A Linux server
Ubuntu 24.04 is the reference, with python3-venv added. Any Linux with Python 3.11 or newer, the venv module and systemd works the same way. Do not install the desktop .deb on this host.
Enterprise
One gateway on every laptop, or one for the whole organization.
PrivacyFence runs on an employee's own computer, or once on a Linux server your organization controls, where everyone signs in through your identity provider. Both are the same open-source software, fully featured, and neither sends data through a PrivacyFence-operated server.
- Works with
- Claude Desktop
- Claude Code
- claude.ai organization deployment
- and other MCP-compatible clients
Side by side
Local mode and organization mode.
| Local mode | Organization mode | |
|---|---|---|
| Where it runs | Each person's own computer: macOS, Windows or Debian/Ubuntu | One Linux server the organization runs, behind its HTTPS reverse proxy |
| Who uses it | The people signed in to that computer, each with their own connectors, rules and approvals | Everyone your identity provider lets in, each kept apart: connectors, approvals, passkeys and audit log per person |
| Sign-in | None: the companion app opens the pages already signed in | Your OpenID Connect identity provider |
| AI clients | Claude Desktop and Claude Code on the same computer | Claude Desktop, Claude Code and web clients such as claude.ai, through OAuth 2.1 |
| Install | The installer (.dmg, .exe or .deb) | pip install privacyfence into a virtual environment, run by systemd |
| Protection from the AI client | Privilege separation: PrivacyFence runs under its own service account | The AI client reaches the server only through /mcp |
| Policy | Set by the person, in Settings | Privacy filter and PII detection set install-wide by admins; each person keeps their own always-allow rules |
| Passkey step-up | On by default with the installers | Set in the organization config bundle |
| Verified AI-system identity | No: the name a client sends is shown as not verified | Admins pin OAuth clients to known AI systems |
| Audit log | On the computer | On the server, and optionally forwarded to syslog or an HTTP endpoint |
In both modes, connector credentials stay with PrivacyFence and never reach the AI client. Local mode is described in Getting started, the difference in trust in Security and compliance.
Before you start
Prerequisites for an organization deployment.
A hostname and TLS
A public hostname with DNS pointing at the server, and a certificate for it. If people will use claude.ai, the hostname must be reachable from the internet, because claude.ai connects from Anthropic's servers.
A reverse proxy on the same host
Caddy or nginx terminates HTTPS and forwards to PrivacyFence on 127.0.0.1. PrivacyFence trusts forwarded headers only from proxies listed with --server-trusted-proxy, so a proxy on the same host is listed as 127.0.0.1.
Your identity provider
Admin access to register one OpenID Connect client. You name which claim makes someone an admin, and can limit sign-in to your domains or a group.
Connector apps
Admin access to each service's developer console, to register one OAuth app per service you offer: Google, Slack, Salesforce, Atlassian. Each person then connects their own account. Outbound HTTPS from the server to those APIs and to the identity provider.
The bundle builder
build_org_bundle.py, attached to every stable GitHub Release, builds and signs org_config.json, the organization's settings. It needs only Python's standard library, plus cryptography for signing.
The prerequisites in full, and the reverse proxy settings, are in the organization deployment guide.
Sizing
Limits of one deployment.
| People with connectors loaded at once | 200 |
|---|---|
| Registered AI clients | 2,000 |
| Pending approvals | 50 in all, 20 per person |
| Upload slot | 50 MB |
An organization deployment is one daemon, not a cluster. Every limit, and which can be changed, is in the guide's Limits table.
Evaluating it
Open source, with no commercial offering.
PrivacyFence is published under Apache 2.0 by a private person. There is no paid tier or support contract: questions and bugs go to GitHub issues or [email protected], and vulnerabilities to the security policy.
Before a rollout, read what PrivacyFence does not claim, and plan for it: pin a reviewed release and give someone the job of tracking new ones.
Deploy
Set up a central deployment.
The organization deployment guide takes an administrator from an empty server to the first sign-in, with Caddy or nginx, a hardened systemd unit and a validation checklist.