preview(text)` | `preview(text)` |
| Redact | `credgate.redact(text)` | `redact(text)` |
| Tokenise, restore | `credgate.tokenise(text, vault)`, `credgate.restore(answer, vault)` | `tokenise(text, vault)`, `restore(answer, vault)` |
| Vault | `credgate.Vault()` | `cg_vault()` |
| Policy | `credgate.Policy.load(path)`, `.decide(texts, endpoint)`, `.apply(texts, endpoint)` | `cg_policy(path)`, `policy_decide()`, `policy_apply()` |
| Policy tests | `credgate.run_policy_tests(path)`, `credgate policy test --policy path` | `run_policy_tests(path)` |
| Audit log | `credgate.AuditLog(path)`, `credgate.audit_verify(path)` | `cg_audit_log(path)`, `audit_verify(path)` |
| Column scan | `credgate.scan_pii(df)` | `scan_pii(df)` |
| Policy editor | `credgate editor --policy path` | `policy_editor(path)` |

## Docs

- [How it works](https://dwarpal.github.io/credgate/how-it-works/): a request through the proxy, step by step, and how confidence is scored.
- [Python: get started](https://dwarpal.github.io/credgate/python/): detection, redaction, tokens, policies and the audit log in Python.
- [R package](https://dwarpal.github.io/credgate/r/): the R reference and articles.
- [R and Python](https://dwarpal.github.io/credgate/r-and-python/): every name in both languages, and where they differ.
- [Proxy guide](https://dwarpal.github.io/credgate/proxy/): Claude Code, Copilot Chat, Ollama, team mode with keys.
- [Features in detail](https://dwarpal.github.io/credgate/features/): what is detected, and the policy, audit log and editor.
- [Specification](https://dwarpal.github.io/credgate/spec/): detection rules, the policy format and the file formats both packages implement.

## Optional

- [Threat model](https://dwarpal.github.io/credgate/threat-model/): what credgate protects against, and what it does not.
- [Policy editor](https://dwarpal.github.io/credgate/policy-editor/): the InfoSec UI, roles and the change log.
- [Custom detectors](https://dwarpal.github.io/credgate/custom-detectors/): adding your own identifier types in YAML.
- [Large data](https://dwarpal.github.io/credgate/large-data/): Arrow, Parquet, DuckDB, Spark and BigQuery.
- [Repository](https://github.com/dwarpal/credgate): source, issues and the changelogs.