privacyfence

PrivacyFence is an open-source privacy and approval gateway that sits between AI assistants and business systems, acting as an independent control point: the AI initiates a request, PrivacyFence decides whether to allow it, and the user sees the risk before execution. It connects to MCP-compatible assistants (such as Claude Desktop and Claude Code) and supports systems including Gmail, Google Drive, Calendar, Slack, Salesforce, Jira, Confluence, and Telegram.

[Purpose] Typically, giving an AI assistant access to Gmail, Drive, Slack, or Salesforce means granting it long-term permissions and trusting it to use them reasonably. But "being allowed to read a record" does not equal "being allowed to send it to the AI," and tool names in client prompts can hardly explain the change that is about to happen. PrivacyFence places an independent control point between the assistant and the systems, and it enforces the decision of what the assistant can see and do, independently of the AI itself.

[Main capabilities]

1. Human approval: Sensitive reads and consequential writes require human approval on a card, and the card shows the actual content or change, the requester, and the reason, rather than the raw tool name or JSON payload.
2. Local PII detection: Runs locally before reads reach the AI, flags possible personal data; even if the rules would otherwise allow it, it turns the request into a card approval.
3. Policy-based automation: Through narrow always-allow rules (such as specific sender domains, Drive folders, Slack channels, or Jira projects), routine requests run directly without a card.
4. Audit log: Records all accepted, rejected, and automatically approved requests in a chained structure that can detect modifications without a key.
5. Credential isolation: Credentials are held by PrivacyFence and, under a packaged installation, run under a separate service account, so an AI client running as the current user cannot read the credentials or approve requests on its own.
6. Clearly defined connectors: The gating for each tool is fixed in code, not a generic proxy for arbitrary MCP tools.

[How to use]

1. Download the installer for your platform from privacyfence.eu/download and run it.
2. Sign out and sign in again once so that the account's new group membership takes effect.
3. When the companion app (menu bar, tray, or app menu) prompts, add a passkey and save the recovery code.
4. Open settings from the companion appand connect services.
5. Claude Desktop connects through the PrivacyFence extension (PrivacyFence.mcpb); Claude Code and other clients that support Streamable HTTP connect directly to the local /mcp endpoint; in organizational deployments, clients such as claude.ai, ChatGPT (developer mode), and Gemini Enterprise sign in via OAuth through the organization's identity provider.
6. Ask the assistant a question and approve it on the card. For detailed steps for each platform, see Getting started and the macOS, Windows, and Linux documentation. For team use, see Organization deployment.

[Use cases]

• Individual employees using it on their own machines (macOS, Windows, Linux) to protect AI access to systems such as Gmail, Drive, and Slack.
• Organizations deploying it centrally on their own infrastructure, supporting connections from web clients such as claude.ai.
• Teams that need human approval, PII detection, and auditing for sensitive reads and writes.

[Limitations] PrivacyFence is independent open-source software, not a certified compliance product; it has no certification, business continuity plan, or SLA, and by itself cannot make a deployment comply with any regulation. It cannot defend against root or local administrators, nor against local code on non-packaged installations (source checkouts or pip installs). A process running as the user can read the local review screen, but cannot approve from it; in local mode, names provided by the AI client are unverified. For the full limitations, see What PrivacyFence does not claim. For vulnerability reports, see SECURITY.md. It is licensed under the Apache License 2.0; see LICENSE and NOTICE for details.