Configuration

Latet reads config.yaml from your user configuration folder. latet global-install writes it, and the dashboard’s Rules page changes it. After editing it by hand, latet reload applies it to the running daemon (a new port needs latet stop and latet start).

System	Location
Windows	%APPDATA%\latet\config.yaml
macOS	~/Library/Application Support/latet/config.yaml
Linux	~/.config/latet/config.yaml

An example:

profile: balanced
terms:
- value: Project Falcon
  type: PROJECT
allow_values:
- admin@example.com
policies:
  PHONE: redact
history: full

Keys

Key	Type	Default	Description
profile	balanced or max or secrets	balanced	Protection profile: balanced, max or secrets.
port	number	5283	Local port of the daemon (it listens on 127.0.0.1 only).
phone_regions	list of text	[IT, US, GB]	Countries whose phone numbers are recognised without an international prefix.
id_regions	list of text	[IT, US, GB]	Countries whose national ID and tax numbers are recognised (the max profile: all of them): BE, CA, CH, DE, ES, FI, FR, GB, IT, LV, NL, PL, PT, SE, US. VAT numbers of 30 European countries are recognised whatever this says.
pii	list of text	not set	Personal-data types to detect; not set means the base types and the ID numbers of id_regions, and a list is used as it is.
include_private_ips	true or false	not set	Also mask private IP addresses (10.x, 192.168.x…); on in max by default.
disabled_secret_rules	list of text	[]	gitleaks rule ids to turn off, such as generic-api-key.
terms	list of object	[]	Your own values to always mask.
recognizers	list of objects (see below)	[]	Your own recognizers: a pattern, check digits and keywords for each (see below). An entry with a mistake is turned off and reported, and kept as it is.
allow_values	list of text	[]	Values never to mask (not sensitive).
allow_patterns	list of text	[]	Regular expressions (RE2) of values never to mask.
policies	map of text to mask or redact or allow	{}	Per type: mask (reversible surrogate), redact (one way, never restored) or allow.
identity	object	see below	This machine’s identity.
capture_dir	path	not set	Debugging only: write raw exchanges (credentials redacted) to this directory.
history	full or metadata or off	full	What the dashboard keeps of each exchange: full (masked text and answers), metadata (counts, timings, flags; no text) or off.
retention_days	number	14	Days the dashboard history is kept.
auto_mode_review	block, allow-identity or object	block	Claude Code’s auto mode reviewer is sent your OS user name and the paths of your home and working directories, plus any host name or git author in your CLAUDE.md or in the action. A review that would carry a blocked detail is stopped, and auto mode cannot approve that action: Claude Code refuses it as if its reviewer were unavailable. block blocks every detail, allow-identity lets every detail through, and the keys below choose one by one. Secrets and personal data never reach the reviewer.
ner	auto or off	auto	Local name and address detection: auto uses it once installed (latet ner install), off never does.
ocr	auto or off	auto	The text in images: auto reads it once the models are installed (latet ocr install) and masks what it finds, off never does (images are then sent as they are, and flagged).
data	normal or strict	not set	strict masks every value of tool outputs that are tables (psql, CSV, TSV, markdown, HTML, a browser’s snapshot), JSON or key=value, column and key names aside; fields set mask: false stay in clear. Outputs of tools that read files are left alone unless data_files names the file, and so are web search results and pages (public content, not your data) unless data_tools names their tool or data_hosts their address. Not set: the profile decides, strict with max and normal with the others.
data_tools	list of text	[]	The tools and MCP servers strict data mode covers (* patterns, such as mcp__postgres__*); empty: every tool but those that read files.
data_files	list of text	[]	The files strict data mode covers when a tool reads them: path patterns such as *.json, **/*.csv, exports/** or .env* (* for any characters, in any case; a pattern without a slash names a file by its name). Each value is found by the file’s format: JSON, tables, .env and properties, YAML. A markdown file only when a pattern names markdown (*.md), and then only its tables. A file named is data whether strict data mode is on or off.
data_hosts	list of text	[]	The web addresses strict data mode covers when a web tool fetches them: host patterns such as api.internal.example.com or *.salesforce.com. An address named is data whether strict data mode is on or off.
fields	list of object	[]	Rules for the values of single fields of tables, JSON and key=value.
dump_guard	number	not set	Withhold a tool output that holds more personal values (e-mails, phone numbers, names, ID numbers…) than this: the model is told why instead. Not set or 0: never.
images	allow or mask or block	allow	allow sends images, with their text masked once the text recognition models are installed (latet ocr install); mask sends only images whose text was read and masked, and no documents; block sends no images or documents. The max profile sends none either, unless this says mask.
llm_review	object	see below	The local reviewer: a language model on your own server that reads what the detectors left in clear (see below).
live_review	object	see below	The Live Reviewer: every new text waits for your approval in the dashboard (see below).
projects	list of object	[]	Your own settings for single projects, on top of these and of the project’s latet.yaml (see below).
upstreams	list of object	[]	Where agents’ requests go after Latet, besides Anthropic, OpenAI and OpenRouter: your company’s gateway, Azure OpenAI, Microsoft Foundry. latet claude, latet codex and global-install add the ones they read from your agents’ settings (see below).

