The document-privacy engine you drop into your platform.
DataGuard is an API for entity recognition and document transformation. Send a PDF, DOCX, or spreadsheet; get back the sensitive entities inside it, a policy decision, and a redacted or aliased file, with an audit trail for every step. Enterprise and government grade, running on Sidian's own models, deployable in your cloud or fully air-gapped.
- API-first
- White-label
- On-prem / air-gapped
- Own models, no third-party AI
- PII · PHI · Financial · CUI
- Aligns with NIST 800-171
- SOC 2 Type II (in progress)
02 / Why an engine, not a regex
Most tools match patterns. DataGuard reads context.
Regex and keyword lists miss what they were never told to look for, and flag what only looks sensitive. DataGuard runs named entity recognition on the actual content, so it catches the SIN in a scanned contract, the diagnosis in a clinical note, and the account number a template never anticipated, across structured and unstructured documents.
Pattern matching
- Brittle keyword and regex lists you maintain forever
- Misses novel formats, OCR noise, and context
- Blocks whole documents, so AI features get switched off
The DataGuard engine
- NER reads content in context: PII, PHI, financial, CUI
- Handles messy, scanned, and mixed structured / unstructured data
- Aliases instead of blocks, so your AI keeps working on safe data
03 / The API
Four calls, one boundary.
Point DataGuard at a document by text, URL, base64 content, or multipart upload. Get entities, a policy decision, or a finished file back. Authenticate with a bearer key; deploy the same API in your own cloud or on-prem.
Base URL
https://api.sidian.io/org/{your-org-slug}Auth
Authorization: Bearer dg_live_.../scanRaw entity detection. Returns every entity found, grouped by category. No policy, no mutation.
/analyze/reviewFull analysis with redaction recommendations. Nothing is changed, so a human can approve first.
/analyze/autoAnalyze and redact in one call. Drop a file in, get a redacted file out.
/redactApply your own rules directly (REDACT or EXCLUDE), no NER step required.
curl https://api.sidian.io/org/acme/scan \
-H "Authorization: Bearer dg_live_..." \
-H "Content-Type: application/json" \
-d '{
"source": {
"type": "text",
"text": "Patient Jane Doe, SIN 123-456-789, seen 2026-03-14."
}
}'{
"entities": [
{ "category": "PII", "type": "PERSON", "text": "Jane Doe", "confidence": 0.98 },
{ "category": "PII", "type": "SIN", "text": "123-456-789", "confidence": 0.99 },
{ "category": "PHI", "type": "DATE", "text": "2026-03-14", "confidence": 0.91 }
]
}Representative shape. Run it live in the cookbook for the exact payload.
Source types: text, url, content (base64), multipart. File types: PDF, DOCX, PPTX, XLSX, JSON, CSV. Up to 5 GiB per file.
04 / See it work
Identify, transform, comply.
The same three stages every call runs, on one example clinical note. This is a static walkthrough; the live cookbook runs it on your own file.
Source document
Patient Jane Doe (SIN 123-456-789), DOB 1984-02-11, seen at Toronto General on 2026-03-14 for hypertension. Card on file 4111 1111 1111 1111.
| Entity | Category | Type | Confidence |
|---|---|---|---|
| Jane Doe | PII | PERSON | 0.98 |
| 123-456-789 | PII | SIN | 0.99 |
| 1984-02-11 | PII | DOB | 0.97 |
| Toronto General | PHI | FACILITY | 0.93 |
| hypertension | PHI | CONDITION | 0.90 |
| 4111 1111 1111 1111 | Financial | CARD | 0.99 |
NER returns every entity with its category and a confidence score.
05 / What you're integrating
Five controls, one embedded layer.
Drop DataGuard into your product and inherit a complete data-leak-prevention stack: detection, policy, redaction, and a zero trust foundation, held to enterprise and government standards.
Entity recognition
NER identifies sensitive data the moment it moves: PII, PHI, financial records, privileged material, and Controlled Unclassified Information, across structured and unstructured content. No manual tagging, no brittle keyword lists.
Policy engine
A configurable rules engine decides what counts as sensitive and what happens next (redact, alias, flag, or exclude) based on your customer's regulatory regime and your own policies. One engine, many policies, applied consistently everywhere your product sends data.
Redaction and aliasing
Sensitive content is removed or swapped for safe, consistent stand-ins before data is sent, shared, exported, or passed to an AI model. And because we alias rather than simply block, your AI features keep working on real-shaped data instead of being switched off.
Zero trust by design
DataGuard runs on a zero trust model: no implicit trust, least-privilege access, and protection applied at the point of data movement rather than at a perimeter that has already been crossed. Security travels with the data, not just around it.
Audit trail
Every detection, rule cited, and action taken is written to an immutable log and shared back to your platform. A defensible record for your customers' regulators and auditors, produced automatically on every call.
