Control what AI can see
Sensitive reads from supported services can be reviewed before the content enters the AI context. Optional PII detection runs locally.
Open source · Local-first · Human-in-the-loop
AI access without giving AI the keys.
Approve the sensitive. Automate the routine.
AI assistant
PrivacyFence
PolicyHuman approvalPII checksAudit
GmailDriveSlackSalesforceJiraConfluenceCalendarMore
PrivacyFence governs defined connectors and supported operations. It is not a generic proxy for arbitrary MCP tools.
What it is
A gateway you control, between the assistant and your systems.
PrivacyFence is an open-source privacy and approval gateway between AI assistants and your business systems. It connects MCP-compatible assistants such as Claude Desktop and Claude Code to Gmail, Google Drive, Calendar, Slack, Salesforce, Jira, Confluence, Telegram, and more.
PrivacyFence enforces, independently of the AI, what an assistant may see and do. Sensitive reads and consequential actions require human approval, while routine requests can be automated by policy. Optional PII detection runs locally before personal data reaches the AI, and every decision is audited.
PrivacyFence runs on an employee’s own computer (macOS, Windows, or Linux) or as a central deployment on infrastructure the organization controls, allowing web clients such as claude.ai to connect as well. Connector credentials stay with PrivacyFence, never with the AI client, and no data passes through PrivacyFence-operated servers — there are none.
Why PrivacyFence
Permission does not equal intent.
Traditional access control can tell you whether a user may access a system. It does not necessarily tell you whether an AI assistant should perform this specific action, on this specific data, right now.
Control what AI can do
Writes and consequential operations can require explicit approval, with the intended action shown in business terms.
Keep the decision independent
The AI assistant is not the authorization boundary. PrivacyFence applies policy and approval separately from the model making the request.
Informed human approval
See the content before the AI does.
PrivacyFence translates supported operations into human-readable review screens. Instead of approving an opaque tool name or JSON payload, you can inspect the content, target, warnings and reason for the request.
- Review the actual content or action
- See locally detected PII warnings
- Understand why the assistant requested access
- Record accepted, denied and automated decisions locally
Actions need context too
Review what will change before it changes.
For supported write operations, PrivacyFence presents the target and values before execution, so approval is tied to the actual business action rather than a broad permission granted earlier.
Privacy by architecture
Your enterprise data does not need to pass through PrivacyFence infrastructure.
PrivacyFence is designed so credential ownership, policy enforcement, PII checks and audit can remain in the environment you control. Credentials stay in the PrivacyFence daemon rather than the AI-facing bridge.
PrivacyFence runs on macOS, Windows and Debian/Ubuntu Linux, integrating with Claude through MCP. IT can instead opt into org mode — one shared instance on a Linux server, with each person signing in through your organization's own identity provider — for centralized, multi-user deployment. Neither mode runs on PrivacyFence-operated infrastructure. The project governs a defined set of enterprise connectors and operations.
Supported services
Built around real business workflows.
PrivacyFence provides connector-level governance for common enterprise systems rather than pretending every arbitrary MCP tool is understood.
GmailGoogle DriveGoogle DocsGoogle SheetsCalendarContactsTasksSlackTelegramSalesforceJiraConfluence
See governed operations on GitHub →
Open source
Run it yourself. Inspect everything.
PrivacyFence is released under Apache 2.0. Try it locally, inspect the implementation, and tell me what does not work.
0 release downloads
0 GitHub stars