Interactive preview: runs in your browser, nothing is sent

See what Kepta does with one AI request

If your business sends customer messages to AI models, those messages can carry personal data. Kepta sits between your apps and the AI provider.

This demo follows one customer complaint through Kepta in five steps. It shows what Kepta hides, what it decides, what it records and how anyone can check that record.

Each step starts in plain English. Developers, engineers and architects can open the technical detail under any step.

Example with invented data. Kepta is not released yet.

This preview needs JavaScript to run.With it off, each step below shows the sample as a static example. Nothing has been worked out.

Interactive preview: runs in your browser, nothing is sent

Step 1 of 5 · A request arrives

Request received

What happens

A building society member types a complaint into the society's online assistant. The assistant's app sends the message to Kepta, not straight to the AI provider.

What it means for your business

Every AI request your apps send through Kepta passes your rules first. You decide what reaches an AI provider.

Member's message The sample message. With JavaScript on, you can edit it and the steps below re-run.

Hi, I'm Priya Halloran (NI number QQ 12 34 56 C). On 14 October £1,250.00 left my account as a transfer to GB82WEST12345698765432 that I never authorised, and there's a £49.99 charge on my card 4242 4242 4242 4242 that I don't recognise. I've rung twice this week and been cut off both times. Please refund both and post the paperwork to 27 Wharf Approach, Leeds LS1 4DY.

Technical detailEndpoint, Kepta key, route and what was returned

Your app sends this to Kepta's base URL with its own Kepta key.

Endpoint: POST /v1/chat/completions
Kepta key: complaints-assistant prod kp_live_…7Q2c
Organisation: Merrow Vale Building Society
Workspace / project / use case: Member services / complaints-assistant / Complaint triage
Data subject: Pseudonym psn_7f3a91…c912
How the subject was found: Verified: end-user token from login.merrowvale.example, claim iss+sub
Model requested: example-model
Route: example-llm, region eu-west
Returned to your app: Example response: no model was called

Interactive preview: runs in your browser, nothing is sent

Step 2 of 5 · Personal data is hidden

Personal data found and redacted

What happens

Kepta reads the message before it leaves and looks for personal data. In this demo it looks for National Insurance numbers, bank account numbers (IBANs) and card numbers.

What it means for your business

The AI provider gets labels such as [UK NI number] in place of the real numbers. Less personal data leaves your business, and each removal is recorded.

Person names and street addresses are not checked: the name detector is off in this policy. Name detection is an optional part of Kepta, and this preview doesn't run it.

Original, as Kepta received it

Your text. Dashed underline: an identifier the preview found.

System

You triage member complaints for Merrow Vale Building Society. Classify the complaint and draft a short holding reply.

User

Hi, I'm Priya Halloran (NI number QQ 12 34 56 C (found: UK NI number)). On 14 October £1,250.00 left my account as a transfer to GB82WEST12345698765432 (found: IBAN) that I never authorised, and there's a £49.99 charge on my card 4242 4242 4242 4242 (found: Payment card) that I don't recognise. I've rung twice this week and been cut off both times. Please refund both and post the paperwork to 27 Wharf Approach, Leeds LS1 4DY.

Returned to your app

Example response: no model was called

Category: unauthorised payment. Holding reply: "Thank you for telling us, Ms Halloran, and I'm sorry you were cut off. We've logged your complaint and will reply in full within 15 business days."

Provider-facing, after redaction

What example-llm would receive. Each masked value is replaced by its label.

System

You triage member complaints for Merrow Vale Building Society. Classify the complaint and draft a short holding reply.

User

Hi, I'm Priya Halloran (NI number [UK NI number]). On 14 October £1,250.00 left my account as a transfer to [IBAN, token 1] that I never authorised, and there's a £49.99 charge on my card [Payment card] that I don't recognise. I've rung twice this week and been cut off both times. Please refund both and post the paperwork to 27 Wharf Approach, Leeds LS1 4DY.

Provider returned

Example response: no model was called

Category: unauthorised payment. Holding reply: "Thank you for telling us, Ms Halloran, and I'm sorry you were cut off. We've logged your complaint and will reply in full within 15 business days."

Technical detailWhere each identifier was found, the detector and the redaction record

Kepta checks the prompt before it leaves; here the check runs in your browser. Each redaction is its own ledger record.

In the sample, the preview finds 3 identifiers when it runs
Identifier	Where	Detector	Action	Redaction record
UK NI number	characters 35–47	`uk-nino 1.0`	mask	`01JBX7K2MA…7C1P`
IBAN	characters 108–129	`iban-mod97 1.0`	reversible tokenisation	`01JBX7K2MA…7C1Q`
Payment card	characters 195–213	`card-luhn 1.0`	mask	`01JBX7K2MA…7C1R`

Interactive preview: runs in your browser, nothing is sent

Step 3 of 5 · Your rules are applied

Policy decisions

What happens

Kepta applies your organisation's rules before the request goes on. They say what to hide, where the data may be processed and what to refuse.

What it means for your business

The same rules apply to every request that passes through Kepta, and each decision is written down before anything is sent.