terms items

Key	Type	Default	Description
value	text	required	The text to mask wherever it appears: a client, a project code name, a domain. It needs a letter or a digit.
type	text	CUSTOM	The label shown for it, such as CLIENT or PROJECT.
case_sensitive	true or false	false	Match the exact case only.
whole_word	true or false	true	Match whole words only (not inside longer words).

identity

Key	Type	Default	Description
enabled	true or false	true	Mask this machine’s identity (detected each time Latet starts, when the fields below are empty).
usernames	list of text	[]	OS user names, masked inside home paths.
hostname	text	not set	This machine’s host name.
hostnames	list of text	[]	Other host names of yours, masked as hostname is (on a Latet server, each of your computers’).
full_name	text	not set	Your name, as in your git author.
emails	list of text	[]	Your email addresses, as in your git author.

recognizers items

See Custom recognizers for how to write one, and latet rules test to check it.

Key	Type	Default	Description
name	text	required	Lower case letters, digits and hyphens; unique.
type	text	not set	The type shown for it, in capitals; the name in capitals when not set.
description	text	''	What it finds, in words.
pattern	text	required	An RE2 regular expression. A group named value picks the part to mask.
checksum	text or object	not set	Check digits the value must pass: luhn, iban, mod97-10, mod11-10, ean, verhoeff, damm, or a weighted sum.
context	object	not set	Keywords that must be near the value.
examples	object	see below	Invented examples, checked on every load.
class	custom or secret	custom	custom, or secret to treat it like a password (never let through, blocks a request).
policy	mask or redact or allow	not set	mask, redact or allow; policies wins.
surrogate	shape or object	shape	shape (same length and kinds of characters), or {keep: N}.
min_length	number	1	Shorter values are skipped.
enabled	true or false	true	false keeps the rule in the file, turned off.

fields items

A rule for the values of one field of a tool’s output: a column of a table, a JSON key or path, the key of key=value. The first rule that matches a field wins; your own settings for a project come before its latet.yaml, and both before the global rules. See Production data.

Key	Type	Default	Description
name	text	required	The field: a column name, a JSON key or path (items[].sku), or the key of key=value; * matches any characters, and case does not matter.
type	text	not set	The type its values are masked as (FIELD when not set).
mask	true or false	true	false keeps its values in clear in strict data mode (only in your own settings).
secret	true or false	false	Its values are secrets: one in clear blocks the request.

llm_review

The local reviewer: a language model on your own OpenAI-compatible server (llama.cpp, Ollama, LM Studio) reads what the detectors left in clear and masks what it finds. It runs on this machine only, it can add to what is masked but never take anything away, and a text it read once is not read again.

Key	Type	Default	Description
enabled	true or false	false	Ask the local reviewer.
url	text	http://127.0.0.1:8080/v1	Its OpenAI-compatible server (llama.cpp, Ollama, LM Studio): on this machine, or on another machine of yours with remote: true.
remote	true or false	false	The server is yours, on another machine: Latet sends it the original texts. Outside your local network its address must be https.
model	text	not set	The model’s id on the server (not set: the first it lists).
api_key_env	text	LATET_LLM_API_KEY	The environment variable holding the server’s API key, if any. Without it, the key saved from the dashboard or with latet llm key is used (kept in the operating system’s credential store).
api_key_file	text	not set	Or a file holding the key (the key itself never goes in this file).
inline	list of user_text or attachment or system or tool_result or tool_input or tool_description or image_text	[user_text, attachment, system, tool_result, image_text]	What is reviewed before it leaves: by default everything the model did not write (your prompts and attachments, its instructions, what its tools fetch).
budget_ms	number	not set	How long a request may wait for its review (not set: as long as it takes).
on_failure	stop or send	stop	When a review cannot be done (the server is off, too slow for budget_ms, or its answer is not to be trusted): stop the request, or send it masked as the detectors did.
background	true or false	true	Review after it is sent what is not reviewed before: what it finds is masked from the next request on.
slots	number	not set	Reviews the server runs side by side (not set: what llama.cpp says, or 1).
block	true or false	false	Let the reviewer stop a request whose text must not leave even masked (a whole medical record).
auto_mask	list of person or address or phone or email or id or health or sensitive or financial or secret or org or confidential	[person, address, email, phone, secret, health, financial]	Categories it masks by itself; the others are shown in the dashboard as suggestions.
chunk_chars	number	7000	Long texts are reviewed in pieces of about this many characters, 16,384 at most: the longest value Latet keeps, so that what the reviewer finds in a piece is always kept. A larger setting is read as 16,384.
certificate	text	not set	The SHA-256 fingerprint of the server’s certificate you trust, for a self-signed one on another machine of yours: latet llm trust, or Trust it in the dashboard. Only that certificate is accepted.
images	true or false	false	Show the reviewer the images too, with the text read in them (its model must see images: llama.cpp with --mmproj). It finds what text recognition missed; a value it sees but Latet cannot place in the image withholds the image.
guidance	text	not set	Your guidance, added after Latet’s own instructions to the reviewer: what else is confidential in your work, or what to leave alone (at most 2000 characters). It applies to the texts reviewed from then on. It is sent to the reviewer’s server with every review: describe kinds of values, and keep the confidential ones themselves in terms.

