Fabric Guard
Your secrets never reach the model provider.
People paste keys, passwords and customer names into Claude and ChatGPT. Guard takes them out before the request leaves, keeps them, and puts them back in the answer. Nobody changes how they work.
How it works
DB_PASSWORD=Tr0ub4dor&3DB_PASSWORD=[SECRET_7f3a1c]… Tr0ub4dor&3 …The original waits in an encrypted vault. The same value always gets the same placeholder, so the provider's prompt cache keeps working.
What it catches
Set it up
Pick how your people work. They combine: developers through the gateway, everyone else with a hook. You need a Fabric key.
Keeps data from the provider Fabric forwards a clean copy and pays with your company's key. First add that key in the console under Guard → Provider keys.
- Claude Code: add to
~/.claude/settings.json: - Claude Desktop: Help → Troubleshooting → Enable Developer Mode, then Developer → Configure Third-Party Inference. Choose Gateway, this address, and your Fabric key:
- Your own apps: the Anthropic SDK takes the address above as
base_url; the OpenAI SDK:
Stops mistakes Checks each prompt before Claude Code sends it; stops secrets, warns about personal data. The text is sent to Anthropic when it passes.
- Download the hook:
- Add to
~/.claude/settings.json: - Try it: send a line with a fake password, such as
password=Tr0ub4dor&3. It should not be sent.
The model never reads it For an owner of a Claude Enterprise organization. Claude asks Fabric about every prompt in every Claude app and refuses the ones that break your rules.
- In claude.ai, open Organization settings → Inference hooks and set the endpoint:
- Add a request header
authorizationwith the value: - Generate the signing secret there and paste it in the console under Guard → Provider keys and Claude Enterprise.
- Click Test connection. Start in shadow mode, look at the record in the console, then enforce.
Stops mistakes Checks what you are about to send on chatgpt.com and claude.ai, and stops or warns first.
- Download the extension and unzip it.
- In Chrome, open
chrome://extensions, turn on Developer mode, click Load unpacked and choose the folder. - In the extension's Options, paste your Fabric key and save.
Questions
Does a model read my text to find secrets?
No. The check is plain code, about 0.3 ms per message, and gives the same answer every time.
What does Fabric keep?
Encrypted: your provider key, the originals behind placeholders and the Claude Enterprise signing secret. The record of checks holds when, from where, the verdict and how many of each kind, never the text.
Why does full protection need an API key?
A claude.ai subscription cannot be used through a gateway: Claude's own apps send text straight to Anthropic. The gateway forwards with your company's key; the hooks work with a subscription but the text still reaches the provider when it passes.
What happens to a confidential fact?
You choose in the console: stop the message, or answer it with our own model so nothing leaves. Our model runs on our infrastructure.