Your AI Is Getting a Bouncer: What a Privacy Gate Is and Who's Shipping One

You paste a client’s bank statement into an AI tool to summarize it, and for the first time, the tool stops and asks: this file has names, an account number, and a home address in it. Do you want to handle that part on your Mac, send it to the cloud anyway, or skip it?

That pause is new. It’s called a privacy gate, and in the last six months the three companies you’d least expect to agree on anything (Perplexity, OpenAI, and Apple) have all shipped a version of one. This post explains what the gate is, who’s building it, and which version makes sense for a small business.

A bouncer, not a vault

The usual way people think about AI privacy is a vault. You pick a vendor, read their policy, decide whether to trust the vault, and then everything you type goes in. The decision gets made once, per vendor, usually on the day you sign up, and then you stop thinking about it.

A privacy gate is a bouncer at the door instead. It looks at each thing you’re about to send and decides whether it should go through. The vault still matters, but now there’s a second check that happens every single time, and it happens on your side of the door.

What makes this possible now is that the bouncer is tiny. The detection models behind these gates are a fraction of the size of the AI you’re talking to, small enough to run on a laptop or inside a browser tab without you noticing. So the big, capable model can live in someone’s data center while the “is this private?” decision stays on your machine.

Who’s shipping one

Perplexity: the gate you can see

In September, Perplexity added what it calls hybrid compute to its Mac app. When you attach a file or paste content, a local model scans it for personal data. If it finds some, the app pauses and gives you three choices: run that step on your Mac, send it to the cloud model, or skip it. It’s available on the Pro, Max, and Enterprise plans on macOS 15 or newer.

The interesting part is that they open sourced the bouncer. The detector is called PII-Tracer, a model with roughly 600 million parameters (a measure of model size; the AI you chat with is hundreds of times larger) released under the MIT license. It tags nine categories of personal data and also scores an entire conversation for how sensitive it is overall. The research paper behind it makes a specific claim: most PII detectors look at one message at a time, so when a client’s name shows up in message one and again in message nine, they miss the second mention. PII-Tracer was built to track identifiers across a whole conversation.

OpenAI: the gate anyone can build with

Back in April, OpenAI released something similar and quieter: Privacy Filter, an open-weight model under the Apache 2.0 license. It detects eight categories of personal data, and it’s small enough to run in a web browser. OpenAI says it uses a version of the same model, tuned on its own data, in its own internal workflows.

Two things stand out about it. First, it can read very long documents in one pass (128,000 tokens, roughly a 300-page book), where Perplexity’s model needs long files chopped into chunks. Second, its model card is unusually blunt. OpenAI describes it as “a redaction and data minimization aid, not an anonymization, compliance, or a safety guarantee,” and specifically warns about medical, legal, financial, and HR workflows. More on that below.

Apple: the gate you never see

Apple Intelligence has had a privacy gate since 2024, but it’s invisible. Requests go to the on-device model first. If the task is too hard, they move to Private Cloud Compute, Apple’s servers that are designed so Apple itself can’t read what you send, and Apple publishes the server software so outside researchers can check that claim. The only time a request leaves Apple’s world is when you’ve switched on an outside model like ChatGPT, and Apple asks you before each one goes.

The tradeoff is that you don’t choose. There’s no setting that keeps everything on-device, and Apple hasn’t published the rules for when a request gets sent up. It’s a gate that works on your behalf without ever consulting you.

The five rungs

If you want a privacy gate of your own, you don’t have to adopt any of the tools above. They’re the newest rungs on a ladder that’s been forming for a couple of years. Here it is, from “takes thirty seconds” to “requires a server in a closet.”

Rung 1: Flip the setting you already have. ChatGPT and Claude both let you turn off “use my conversations to improve the model” on their consumer plans. On their business plans and their developer APIs (the plumbing other software uses to talk to the model), training is off by default. This isn’t a gate (your data still goes to the vendor), but it’s the baseline, it’s free, and a surprising number of people have never looked for it.

Rung 2: A browser extension. Nightfall makes one for ChatGPT that scans what you’re typing and redacts personal data before you hit send. It’s a gate for one tool in one browser, which covers the way most small business owners use AI.

Rung 3: A product with the gate built in. Perplexity’s hybrid compute and Apple Intelligence both belong here. You pay for the product and the bouncer comes with it. This is the rung most readers of this blog should be looking at, because it requires no setup and no technical judgment.

Rung 4: Assemble your own. For people who build tools: Microsoft Presidio is the long-standing open source detector (rules plus a small language model, MIT licensed). LiteLLM, a popular open source router for AI traffic, can run Presidio as a check on every request and send flagged ones to a local model instead of the cloud. Cloudflare’s AI Gateway does something similar with its data-loss-prevention profiles. One caution: LLM Guard, which used to be the go-to toolkit here, was archived in July after Palo Alto Networks bought the company behind it. Open source projects have lifecycles too.

Rung 5: Go fully local. Run the model itself on your own hardware with Ollama or LM Studio, and nothing leaves the building at all. No gate needed because there’s no door. The cost is capability: the open models have gotten good, but the hardest tasks still go to the frontier models in the cloud. I wrote about which models fit which Macs in The Open Source Flood. For what it’s worth, my own setup is a Mac Studio running local models that my laptop talks to over a private network, and most of my client-sensitive work runs there.

Why this matters for you

Here’s the shift underneath all of this. For three years, the only real privacy decision available to a small business was “which vendor do I trust.” That’s a bad decision to have to make, because the honest answer for most people is “I don’t know, and I don’t have time to find out.”

A privacy gate changes the shape of the decision. Instead of trusting a vendor with everything, you trust them with the parts that aren’t sensitive and keep the rest at home. Instead of deciding once, the software decides per request, and in the good versions, it tells you when it’s unsure.

That’s a better fit for how small businesses work. You don’t have a compliance team. You have a laptop and a pile of client files, some fine to send anywhere and some absolutely not. A bouncer that can tell the difference, even imperfectly, beats a vault you have to trust blindly.