Does my data go through PrivacyFence's servers?
No. There are none. PrivacyFence runs on your own computer, or on a server your organization controls. Every tool call goes from there straight to the provider: Google, Slack, Salesforce, Atlassian or Telegram. No hosted service sits in the data path, and your connector sign-ins stay with PrivacyFence, never with the AI client.
The AI client itself is a different matter: whatever you approve is sent to the AI, under that AI provider's terms. PrivacyFence decides what reaches it.
This website is separate from the product. It uses Google Analytics, only if you accept it in the cookie banner; the privacy policy says what it collects.
Which AI clients work?
PrivacyFence is tested with these clients, and any MCP-compatible client can connect:
- Works with
- Claude Desktop
- Claude Code
- claude.ai organization deployment
- and other MCP-compatible clients
Web clients reach PrivacyFence only through an organization deployment, because on a single computer PrivacyFence listens only on that computer. How an AI client connects has the steps for each.
What does the AI see before I approve?
Only what it already had: the tool it called, the arguments it sent, and a status telling it to wait. PrivacyFence may fetch the content first, to build your card and check it for personal data, but that content stays inside PrivacyFence until you allow it. If you deny, the AI gets nothing from it.
Lookups that disclose little, such as searching email subjects or listing files, run without a card and are audited. Which tools those are is fixed in code and listed per connector on Connectors.
What the AI sees before approval
Can routine requests run without approval?
Yes, within limits you set. An always-allow rule lets matching requests run without a card: mail from your company's domain, one Drive folder, one Slack channel, one Jira project. You can add one from a card's Always allow button, from Settings, or by letting the assistant propose it for you to confirm. Every request a rule lets through is still audited.
Rules only ever add permissions, and they cannot overrule the PII check: a read with likely personal data in it still comes to you. For scheduled work with nobody watching, a run can declare itself unattended, so anything no rule covers is refused at once instead of waiting.
Always-allow and policy rules
Is PrivacyFence certified?
No. PrivacyFence has no security certification, no business-continuity plan and no service-level agreement. It is open-source software that you run yourself, so there is no PrivacyFence-operated infrastructure to certify, and installed copies keep running without the maintainer.
Using it does not by itself satisfy a regulation or a contract either: that depends on your configuration, identity provider, retention and your own assessment. Where policy asks for a certification, organizations typically approve PrivacyFence through an exception process, pin a reviewed release, and assign an internal owner to track releases.
What PrivacyFence does not claim
Local or organization mode?
Local mode is the default: the installer for macOS, Windows or Linux runs PrivacyFence on one person's computer, under its own service account, for Claude Desktop and Claude Code on that computer. No server and no sign-in are needed.
Organization mode runs one PrivacyFence on a Linux server your organization controls, behind your HTTPS reverse proxy. People sign in through your identity provider, administrators set the privacy filter and PII check for everyone, and web clients can connect too.
Local and organization mode side by side
Is it free?
Yes. PrivacyFence is open source under the Apache License 2.0, with no paid tier, no account and no commercial offering. The services you connect are your own accounts with Google, Slack, Salesforce, Atlassian or Telegram, on whatever plan you already have.
Source code on GitHub
How do I verify a download?
The download page lists the SHA-256 checksum of every installer. Compute the checksum of the file you downloaded and compare the two before running it; if they differ, do not run the file.
shasum -a 256 <file> # macOS
sha256sum <file> # Linux
Get-FileHash <file> -Algorithm SHA256 # Windows
Stable releases are also signed: the macOS installer is signed and notarized by Apple, and the Windows installer is Authenticode-signed. Pre-release builds may not be. Each install guide has the exact command: macOS, Windows, Linux.
