Skip to main content
Masker works as a forward proxy. You point your voice platform at a Masker URL instead of directly at your LLM, and every conversation turn flows through the pipeline below. Your LLM provider only ever sees tokens. Your callers hear natural responses. The full pipeline adds 45–95 ms of overhead.

​
Request flow

1

Caller speaks

Your voice platform (Vapi, ElevenLabs, Bolna) handles the phone connection, runs speech-to-text, and assembles a chat-completions request with the conversation history. This is standard behavior — Masker has not changed anything yet.
2

Voice platform POSTs to Masker

Instead of posting to OpenAI directly, your voice platform sends the request to your per-agent Masker proxy URL:
The {agent_id} is generated when you create an agent in the portal. This is the only configuration change required on your voice platform — one URL swap.
3

Masker detects PHI

Masker runs a two-pass detection pipeline over the request body:
  • Pass 1 — regex: Structured PHI with known patterns: SSN, US phone and fax, email, ZIP code, date of birth, MRN, account numbers, URLs, IP addresses, credit card numbers (Luhn-checked), and VINs.
  • Pass 2 — NER: Unstructured PHI using Gemma-4 named-entity recognition: person names, organizations, locations, and medical terms that don’t match a regex pattern.
Each detected span is recorded with its character offsets, detector ID, and confidence score before tokenization begins.
4

Masker tokenizes each span

Every detected span is replaced with a stable token. Masker supports two tokenization schemes:
  • Vault-deterministic (HMAC-SHA256): The same input always produces the same token within a session. The LLM can refer to the same person consistently across turns.
  • Reversible AEAD (AES-256-GCM-SIV): Each tokenization produces a ciphertext that can be reversed using the session key. Used when the original value must be recoverable server-side.
The token format is:
Breaking that down:The original values are stored in a per-session SQLite vault, keyed by session ID and token. Nothing is persisted on the public demo; self-hosted deployments retain only the encrypted vault.
5

Masker forwards the masked request to your LLM

The redacted request body — with all PHI spans replaced by tokens — is forwarded to your configured upstream LLM. The default is OpenAI gpt-4o-mini. Masker’s proxy endpoint is OpenAI-compatible, so any voice platform with a Custom LLM URL setting works without code changes.
6

Your LLM responds with tokens intact

The LLM treats tokens as opaque strings and responds naturally. A typical masked response looks like:
Your LLM provider’s logs — OpenAI, Anthropic, or any other — only ever contain these token strings.
7

Masker rehydrates the response

Masker walks the response, finds every token, looks it up in the per-session vault, and substitutes the original value back in. The result returned to your voice platform:
The caller hears a natural response. No [REDACTED], no broken references.
8

Masker writes the audit chain

Every detection and redaction event is appended to a hash-chained journal. Each entry carries a SHA-256 prev_hash linking it to the previous event and a curr_hash covering its own contents plus the previous hash:
A single mutated byte anywhere in the chain breaks every downstream hash. The session’s merkle_root_hex can be verified offline. POST /audit/verify re-runs the chain check and returns {ok, event_count, message} — the literal string "chain ok" is what you show an auditor.

​
Three artifacts per session

Every completed session produces three artifacts, all derived from the same event chain:

​
HIPAA Safe Harbor coverage today

Masker currently fully covers 9 of the 18 HIPAA Safe Harbor identifier categories, with 3 partial: Full 18-category coverage is targeted for the May 30, 2026 production beta. See hello@masker.dev if you need coverage for a specific PHI shape sooner.

​
Latency budget

This is well within Vapi’s first-token-latency budget (< 1500 ms typical) and is imperceptible to callers in real-time conversation. If you observe higher overhead in your environment, that’s a bug — report it at hello@masker.dev.

Quickstart

First masked call in under five minutes.

Beta access

Production access with a signed BAA and VPC deployment.