Protecto AI Data Control Plane (Privacy Vault)

Protecto Inc is a data security and privacy company based in San Jose, California, which publicly launched its product in January 2022. It addresses a problem that grows as enterprises adopt generative AI: personal, health and confidential data ends up in prompts, RAG indexes and agent tool calls, where it can leak or breach laws such as GDPR, HIPAA, India's DPDP and Saudi PDPL.

The AI Data Control Plane scans structured and unstructured data for more than 200 PII and PHI entity types in over 50 languages, replaces them with consistent, format-preserving or context-preserving tokens, and lets authorized users unmask values on demand with a full audit trail. Context-based access control decides what each user or agent may see. It runs as SaaS, in the customer's VPC or on-premise, with REST APIs, a Python SDK and connectors for major LLMs and vector databases. Named users include Inovalon, Automation Anywhere and Bank of Muscat.

• Sensitive data scanning: Detects 200+ PII and PHI types in 50+ languages.
• Intelligent tokenization: Entropy-based, format-preserving and context-preserving tokens.
• Controlled de-tokenization: Role-based unmasking with a full audit trail.
• Context-based access control: Decides what each user or AI agent may see.
• GPTGuard and AI chat gateway: Masks prompts and responses for LLM chat and RAG.
• Compliance policies: Pre-built policies for HIPAA, GDPR, PDPL and DPDP.

A Vietnamese bank can let a customer service chatbot answer from account records while names, ID numbers and phone numbers stay tokenized. A hospital software vendor can build RAG search over medical notes without exposing patient identities. An insurer can share masked claims data with an analytics partner.

Teams can use LLMs and AI agents on customer data without exposing real identities, because masking preserves meaning for the model. Consistent tokens let data be joined across CRM, warehouse and chat logs without raw PII. The vendor cites 99.99% precision on PII detection and costs about one tenth of an in-house build. Air-gapped and VPC deployment keeps regulated data inside the customer's perimeter.

Enterprises are moving from AI pilots to production copilots and agents that read customer records, while privacy laws require minimization and protection of sensitive data. Vietnam's Personal Data Protection Law and Decree 356 effective in 2026 require encryption or anonymization when sensitive data is transferred, increasing demand for masking layers in AI pipelines.

Protecto Inc, 5576 Oakhurst Ct, San Jose, CA 95129, US. The company announced its launch in January 2022. Reports SOC 2 Type II and ISO 27001 certification and offers a HIPAA BAA. Processes about 13 million documents per day according to its product page.