RedactNode
TANDA GATEWAY/REVERSE PROXY & TOKEN VAULT

Zero-Knowledge AI Inference. Raw Data Stays Home.

Tanda Gateway sits between your internal applications and external AI providers. It intercepts outgoing prompts, replaces sensitive Malaysian identifiers with reversible surrogate tokens, and restores responses before returning to your callers.

< 3ms End-to-End Gateway Overhead
OpenAI API Wire-Compatible
Streaming SSE Re-Hydration
Gateway Lifecycle Trace
https://gateway.internal.firm/v1
PROXY ACTIVE (2.1ms total)
LOCAL TOKEN VAULT SUBSTITUTION:3 TOKENS GENERATED
MyKad NRIC:901024-14-5821
MYKAD_TOKEN_901024
Financial Income:RM 16,500
SALARY_TOKEN_16500
Account Balance:RM 42,000
BALANCE_TOKEN_42000
Sanitized Stream: "Assess debt service ratio for borrower [MYKAD_TOKEN_901024] with gross salary [SALARY_TOKEN_16500] and Maybank balance [BALANCE_TOKEN_42000]."
API Reference
[ 01 / INTEGRATION PATTERN ]

Drop-in replacement for any OpenAI-compatible SDK

No complex SDK refactoring. Point your application's base URL to Tanda Gateway. Existing code, prompts, tool calls, and structured outputs function without modification.

Works with LangChain, LlamaIndex, and Semantic Kernel
Compatible with OpenAI, Anthropic, Gemini, and Ollama
Preserves function calling and JSON mode schemas
python_openai_client.py
ZERO REFACTORING
from openai import OpenAI

# 1. Point the client to your internal Tanda Gateway boundary
client = OpenAI(
    base_url="https://gateway.internal.firm/v1",
    api_key=os.environ["REDACTNODE_GATEWAY_KEY"]
)

# 2. Existing prompts with Malaysian identifiers execute unmodified
# Tanda Gateway automatically strips PII before forwarding to OpenAI
response = client.chat.completions.create(
    model="gpt-4o",
    messages=[
        {"role": "user", "content": "Review loan for MyKad 901024-14-5821"}
    ],
    stream=True  # Streaming tokens re-hydrated dynamically in real time
)

for chunk in response:
    print(chunk.choices[0].delta.content or "", end="")
[ 02 / PROXY CAPABILITIES ]

The control plane for responsible enterprise AI

Tanda Gateway is not a passive firewall. It is a stateful, high-throughput protocol engine built for high-volume operational workloads.

STAGE 01

Streaming SSE Re-Hydration

< 2ms chunk latency

Intercepts Server-Sent Events (SSE) token by token. Re-hydrates surrogate tokens back into original values on the fly without waiting for the full response to finish generating.

Latency: < 2.5msACTIVE
STAGE 02

Ephemeral In-Memory Vault

AES-256-GCM encryption

Token pairs reside in an isolated Redis cluster with configurable time-to-live (TTL). When a chat session closes, the cryptographic keys are shredded from RAM.

Latency: < 2.5msACTIVE
STAGE 03

Sovereign Model Routing

Multi-provider policy

Enforces custom data classification boundaries. Directs restricted banking or healthcare prompts to on-premise local models, while routing general tasks to cloud APIs.

Latency: < 2.5msACTIVE
STAGE 04

Zero-Honeypot Audit Stream

SHA-256 cryptographic logs

Emits structured compliance telemetry recording timestamps, rule IDs, and hash digests without creating a vulnerable central database of employee prompts.

Latency: < 2.5msACTIVE
[ 03 / OPERATING ENVIRONMENTS ]

Choose the boundary your organization can operate

Start with a managed cloud pilot, then migrate to dedicated VPC infrastructure or fully air-gapped hardware when data residency mandates require it.

Hosted Sovereign Gateway

FAST PILOT

Managed multi-tenant or dedicated gateway instances operated by RedactNode. Ready in minutes for teams validating the prompt sanitization workflow.

Zero infrastructure maintenance
Automatic rule grammar updates
SOC 2 Type II data handling
Immediate API key provisioning
Request Tanda Proxy access

Private Cloud VPC Cluster

RECOMMENDED

Deploy RedactNode Gateway containers inside your own AWS, Azure, or Google Cloud VPC. Token vaults and encryption keys remain exclusively in your network boundary.

Kubernetes Helm & Docker Compose
Customer-managed Redis and DB
Zero external telemetry egress
Custom internal DNS resolution
Request Tanda Proxy access

Air-Gapped Hardware Enclave

BNM RMiT ALIGNED

Self-contained physical server installation for regulated financial institutions and defense environments requiring strict physical data isolation.

No outbound internet connectivity required
Local offline regex & tokenizer engine
Integrated with on-premise vLLM / Ollama
Hardened Linux operating image
Request Tanda Proxy access
INFRASTRUCTURE READY/DOCKER & KUBERNETES

Bring Tanda Gateway into your security perimeter

Pull container images from our private registry, evaluate latency metrics against production workloads, and maintain sovereign control of your sensitive enterprise prompts.