Lucairn is a compliance gateway for OpenAI, Anthropic and more. Use AI on sensitive business data, with proof. Built in Germany for regulated organisations in Europe.
Lucairn is BYOK/Plan: bring your own provider key for Anthropic, OpenAI, Mistral or Gemini. Paste the config into Claude Desktop, route the OpenAI SDK, or change the base_url in the Anthropic SDK. Streaming responses (stream:true / SSE) are supported.
On the hosted Developer and Pro tiers, on-gateway pseudonymization happens before your LLM sees the request — apart from text in a tool’s system prompt (for example project instructions), which is forwarded to the model vendor as written. On Enterprise self-hosted, no raw identity data leaves your environment — apart from text in a tool’s system prompt (for example project instructions), which is forwarded to the model vendor as written.
Detection combines known-entity matching against customer-supplied recognizers with Presidio NER for general identifiers. Lucairn separates Sandbox A (identity) from Sandbox B (AI processing) at the network level; even if a PII string slips past detection, Sandbox B cannot reach the identity store, so the leak is bounded and the audit chain still captures the request. The gateway restores original values in the response by default on every plan.
Every successful call through the gateway mints a signed Lucairn certificate (Ed25519). A certificate attests that Lucairn’s pseudonymization pipeline ran for the request — it is not a claim of complete PII detection and not a claim of legal compliance. Anchoring is attempted via an RFC 3161 timestamp (FreeTSA) and the Sigstore Rekor transparency log; the certificate records whether each anchor confirmed.
Certificate fields are structured input a provider or deployer can feed into their own EU AI Act Article 12 record-keeping; they do not make an AI system Article-12-capable. Audit exports (Pro and Enterprise) are input for a controller’s own GDPR Article 30 records.
Plans: Developer (free), Pro and Enterprise. Enterprise self-hosted runs on your infrastructure via Helm on Kubernetes or Docker Compose.