live_review

The Live Reviewer: every new text an agent is about to send waits for your approval in the dashboard. You approve it, mask more in it, or stop it; you can only add masking. See Live Reviewer.

Key	Type	Default	Description
enabled	true or false	false	Every new text waits for your approval in the dashboard: you confirm it, or mask more first.
kinds	list of user_text or attachment or system or tool_result or tool_input or tool_description or image_text	[user_text, attachment, system, tool_result, image_text]	What waits for you: by default everything the model did not write (your prompts and attachments, its instructions, what its tools fetch).
auto_approve_clean	true or false	false	Send without asking a text in which neither Latet nor the local reviewer found anything.
timeout_s	number	not set	How long a text waits for you; when the time is up it is not sent (not set: until you answer).

auto_mode_review

One choice per detail of your identity that Claude Code’s auto mode reviewer may receive. block and allow-identity set every detail at once, and are kept that way in the file.

Key	Type	Default	Description
user_name	block or allow or surrogate	block	Your OS user name, which the reviewer is told as its User identity. surrogate gives Claude Code your user name’s surrogate instead (in USERNAME and USER), so the reviewer sees the same fake name as the model.
paths	block or allow	block	Your user folder’s name in the paths of your home and working directories.
host_name	block or allow	block	This machine’s host name.
git_author	block or allow	block	Your name and email, as in your git author.

projects items

Your own settings for one project, on top of the keys above and of the project’s latet.yaml: a value replaces the global one, a list is added to it. See Projects.

Key	Type	Default	Description
profile	balanced or max or secrets	not set	The profile in this project.
pii	list of text	[]	Personal-data types to detect, besides the global ones.
id_regions	list of text	[]	Countries whose national ID and tax numbers to recognise, besides the global ones.
phone_regions	list of text	[]	Countries whose phone numbers to recognise without a prefix, besides the global ones.
include_private_ips	true or false	not set	Also mask private IP addresses.
ner	auto or off	not set	Local name and address detection.
terms	list of object	[]	Values to always mask in this project.
recognizers	list of map of text to Any	[]	Recognizers for this project (a name already in use turns the entry off).
allow_values	list of text	[]	Values never to mask in this project.
allow_patterns	list of text	[]	Regular expressions (RE2) of values never to mask in this project.
policies	map of text to mask or redact or allow	{}	Per type: mask, redact or allow.
disabled_secret_rules	list of text	[]	gitleaks rule ids to turn off in this project.
data	normal or strict	not set	strict masks every value of tool outputs that are tables, JSON or key=value.
data_tools	list of text	[]	The tools strict data mode covers (* patterns), besides the global ones.
data_files	list of text	[]	The files strict data mode covers when a tool reads them (path patterns such as *.json), besides the global ones.
data_hosts	list of text	[]	The web addresses strict data mode covers (host patterns such as *.salesforce.com), besides the global ones.
fields	list of object	[]	Rules for the values of single fields.
dump_guard	number	not set	Withhold a tool output with more personal values than this (0: never).
images	allow or mask or block	not set	mask sends images only with their text read and masked, block sends no images or documents.
ocr	auto or off	not set	Reading the text in images.
llm_review	off or background or inline	not set	How much the local reviewer reads here, when it is on: off, background or inline.
live_review	true or false	not set	Whether new texts wait for your approval in the dashboard in this project.
review_images	true or false	not set	Whether the local reviewer is shown the images in this project. Yours alone: a repository file cannot set it.
review_guidance	text	not set	Your guidance to the local reviewer for this project, added after your global llm_review.guidance (at most 2000 characters). Yours alone: a repository file cannot set it.
path	text	required	The project’s folder; its subfolders are part of it.
enabled	true or false	true	false turns Latet off in this project: nothing is masked or blocked, and surrogates already in a conversation are still restored.

upstreams items

Where an agent’s requests go after Latet, when they go to your company’s gateway, Azure OpenAI or Microsoft Foundry rather than straight to the provider: requests to http://127.0.0.1:5283/<name>/... go to its address. Changing a destination’s address, or removing it, waits for your approval when it does not come from the dashboard. See Company endpoints.

