Patient data stays. Agents ship.

A TypeScript privacy engine that detects and seals PHI in healthcare agent traffic inside your own process. No network call, no API key, no data leaving the building.

Read the docs See exactly what's real today →

TypeScript · 455 tests · benchmarked on 10,000 synthetic healthcare cases

engine: synapse-method-2026-05-21 · policy: safe_handoff_strict actual output

Agent message, outbound Handoff for patient Maria Gomez: MRN: 448812, member id SYN-MBR-40217, DOB: 1988-03-14. Callback (415) 555-0117. Notes at https://portal.stmarys.example/case/9921. Visit date is on 2026-06-28 for infusion follow-up.

After redactPHI() Handoff for patient [PERSON]: MRN: [MRN], member id [CASE_ID], DOB: [DATE_OF_BIRTH]. Callback [PHONE]. Notes at [PRIVATE_URL]. [PRIVATE_DATE] for infusion follow-up.

7 detections · identifiers marked for hashing in audit records · this is the engine's real output for this input, not a mockup

Runs in-process: Synchronous TypeScript. Works offline, on-prem, in air-gapped environments.
Zero data movement: Nothing is sent anywhere. There is no service behind this feature to trust.
Built for handoffs: A strict policy mode for text that leaves the trust boundary: names, dates, facilities, IDs.

Quickstart

Two lines to a sealed message

Construct an engine, redact a string. Every detection carries its span, type, and suggested handling (mask or hash) so your audit trail can record what was sealed and why.

Private beta: the package is not on npm yet. Ask us for repo access, or watch this page. The API shown is the real, tested surface in src/privacy-engine/.

import { PrivacyEngine } from '@synapse-foundry/sdk';

const engine = new PrivacyEngine({ policy: 'safe_handoff_strict' });

const { redactedText, detections } = engine.redact(outboundMessage);

// detections → [
//   { type: 'PERSON',  text: 'Maria Gomez', action: 'mask' },
//   { type: 'MRN',     text: '448812',      action: 'hash' },
//   ...
// ]

Benchmark

The honest numbers, including the one that isn't 100%

The engine is evaluated against a 10,000-case synthetic healthcare privacy benchmark with a committed, re-runnable harness. We authored that benchmark and tuned the detector against it, so we also report the number that matters more: performance on a private held-out set the detector was never tuned on.

Evaluation set	Cases	Recall	Utility preserved	Identifier leaks	Status
Synthetic healthcare v3 (authored + tuned)	10,000	100.0%	99.4%	0	pass
Private held-out (untuned)	125	94.4%	—	22	open gap

Synthetic cases. These results do not establish HIPAA compliance.
The 10,000-case run reproduces with one command from a committed harness; the SDK engine is verified span-for-span identical to the benchmarked engine across all 10,000 cases.
Closing the held-out gap is the top of the engine roadmap, ahead of any new feature.

What's real today

We'd rather you find this out here

Updated 2026-07-03. This table mirrors REALITY.md in the repository and is kept honest in code review.

Local privacy engine	Detection + redaction, in-process, 120-case parity fixtures against the benchmarked original.	runs today
Webhook signature verification	HMAC-SHA256, timing-safe, framework-agnostic helpers.	runs today
Typed governance APIs	Agents, evals, audit, guardrails: typed clients exist; the hosted backend is not deployed. Calls fail today.	in design
Hosted service, keys, dashboard	No live service. No uptime to report, so we don't report one.	not live
Compliance certifications	No HIPAA or SOC 2 certification is held. The engine is built for HIPAA-aligned workflows; certification claims will appear here only when real.	not held