Hide personal dataWorked out when the preview runsWorked out when it runs
Where the data may go✓ Allowed: example-llm in eu-west is in the EUFixed example
Check for prompt injection— Not run in this previewNot run
Who is asking✓ The member's user id is sent as a pseudonymFixed example

Technical detailPolicy versions and the residency attestation

Policy settings schema v3. Each decision is written to the ledger before the request goes on.

4 decisions
Policy	Setting	Outcome	In this preview
Redaction	member-data v12	Worked out when the preview runs	Worked out when it runs
Residency	allowed geographies: UK, EU	✓ Allowed: `example-llm` `eu-west` is in the EU	Fixed example
Guardrail	prompt-injection v2.1	— Not run in this preview	Not run
Outbound user field	rewrite to pseudonym	✓ Rewritten: `user` sent as `psn_7f3a91…c912`	Fixed example

Residency attestation

Fixed example. In Kepta this records where the call went; no call is made here.

Base URL: eu-west.example-llm.example
Location: eu-west (EU)
Model served: example-model-2026-10
Region the provider reported: ✓ eu-west, matches the pinned location

Interactive preview: runs in your browser, nothing is sent

Step 4 of 5 · A sealed record is kept

The signed record

What happens

Kepta writes down what happened and signs it. Each record also carries a fingerprint of the record before it, so the records form a chain.

What it means for your business

If a customer or a regulator asks what your AI was sent, you have a record to show them. A changed record breaks the chain, so the change shows.

Record 1 of 4UK NI number hiddenFirst in this page’s chainSigned when the preview runs
Record 2 of 4IBAN replaced with a tokenCarries record 1’s fingerprintSigned when the preview runs
Record 3 of 4Payment card hiddenCarries record 2’s fingerprintSigned when the preview runs
Record 4 of 4AI request recordedCarries record 3’s fingerprintSigned when the preview runs

Technical detailThe signed core, hashes, signing key, signature and chain

Built in your browser from your message: one record per redaction, then one model-call record.
Each record carries the hash of the record before it.
Rows marked "computed" are worked out in this page; the rest are fixed examples.
Hashes are SHA-256 over this preview's own byte encoding, which is not Kepta's published record schema.

Signed core

Schema kepta.ledger/1.0, in this preview's own encoding.

Record id: 01JBX7K2M9…Q4M2
Time (UTC): 28 Oct 2026 14:03:11.482 UTC
Operator / organisation: self-hosted / Merrow Vale Building Society
Workspace / project / use case: Member services / complaints-assistant / Complaint triage
Actor: user · pseudonym psn_7f3a91…c912
Event class: model.call
Provider / region: example-llm · eu-west
Model requested / served: example-model / example-model-2026-10
Trigger family: operation
Purpose tags: deployer monitoring
Previous hash · computed: Worked out when the preview runs
This record's hash · computed: Worked out when the preview runs
Algorithms: SHA-256 hash · Ed25519 signature
Signing key · computed: Made when the preview runs
Signature · computed: Not computed: the preview needs JavaScript

Hash chain

Each record carries the hash of the one before it. Change one character in step 1 and every hash from that record on changes.

Start of this page's chainsha256:00000000…0000
↓ previous hash
01JBX7K2MA…7C1P redaction, UK NI numberWorked out when the preview runs
↓ previous hash
01JBX7K2MA…7C1Q redaction, IBANWorked out when the preview runs
↓ previous hash
01JBX7K2MA…7C1R redaction, Payment cardWorked out when the preview runs
↓ previous hash
This record · 01JBX7K2M9…Q4M2 model.callWorked out when the preview runs

Not in a checkpoint.Kepta signs checkpoints over batches of records. This preview issues none.

Encrypted payload

In Kepta, the prompt, the response and the call settings sit beside the signed core in an encrypted payload. This preview encrypts nothing and keeps nothing.

Interactive preview: runs in your browser, nothing is sent

Step 5 of 5 · Anyone can check the record

Export and check it

What happens

You can take the records out of Kepta and check them with Kepta's open-source verifier. It runs on your own computer and needs no network.

What it means for your business

Anyone with the export can check it with the open-source verifier, your auditor included. In Kepta, an export like this is evidence for your record-keeping controls.

Community build

Check the records yourself

This page runs three of the verifier's checks on an export of the records in step 4.

Needs JavaScript. With it on, this step builds an export of the records in step 4 and runs the verifier’s checks on it, here in your page.

Enterprise build

Evidence pack

In the Enterprise build, Kepta puts the records for one use case and period into a signed evidence pack. This preview only describes it.

Technical detailThe verifier's output and the evidence pack's contents

Community build

Verifier output

Kepta's verifier is an open-source command-line tool that needs no network access.

The checks appear here when the preview runs.

Enterprise build

What an evidence pack holds

Narrative (JSON, with an HTML rendering): what was recorded for this use case, as evidence for each mapped control
Ledger export and the signed checkpoints that cover it
Control map version 2026.10
Policy and pack versions in force: member-data v12, prompt-injection v2.1, settings schema v3

Kepta is not released yet. Join the waitlist to hear when it opens.

Join the waitlist