Kalpita Sentinel · Offline AI Data Firewall
What Is Kalpita Sentinel, the Offline AI Data Firewall?
Mask sensitive data on the device before it reaches ChatGPT, Copilot or Claude. No cloud. No telemetry. Data never leaves the building.
Sentinel detects, masks and grades PII on-device — so sensitive data never leaves your network or reaches a cloud model.
Watch a document get masked, graded and logged with the network switched off.
The problem
Shadow AI Is Leaking Your Data Now
Industry data shows 18% of employees paste corporate data into generative-AI tools, and more than half of those pastes contain sensitive content. Every prompt with a customer's Aadhaar, a patient's record or a card number is a data-residency and breach risk — and under India's DPDP Act, a single leak can carry ₹250 crore of exposure.
Regex-only DLP misses context; a cloud PII API sends your data off-device to fix the problem. Neither is enough.
What it does
It Sits Between Any Employee and Any AI Tool
Sentinel scans a file or a paste, masks every piece of PII with reversible tokens, assigns a Red/Amber/Green verdict with a plain-English rationale, and writes an audit-ready log — entirely on the device.
Only the de-identified version moves on; the original never leaves your network. It is sovereign AI you can switch on today.
Capabilities
Key Capabilities
Reasoning and cited evidence, at zero per-scan cost, with the network switched off.
Hybrid Detection Engine
A deterministic layer (Presidio, Piiranha and Indian-PII recognisers) plus an offline reasoning model (Phi-4-mini via Ollama) for context, rationale and verdict.
Every Modality
Text, CSV/Excel, JSON/XML, Word, scanned PDFs, images (text-in-image and faces/ID cards), audio and video — all converted to text and run through the same pipeline.
India-First PII
Aadhaar, PAN, GST, IFSC, voter ID and Indian mobile formats, with multilingual OCR for regional documents.
Reversible Tokenisation
Safe round-trips to cloud models, then local rehydration — you keep the productivity of generative AI without exposing the underlying data.
Compliance Citation Per Entity
DPDP, GDPR, HIPAA, PCI-DSS, CCPA/CPRA, SOC 2, ISO 27001/27701, NIST 800-122 and FERPA — the specific clause, per flagged entity.
No-Code Recogniser Builder
Add an internal ID or policy-number pattern straight from the UI, with no engineering ticket.
Guardrail Modes
A browser extension, an IDE plugin, RAG pre-ingestion scrubbing, and agent/MCP egress guardrails — wherever data tries to leave.
One-Click Audit Log
Timestamped evidence rows a SOC 2 or ISO 27701 reviewer can export directly, in under ten seconds.
How It Works
Two layers, six steps — and the network stays off the whole way through.
A file or paste enters Sentinel on the device — network off.
Layer 1 catches structured identifiers — Aadhaar, PAN, cards, SSNs — in under a millisecond.
Layer 2 reasons over the hard cases: names in context, indirect and quasi-identifiers, other languages.
Each entity is replaced with a reversible token and tagged with the compliance clause it triggers.
Sentinel returns a masked file, a Red/Amber/Green verdict and a one-sentence rationale.
An audit row is logged; only the masked text is sent to any AI tool, then rehydrated locally if needed.
Why Kalpita Sentinel
Sentinel adds reasoning and cited evidence while keeping everything on-device at zero per-scan cost.
| Capability | Kalpita Sentinel | Regex DLP | Cloud PII API |
|---|---|---|---|
| Where data is processed | On-device, offline | On-device | Off-device (cloud) |
| Contextual PII | Yes — reasoning layer | No | Partial |
| Explainable rationale | Cited clause per entity | No | Rarely |
| Per-scan cost | $0 | $0 | Metered per call |
| Modalities | Text, docs, PDF, image, audio, video | Text only | Text or limited |
| Audit evidence | One-click log | Limited | Vendor-dependent |
Who it's for
Govern Generative AI Without Blocking It
- CISOs and security architects governing generative-AI use without blocking it
- Compliance leads who need exportable, clause-level audit evidence
- Regulated industries — banking, insurance, healthcare — handling Aadhaar, PAN, PHI and card data
- Government and air-gapped environments that cannot send data to the cloud
Deployment Tiers
Sentinel deploys where the data live: a one-click Windows desktop app for individuals; a Docker-packaged service with a browser UI for teams; and an air-gapped server build for enterprises and government. The minimum target is a 16 GB developer laptop with no GPU; a consumer GPU or enterprise server scales it for larger teams. The entire stack is open-licensed, so it is structurally free and structurally safe.
- Windows desktop (one-click)
- Docker service + browser UI
- Air-gapped server build
- Presidio + Piiranha
- Phi-4-mini via Ollama
- 16 GB laptop, no GPU
Proof, not promises
Proven Outcomes
≥ 0.91F1
Entity-level accuracy
Verified by a separate output-verification team rather than self-reported by the build team.
≤ 3sp95 Latency
Per 512-token chunk
Measured on laptop CPU — fast enough to sit in the path of a paste without anyone routing around it.
$0Per Scan
~$108K/yr avoided
A 5,000-employee deployment avoids roughly $108,000 a year in cloud inference fees.
100%Offline
Provably
An airplane-mode toggle and zero telemetry, so the claim can be demonstrated rather than asserted.
Audit-Ready in 10s
Masked, graded, logged
Masked file, verdict and logged evidence — the three artefacts a compliance officer actually asks for.
Frequently Asked Questions
Sovereign AI You Can Switch On Today
Book a 30-minute sovereign-AI readiness call and watch Sentinel mask, grade and log a document with the network switched off.
Kalpita Technologies® is a Registered Trademark © 2026 All Rights Reserved.