<p align="center"> <img src="assets/logo/SendaShield_Logo_v0.png" alt="SendaShield — open-source sensitive data protection" width="480"> </p>

SendaShield

Sensitive Data Shield — a self-hosted privacy filter that sits between your AI assistant and your mail and calendar.

When you connect Gmail to Claude or ChatGPT, every message the assistant fetches lands raw in its context window. A request as ordinary as "triage my unread mail" can pull bank statements, medical correspondence, or a lawyer's letter into a third party's system — and into a chat history you cannot delete.

SendaShield inspects every item before it reaches the assistant, masks or withholds sensitive content according to a policy you control, and tells you honestly what was held back.

You run it. Nobody else — including the authors — ever sees your data.

---

What it does

• Masks aggressively, withholds cautiously. Hiding an account number costs you nothing. Hiding a whole message might cost you a deadline.
• Detects by checksum, not guesswork. Luhn for cards, mod-97 for IBANs, the German Steuer-IdNr check digit — near-zero false positives on the identifiers that matter most.
• Understands whole-message sensitivity. A letter from your lawyer contains no detectable identifier. SendaShield still catches it.
• Treats calendar as a first-class problem. An event has no body — the sensitivity is in the title and the attendee list. Nobody else handles this.
• Shows you what it withheld. In your own dashboard, on your own machine.
• Neutralises prompt injection. Email is attacker-controlled text, and assistants treat tool results as authoritative.

What it does not do

SendaShield reduces what your assistant sees. It does not guarantee that nothing sensitive gets through. Automated detection is imperfect: it will miss things, and it will occasionally withhold something harmless. Treat it as a strong seatbelt, not an airbag.

It also cannot stop your assistant using a different tool. If you leave a native Gmail connector enabled, the assistant will route around SendaShield and there is no way for us to detect or prevent that. Disconnecting the direct connector is the only real control.

The honest claim is SendaShield filters everything that passes through it — never it prevents your assistant from reading sensitive email.

Status

Early development. See docs/build-plan.md for milestones. INSTALL.md describes the target state at v1.0, not the current build.

Getting started

See INSTALL.md. Roughly ten minutes for IMAP/CalDAV, twenty-five for Gmail.

Runs on anything from a Raspberry Pi to a €5/month VPS. Free hosting is possible on your own machine via Tailscale Funnel.

How it works

SendaShield is an MCP server. Your assistant connects to it instead of to Google, so your assistant never holds provider credentials and never touches raw mail.

you → assistant → SendaShield → Gmail / IMAP / CalDAV
                       ↓
                 detect · mask · withhold
                       ↓
                 filtered view + honest count of what was held back

Works with claude.ai (web, desktop, mobile), Claude Desktop, and any other MCP client.

Full design in docs/architecture.md; the reasoning behind each decision is in docs/project-brief.md.

Privacy

No telemetry. No analytics, no crash reporting, no version checks. Message bodies are never written to disk. The audit log records that an item was filtered and its category — never its content.

Your data goes to your AI provider (filtered) and to your mail provider. There is nowhere else for it to go.

Do I have legal obligations?

If you are running this on your own personal mail, no — GDPR's household exemption (Art. 2(2)(c)) covers personal use entirely.

If you are a freelancer or business using it on work mail, you already have obligations as a controller, and they exist because you hold client correspondence, not because you installed this. SendaShield improves that position: it is a technical measure under Art. 32, evidence of minimisation under Art. 5(1)(c), and an implementation of privacy by design under Art. 25.

This is orientation, not legal advice.

Licence

AGPL-3.0. Contributions require a CLA — see CONTRIBUTING.md.

Security

Please report vulnerabilities privately. See SECURITY.md.