AI Airlock

A privacy pre-flight for your documents — everything runs on your Mac, nothing leaves it.

Before you paste a document into ChatGPT, Claude, Gemini, or any other AI tool, AI Airlock creates a sanitized working copy: it finds credentials, personal identifiers, and confidential business context, replaces them with neutral placeholders, verifies the clean copy actually contains none of the removed material, and writes a removal note listing what was hidden (types and counts only — never the details themselves).

• 100% local. The renderer is network-blocked at both the session and CSP layer. A bundled Gemma 3 1B model runs through a pinned llama.cpp process on a random loopback port with a per-process key. No telemetry, no cloud, no account.
• Fail closed. Anything the current build cannot fully inspect (encrypted files, macros, images, embedded objects, unknown DOCX parts) blocks the export instead of silently passing through.
• Deterministic where it matters. Structured secrets — private keys, API keys, payment cards, SSNs, emails — are found and replaced by validated rules, not model judgment. The local model only proposes semantic passages (strategy, financials, client, HR, legal, unreleased work) for your review; deterministic code applies your decisions and independently verifies the output.
• Your original is never touched. Exports are new files only; source overwrite is refused; the source is hash-checked again immediately before every save.

Download

Grab the latest AI-Airlock-<version>-arm64.dmg from Releases.

Requirements: Apple Silicon Mac (M1 or later), macOS 13+. The download is ~1 GB because the Gemma model and llama.cpp runtime are bundled inside — that's what makes it fully offline.

The current build is ad-hoc signed (not yet notarized), so on first launch macOS will warn you:

1. Open the DMG and drag AI Airlock to Applications.
2. Double-click it once — macOS will block it. That's expected.
3. Go to System Settings → Privacy & Security, scroll down, and click Open Anyway.

Supported inputs: pasted text, .txt, .md, and text-only .docx (up to 25 MB / ~300,000 characters per scan).

What it does NOT do

• It does not read images, scans, PDFs, spreadsheets, or slides.
• It does not decide whether your company allows AI tools — every receipt says authorization: NOT_ASSESSED on purpose.
• It does not "anonymize" by rewriting. Removed items become visible placeholders like [EMAIL_01], so you can see exactly what changed.

Local development

npm install
./scripts/fetch-bundled-assets.sh
npm start

Verification

npm run verify:assets
npm test
npm run test:model

See docs/testing-runbook.md for real-file and packaged-app smoke tests.

macOS build

npm run package:dir
npm run package:mac

The current build is Apple Silicon-only and ad-hoc signed. A downloaded build requires macOS Open Anyway approval. Replace mac.identity: "-" with the Developer ID release identity and add notarization credentials when the Apple developer account is ready.

Pinned local model

• Gemma 3 1B instruction-tuned, Q4_K_M GGUF
• Model revision: f9c28bcd85737ffc5aef028638d3341d49869c27
• Model SHA-256: 8ccc5cd1f1b3602548715ae25a66ed73fd5dc68a210412eea643eb20eb75a135
• llama.cpp: b10050

Gemma redistribution notice and terms are bundled under resources/licenses/ and inside the app.

License

AI Airlock is proprietary, source-available software — the code is public so anyone can verify the privacy claims, and official builds are free to use during the early-release period. See LICENSE for exact terms. Bundled third-party components (Gemma model, llama.cpp) keep their own licenses.