gaze swaps PII for stable tokens before text leaves your machine for an LLM, then swaps the originals back into the model's reply. Emails, names, phone numbers, IBANs, credit cards, IP addresses — each one gets replaced with a session-scoped placeholder, and the manifest needed to restore them stays server-side.
Detection runs in deterministic passes: regex first, then optional dictionary, then optional named-entity recognition. Ambiguous matches get tokenized rather than passed through. A signed manifest links each token back to its original, so restoration is cryptographic, not string-substitution.
Use it from the CLI by piping text through gaze clean before the model call, then piping the response through gaze restore. Rust applications can import gaze-pii directly and drive the pipeline in-process. An optional SQLite audit log records metadata about every redaction — never the raw PII — for compliance review.
Written in Rust. Installs via cargo or pre-built binaries for Apple Silicon and Linux x86_64. Ships as a CLI and as crates for direct library use.