Secrets stay out of prompts. Personal data stays out of answers.
Tempr checks what people and apps send to a model, and what the model sends back. Secrets and personal data are flagged, masked or blocked by rules you set, whether the request came from an IDE, the terminal, an agent run, Claude Code, Codex or your own app.
Checks on the way in and the way out.
Flag, mask or block
Flag a match and let it through, replace secrets (or secrets and personal data) with placeholders, or refuse the request outright.
Masking on Gateway Pro and upDetectors built in
Cloud and API keys (AWS, Anthropic, OpenAI, GitHub, GitLab, Slack, Google, Stripe, npm and Tempr), PEM private keys, card numbers that pass the Luhn check, and personal data such as email addresses.
Your own rules
Up to 20 patterns of your own, values that are never flagged, and built-in categories you can turn off.
Gateway Pro and upAnswer scanning
Flag or mask secrets and personal data in a model's answer before anyone sees it, streamed answers included.
Gateway Pro and upTest before you turn it on
Paste text next to any guardrail setting and see each match highlighted, the text after masking, and whether the request would be refused.
An LLM check
An optional model-based check for what patterns can't catch, on top of the detectors.
Gateway Pro and upThe same rules for people, agents and apps.
Members' own turns are checked like API traffic.
Owners and admins choose how the organization checks what its members send from the IDE extensions, the CLI and agent runs, with the same settings as Gateway keys and an override per key.
- One guardrail setting for the organization
- Overrides per key
- MCP tool calls checked in both directions
Nobody holds a raw provider key.
People and apps get virtual keys you can scope, limit and revoke, while the provider keys stay in Tempr, encrypted at rest. Sign-in goes through your identity provider, and every change is in the audit log.
- Virtual keys with an IP allowlist each
- SSO with SAML or OIDC and enforced domains, on Teams and Enterprise
- An audit log of who changed what, and through which app
- AI agents can tighten your Gateway; loosening waits for your approval
What Tempr records, and what it never does.
End-user ids are hashed per account before any provider sees them. Responses say what a guardrail did as counts per kind, never the values, and request logs are kept for 7, 30 or 90 days depending on your plan.
- Hashed end-user ids
x-tempr-guardrails: redacted=aws-key:1, counts only- Logs kept 7, 30 or 90 days by plan
x-tempr-cost-usd: 0.0041
server-timing: tempr;dur=11
About guardrails.
What does the Free plan include?
Detecting secrets and personal data, and flagging or blocking requests that contain them. Masking, your own rules, answer scanning and the LLM check come with Gateway Pro, Scale and Enterprise.
Can I see what was masked?
Each request's page in the Portal shows what the guardrail did, and the response carries counts per kind in x-tempr-guardrails. The masked values themselves are never sent back.
Does this cover Claude Code and Codex?
Yes. Their requests go through Tempr like any other, so the same guardrails apply, along with your budgets and logs.
Turn on guardrails before the next paste.
Start by flagging, see what your team sends, then mask or block.