Key	Type	Default	Description
name	text	required	Its route: lowercase letters, digits and dashes (llm-acme-com), and none of Latet’s own (anthropic, openai, chatgpt, openrouter, gemini, bedrock, vertex, backend-api).
url	text	required	The address requests go to, such as https://llm.acme.com: https outside your local network, no user, password or query in it.
agent	claude or codex	not set	The agent whose settings Latet read it from; not set: written by you.

The project file: latet.yaml

A project’s own settings, in its repository, shared with everyone who works on it. It may set these keys, and only to add protection: anything else in it is ignored, and latet project check says what and why. Its JSON Schema lets editors check it.

Key	Type	Default	Description
profile	balanced or max or secrets	not set	The profile in this project.
pii	list of text	[]	Personal-data types to detect, besides the global ones.
id_regions	list of text	[]	Countries whose national ID and tax numbers to recognise, besides the global ones.
phone_regions	list of text	[]	Countries whose phone numbers to recognise without a prefix, besides the global ones.
include_private_ips	true or false	not set	Also mask private IP addresses.
ner	auto or off	not set	Local name and address detection.
terms	list of object	[]	Values to always mask in this project.
recognizers	list of map of text to Any	[]	Recognizers for this project (a name already in use turns the entry off).
policies	map of text to mask or redact or allow	{}	Per type: mask, redact or allow.
data	normal or strict	not set	strict masks every value of tool outputs that are tables, JSON or key=value.
data_files	list of text	[]	The files strict data mode covers when a tool reads them (path patterns such as *.json), besides the global ones.
data_hosts	list of text	[]	The web addresses strict data mode covers (host patterns such as *.salesforce.com), besides the global ones.
fields	list of object	[]	Rules for the values of single fields.
dump_guard	number	not set	Withhold a tool output with more personal values than this (0: never).
images	allow or mask or block	not set	mask sends images only with their text read and masked, block sends no images or documents.
ocr	auto or off	not set	Reading the text in images.
llm_review	off or background or inline	not set	How much the local reviewer reads here, when it is on: off, background or inline.

Server settings

An instance reads these keys from server.yaml, selected with latet server run --config FILE or LATET_SERVER_CONFIG. Its LATET_SERVER_* variables override the file; the master-key file uses LATET_MASTER_KEY_FILE. These are deployment settings, separate from the settings the server shares (latet server config) and each identity’s own settings and rules (the server dashboard). See Server operations for storage, TLS, keys and limits.

