Saklam: Keeping Client Data Out of ChatGPT

🇩🇪 Auf Deutsch lesen

A few months ago, a lawyer told me he drafts pleadings with ChatGPT – including client names, case numbers, diagnoses. It hit me: that’s a §203 problem in plain sight.

In Germany, anyone bound by professional confidentiality – lawyers, doctors, tax advisors, notaries – who sends client data to ChatGPT/Claude/Gemini violates §203 of the Criminal Code. Cloudflare’s AI Gateway just blocks such requests. But “blocking” isn’t a solution for someone who needs the AI. The right answer is “YES, but safely”.

The only place this is cleanly solvable is the browser. Before the data leaves the machine.

Saklam detects personal data in the browser and replaces it with tokens – [NAME_1], [CASE_2], [ADDRESS_1]. The LLM only ever sees tokens. The response comes back and is reassembled with the real values in the browser. No clear data hits the server.

The stack:

  • GLiNER PII models, running locally in the browser (~200 MB cache)
  • ONNX Runtime Web for inference
  • LiteLLM as proxy (auth, routing, audit log)
  • Provider-agnostic – OpenAI, Anthropic, Google

Available as web chat, desktop app, JavaScript SDK, and Docker for on-premise. The privacy level matches the sensitivity: web chat for daily work, desktop for confidential matters, Docker for firms with their own servers.

→ saklam.com

PerfMatters: From Idea to Launch

🇩🇪 Auf Deutsch lesen

The trigger was a blog post by Stoyan Stefanov: AISlow. His idea: feed Lighthouse data through an ML model and explain it with GPT in plain language.

I wanted to try this.

The result is PerfMatters – a tool that analyzes web performance, predicts the SpeedIndex, and explains in plain language what makes a page slow.

The stack:

  • LightGBM for prediction (R² = 0.90)
  • SHAP for feature importance
  • GPT-4o-mini for the summary
  • Laravel + FastAPI

Stoyan tested it right away and found a few edge cases – now fixed. Thanks for that!

→ perfmatters.org

OpenPIMS: Looking Back at 6 Months Prototype Fund

🇩🇪 Auf Deutsch lesen

Six months of Prototype Fund, for the second time. The project: OpenPIMS – abolishing cookie banners through centralized consent management.

This project was funded as a private individual through the Prototype Fund.

The Goal

With TDDDG §26, there is finally a legal framework for PIMS in Germany. OpenPIMS was meant to provide this infrastructure: Set once centrally, apply everywhere.

What Was Built

  • 3-tier consent system – by category, provider, or individual cookie
  • Browser extensions – Chrome, Firefox, Safari, Edge (unified codebase)
  • Privacy proxy – Python mitmproxy addon + