Protect PII in Kubernetes logs with Shannon Entropy & O(1) Regex.
Deterministic hashing for debugging. 100% client-side demo.
PII-Shield is an open-source Kubernetes sidecar, written in Go under Apache-2.0, that redacts PII and secrets from container logs before they reach the log collector (Fluent Bit, Fluentd, Datadog, Loki, ELK or the OpenTelemetry Collector). The same engine runs as a CLI binary and as a WASM module for Node.js and Python. There is no hosted service: nothing leaves your pod.
Not to be confused with other tools that share the name: the PII Shield privacy proxy for LLM calls from a Microsoft developer-community blog post (May 2026, by Vikas Gautam, kept in his own repository), the piishield.ai and piishield.com products that redact prompts before they reach ChatGPT or Claude, and the pii-shield package on PyPI by Intellirim. None of them is this project. Our code lives at github.com/pii-shield/pii-shield, our packages are pii-shield-wasi on PyPI and @aragossa/pii-shield-wasi on npm, and in public text we call it the PII-Shield sidecar.
PII redaction with the simplicity of a sidecar.
Detects unknown secrets (API keys, tokens) automatically using Shannon Entropy without predefined patterns.
Engineered for high-load sidecars. A low-allocation scan loop keeps the sidecar light on CPU and memory.
Combine entropy checks with Whitelists (Safe Regex). Explicitly allow safe patterns like Git SHAs to prevent false positives.
25-point checklist: where PII leaks from pods, which log paths bypass your filters, and how to verify redaction actually works. Built for DevOps teams preparing for SOC 2 and GDPR audits.
You'll also get new integration guides, detection rules, and release notes. No spam â unsubscribe at any time.
Seamlessly integrates into your existing Kubernetes pods.
PII-Shield runs as a sidecar container in your Pod, capturing stdout/stderr streams via pipe.
It scans log streams against high-entropy signals (secrets) and deterministic salt patterns.
Only clean, sanitized logs are passed through to your logging agent or collector.
Pull the Docker image or download the binary for Linux/Mac/Windows.
# Pull the latest image
docker pull thelisdeep/pii-shield:latest
# Try with JSON input (PII-Shield preserves structure!)
echo '{"msg":"Login", "pass":"SuperSecret123", "id":42}' | \
docker run -i --rm thelisdeep/pii-shield:latest
# Output: {"msg":"Login", "pass":"[HIDDEN:5a1b2c]", "id":42}
âšī¸ Deterministic Redaction: PII-Shield uses HMAC-SHA256 with a salt.
The same secret always produces the same redacted hash (e.g. [HIDDEN:5a1b2c]),
allowing you to correlate logs across services without revealing the data.
40+ tested GDPR redaction rules, DPO-ready documentation and audit-trail templates, on top of the open-source sidecar. Early access, delivered as a ZIP within 5 working days, 14-day refund.
See what's inside â2 minutes, and it directly shapes what gets built next. Every response goes straight to the maintainer â and you can opt in to be quoted (or stay anonymous).
Talk directly with the creator â a 20-minute call about your log pipeline. No sales pitch; I'm the maintainer and I want to understand your setup.
Same format as the GDPR pack: ready-made redaction rule sets, documentation and audit-trail templates. Leave your email and you'll hear when they ship.
Prefer email? Write to me directly. No spam â unsubscribe at any time.