Key	Type	Default	Description
url	text	required	The address people use, such as https://latet.acme.lan (http on this machine only).
database_url	text	required	PostgreSQL: postgresql://user:password@host:5432/latet, with ?sslmode=verify-full&sslrootcert=… off this machine.
valkey_url	text	required	Valkey or Redis: redis://host:6379/0 on this machine, rediss://:password@host off it.
master_key_file	path	not set	The master key (LATET_MASTER_KEY gives it too).
host	text	0.0.0.0	Where an instance listens.
port	number	5283	The port an instance listens on.
certificate	path	not set	TLS at the instance (else at the load balancer).
key	path	not set	The private key of the instance’s certificate, in a private file.
log_format	text or json	text	How the log’s lines are written on the standard output: text or json.
log_level	text	info	What Latet’s own lines say from: one of debug, info, warning, error.
metrics_token_file	path	not set	A file holding the token Prometheus asks the metrics with: no file, no metrics.
reviewer_key_file	path	not set	A file holding the local reviewer’s own API key, never another secret, read once at start. Every identity’s reviewer on this server sends it to the shared reviewer’s address set by the administrators, over https or on this machine. The server reads no variable, keyring or saved key for it.
metrics_host	text	127.0.0.1	Where an instance answers Prometheus: an address only Prometheus reaches.
metrics_port	number	7283	The port where an instance answers Prometheus, with metrics_token_file: never the instance’s own port (port).
database_password_file	path	not set	A file holding PostgreSQL’s password.
database_connect_timeout	number	5	Seconds PostgreSQL has to answer a new connection before it is given up.
database_private_network	true or false	false	Reach PostgreSQL over a network that only the instances share, with no checked TLS.
valkey_password_file	path	not set	A file holding Valkey’s password.
valkey_unauthenticated	true or false	false	Reach a Valkey that asks no password: only one nothing else can reach.
valkey_private_network	true or false	false	Reach Valkey over a network that only the instances share, with no checked TLS.
max_request_mb	number	32	The largest request body, in MiB.
requests_in_flight	number	16	How many requests one identity may have in flight on an instance, counted separately for its destinations (HTTP or WebSocket turns), dashboard and bridge: past each limit, 429. Long polls and streams have their own limits.
vault_limit	number	200000	How many values one identity’s vault may hold.
history_limit_mb	number	1024	How many MiB one identity’s history may keep: past it, its oldest exchanges go.
admin_token_days	number	90	How many days a new administration token lasts (--never opts out).
forwarded_allow_ips	text	127.0.0.1	The proxy’s addresses, whose X-Forwarded-For and X-Forwarded-Proto are believed (never *, nor a network wider than /8 for IPv4 or /32 for IPv6).
valkey_connections	number	100	How many connections to Valkey an instance keeps at most: past them a call waits for one, five seconds at most.
audit_retention_days	number	365	How many days the administration log keeps an entry.
ocr_readers	number	2	How many text recognitions an instance keeps, each reading one image at a time, the processors this instance may use shared among them (never more readers than processors): each holds its models in memory (0.05 GB at rest; the first brings ONNX Runtime, 0.7 GB), and up to 0.9 GB more while it reads a large screenshot.
ocr_read_seconds	float	30.0	How long one image’s text may take to read: past it the image is withheld, or the request that only carries it stopped.
ocr_wait_seconds	float	35.0	How long a read waits at most, for its identity’s other read and then for a text recognition: past it, as past the read’s time. Never shorter than ocr_read_seconds.

Environment variables

Variable	Effect
LATET_CONFIG	Read the configuration from this file instead.
LATET_DATA_DIR	Keep the vault, the dashboard history and the logs in this folder.
LATET_TRUSTED_ACCOUNTS	Windows accounts or groups, by name (COMPUTER\name, DOMAIN\name, name) or by SID (S-1-5-… or *S-1-5-…), separated by ; or ,, that may change the parent folders of Latet’s data folder as the Administrators may (the direct members of the local Administrators group may, with no setting); never the data folder itself or a folder in it. Read from the registry alone, your user environment and the computer’s, as setx, the system settings and group policy write them: a value set only in a terminal session counts for nothing. A name Windows does not find, or an account that is not one of this computer, a domain, Entra ID or a service, trusts nothing; latet doctor says so, and lists the accounts trusted and where the variable is set. It changes nothing on Linux and macOS, where the folder checks are by owner and mode.
LATET_ROOT_KEY	The vault’s root key (base64), instead of the OS keyring.
LATET_BRIDGE_TOKEN	Claude plugin token: local bridge token or connected computer’s personal token.
LATET_PORT	The daemon’s port, over port in the file (the container is given its port this way).
LATET_HOST	The address to listen on; anything but this machine only with LATET_CONTAINER=1.
LATET_CONTAINER	1 in the container image: the commands that change your computer refuse.
LATET_KEYRING	off keeps the root key in root.key in the data folder and saves no credential in the OS keyring; an older copy found there makes latet connect refuse until latet disconnect revokes and removes it, and a locked keychain may ask to be unlocked.
LATET_ROOT_KEY_FILE	Read the root key (base64) from this file, such as a Docker secret.
LATET_AUTOSTART	0 in Claude Code’s settings: the plugin does not start a daemon of its own.
LATET_CONNECTION	Read this computer’s private server connection record from this file instead of connection.yaml in its data folder. It holds server, identity and certificate-pin metadata; the personal token is stored separately. Keep the record private.
LATET_SERVER_URL	The public URL of a server instance; also the default server address for administration commands when --server is absent.
LATET_SERVER_FINGERPRINT	The server certificate’s fingerprint for administration commands when --fingerprint is absent. Verify it through a trusted channel before using it.
LATET_SERVER_ADMIN_TOKEN	An administration token from a CI or container secret store, bound to LATET_SERVER_URL. Keep it out of an agent user’s shell environment; use a hidden prompt or --admin-token-file on that computer.

JSON Schema

The file’s JSON Schema (also latet config schema) lets editors complete and check it: latet global-install and the dashboard write a # yaml-language-server line at the top for that. latet config validate checks a file, recognizers included.