SOC 2 Type II
We are actively pursuing SOC 2 Type II attestation, holding our own operations to the same standard your enterprise and government customers expect from every vendor in your stack.
06 / What you can build
One engine, many integration shapes.
Each of these is a real capability mapped to a real endpoint, not a roadmap. Pick the shape that fits your product.
Pre-flight inspection
Before a user shares or uploads a document, show them exactly what is sensitive inside it. Pure detection, nothing is mutated, so you can warn, gate, or route without touching the file.
Automated redaction pipeline
For trusted, high-volume flows: drop a PDF in, get a redacted PDF out in one call. No human in the loop. Wire it into an export job, an ingestion queue, or an outbound webhook.
Human-in-the-loop review queue
Analyze returns recommendations without changing anything, so your reviewers approve or edit first, then commit the redaction. The right shape for legal, medical, and other high-stakes documents.
Keep your AI features on
Alias sensitive values to consistent stand-ins instead of blocking. Your assistant, search, and analytics keep running on real-shaped data, and nothing sensitive ever reaches the model, so you ship AI where competitors have to disable it.
Sanitize exports and warehouse loads
Clean data on the way out: to a customer export, a BI dashboard, or a data warehouse. Structured formats are first class, so a spreadsheet of records is handled as cleanly as a scanned PDF.
In-region and air-gapped processing
Run the whole engine inside your own infrastructure, including disconnected networks. Data never leaves your tenancy or crosses a border, and there is no outbound dependency on Sidian or any third-party AI.
07 / How it integrates
Embed it. Don't build it.
DataGuard is API-first and white-label, so it runs inside your product under your brand and your UX. You ship a compliance-grade capability in weeks instead of quarters, and your engineering roadmap stays on your core product. Deploy in your cloud or fully on-premises.
MODEL 01
API
Call DataGuard from your product and keep your own UI. The fastest path to a working integration.
MODEL 02
Embedded / white-label
DataGuard runs inside your platform under your brand. Your customers never leave your product.
MODEL 03
On-prem / air-gapped
Deploy entirely inside your own infrastructure, including disconnected and air-gapped networks. No outbound dependency required.
08 / Why teams build on DataGuard
Embed a capability, not a cost center.
You bring the platform and the reach. DataGuard brings the engine and the public-sector credibility, already built and already vetted.
Ship in weeks, not quarters
API-first and white-label, so DataGuard runs inside your product under your brand and your UX. You get a compliance-grade capability without pulling your engineers off your core roadmap.
Clear security reviews faster
Our controls map to the frameworks your customers operate under, so integrating DataGuard helps both of you get through security questionnaires and reviews with evidence instead of promises.
Differentiate with safe AI
Offer the AI features your competitors have to block, because aliasing keeps sensitive data out of the model while keeping the output useful.
Lower risk, raise retention
A defensible audit trail reduces breach and data-processing liability for you and your customers, and an embedded compliance layer is deep, sticky, and grows account value over time.
09 / Security & data sovereignty
Built for the most sensitive environments.
For government, defense, and regulated work, where the data sits and what touches it matters as much as the result. DataGuard is designed so neither ever leaves your control.
Data residency
In plain terms
Your data stays in your environment and your jurisdiction. Nothing is copied out to be processed.
Under the hood
Deployed in-region; data never leaves your tenancy or crosses borders during processing.
Our own models do the work
In plain terms
Protection is run by Sidian's own purpose-built models. No third-party AI ever sees your data.
Under the hood
No calls to OpenAI, Anthropic, or any external API. Models are trained and hosted by Sidian on real regulated documents.
On-prem deployable
In plain terms
Run DataGuard entirely inside your own infrastructure, including air-gapped and disconnected environments.
Under the hood
Containerized into your cloud, private cloud, or on-prem / air-gapped network. No outbound dependency required.
10 / Trust & assurance
Held to the standard your customers audit against.
The engine is government-proven, and Sidian carries the attestations and coverage your enterprise buyers expect from a vendor in their stack.
SOC 2 Type II
Actively pursuing SOC 2 Type II attestation, so your security team can point to an independent report rather than take our word for it.
Cyber liability insurance
Sidian carries cyber liability insurance, so the risk you take on by integrating us is backed, not just asserted.
Government-proven engine
Our core IP was procured and proven through a Canadian public-safety procurement and aligns with NIST SP 800-171, CMMC, and FedRAMP control families for handling Controlled Unclassified Information.
- SOC 2 Type II (in progress)
- Cyber liability insured
- Government-proven
- NIST SP 800-171
- Zero trust (NIST 800-207)
- CUI ready
11 / Let's build together
Give your product a government-ready data layer.
Without building it yourself. We bring the engine and the public-sector credibility; you bring the platform and the reach; your customers get to move fast without tripping a compliance wire.
Talk to our team
Bring your platform and a real use case. In one short call we'll map exactly where DataGuard fits and what an integration looks like.