THE ROUND TRIP — ONE PATH FOR EVERY CALLER
1
Capture. A person, application, or agent sends a request containing real values — +90 543 417 88 21, account VF-C-88231. A capture lane (app gateway, endpoint agent, or the Workspace itself) brings it to the Salus Engine.
2
Detect & tokenize. The self-hosted PII model and deterministic validators find sensitive spans. Each value is replaced with a typed token — PHONE_8f3a, CID_4a2e — and the mapping is written to the vault. Policy decides what is masked, blocked, or held for approval.
3
Egress. Only the tokenized request crosses your boundary. The external provider writes its answer around the tokens — it has no path to the original values.
4
Restore. The response returns to the engine, which looks up each token in the vault and restores the original values inline — on streamed responses too. Every restore is an audited event.
5
Deliver. The caller receives a complete, useful answer with real values restored where policy allows. The workflow is unchanged.

Detection runs inside, reasoning runs outside#

The step that has to see real data — detection — runs on your infrastructure. Salus's self-hosted PII model handles free text, while deterministic validators handle structured identifiers (national IDs, IBANs, phone numbers, account numbers) on a fast path. Optional vision models detect sensitive content in files, screenshots, and images. None of this calls out.

The external model only ever performs step 3's job: reasoning and writing, over tokens.

Deterministic tokens preserve context#

Tokens are typed and deterministic: the same phone number produces the same PHONE_8f3a within a configured scope (tenant, user, app, or conversation). The model can therefore track who did what across a long document or conversation — the relationships between entities survive, which is why answer quality stays high. Tokenization covers this mechanism in depth.

Streaming responses are restored live#

Modern AI responses stream token by token, and a restore step that waited for the full response would freeze every chat window. Salus restores inline as the stream arrives, using a small hold-back window — just enough to catch a token split across stream chunks. The stream stays live; the user sees restored values appear in real time.

When something fails#

Every failure mode has a declared behavior, configured per data class. The defaults are conservative: if detection is unavailable, requests carrying sensitive-marked classes are blocked; if the vault is unreachable, a response marked for restore is held rather than delivered with tokens in it. The principle: fail closed by default, per-class configurable — and open never means raw.