A Linux server
Docker Engine 24 or newer with the Compose plugin 2.24 or newer. Without Docker: Python 3.11 or newer and systemd, as in the deployment guide. Do not install the desktop .deb on this host.
Enterprise
One gateway for the whole organization, or one for yourself.
PrivacyFence runs for one person on their own computer, or once on a Linux server your organization controls, where everyone signs in through your identity provider. Both are the same open-source software, fully featured, and neither sends data through a PrivacyFence-operated server. When an organization server uses PrivacyFence's built-in sign-in apps, only the sign-in redirect passes through the PrivacyFence relay, and an organization can use its own apps instead.
- Works with
- Claude Desktop
- Claude Code
- claude.ai organization deployment
- ChatGPT
- Gemini Enterprise organization deployment
- and other MCP-compatible clients
Side by side
Desktop mode and organization mode.
| Desktop mode (deprecated) | Organization mode | |
|---|---|---|
| Where it runs | Each person's own computer: macOS, Windows or Debian/Ubuntu | One Linux server the organization runs, behind its HTTPS reverse proxy |
| Who uses it | The people signed in to that computer, each with their own connectors, rules and approvals | Everyone your identity provider lets in, each kept apart: connectors, approvals, passkeys and audit log per person |
| Sign-in | None: the companion app opens the pages already signed in | Your OpenID Connect identity provider, or the built-in Google sign-in |
| AI clients | Claude Desktop, Claude Code and ChatGPT desktop (macOS) on the same computer | Claude Desktop, Claude Code and web clients such as claude.ai, ChatGPT and Gemini Enterprise, through OAuth 2.1 |
| Install | The installer (.dmg, .exe or .deb) | The privacyfence-org Docker image with Caddy, configured from environment variables; or pip install privacyfence under systemd |
| Protection from the AI client | Privilege separation: PrivacyFence runs under its own service account | The AI client reaches the server only through /mcp |
| Policy | Set by the person, in Settings | Privacy filter and PII detection set install-wide by admins; each person keeps their own always-allow rules |
| Passkey step-up | On by default with the installers | On the Admin page; there it can only be made stricter |
| Connector apps | The organization's own apps, in a config bundle | PrivacyFence's built-in apps, or the organization's own, uploaded on the Admin page |
| Verified AI-system identity | No: every request is shown as Undetected | Admins pin OAuth clients to known AI systems |
| Audit log | On the computer | On the server, and optionally forwarded to syslog or an HTTP endpoint |
PrivacyFence 7 deprecates desktop mode, and PrivacyFence 8 removes it. Desktop installs keep working through 7.x, without the built-in apps. Move to the Docker image on your computer or to an organization server (moving to organization mode).
In both modes, connector credentials stay with PrivacyFence and never reach the AI client. Desktop mode is described in Getting started, the difference in trust in Security and compliance.
Before you start
Prerequisites for an organization deployment.
A hostname and TLS
A public hostname with DNS pointing at the server, and a certificate for it. If people will use claude.ai, ChatGPT on the web or Gemini Enterprise, the hostname must be reachable from the internet, because they connect from Anthropic's, OpenAI's and Google's servers.
HTTPS in front
The Docker files bring Caddy, which gets the certificate itself. With nginx or another proxy, the deployment guide has the settings; PrivacyFence trusts forwarded headers only from the proxy addresses you list.
Your identity provider
People sign in through your organization's OpenID Connect identity provider, or, for a small Google Workspace team, through PrivacyFence's built-in Google sign-in, which needs nothing registered at Google and admits only verified Workspace accounts. You name the admins by verified email or by a group claim.
Connector apps
PrivacyFence ships its own apps for Google, Slack, Salesforce, Atlassian and Miro, so an organization server, or the Docker image on your own computer, connects them with nothing to register. An organization may register its own app with any of them instead and upload it on the Admin page; its own apps never touch the relay. Each person then connects their own account. The server needs outbound HTTPS to the services' APIs and, for the built-in apps, to oauth.privacyfence.eu.
The Admin page
Administrators run the server from the Admin page: which services are offered and which app each uses, who may sign in, step-up, scoped tokens, audit forwarding and the install-wide privacy filter. Every change that alters what the server does asks for a passkey and is recorded in the audit log. The server address, the identity provider and the admins are set in the environment, not on the page.
The prerequisites in full, and the reverse proxy settings, are in the organization deployment guide.
Sizing
Limits of one deployment.
| People with connectors loaded at once | 200 |
|---|---|
| Registered AI clients | 2,000 |
| Pending approvals | 50 in all, 20 per person |
| Upload slot | 50 MB |
An organization deployment is one daemon, not a cluster. Every limit, and which can be changed, is in the guide's Limits table.
Evaluating it
Open source, with no commercial offering.
PrivacyFence is published under Apache 2.0 by a private person. There is no paid tier or support contract: questions and bugs go to GitHub issues or [email protected], and vulnerabilities to the security policy.
If a data protection officer will review the rollout, AI assistants and the GDPR maps the GDPR principles to what PrivacyFence does, and where the answers for a DPIA are.
Before a rollout, read what PrivacyFence does not claim, and plan for it: pin a reviewed release and give someone the job of tracking new ones.
Deploy
Set up a central deployment.
The organization deployment guide takes an administrator from an empty server to the first sign-in, with Docker and Caddy or with systemd behind your own proxy, and a validation checklist.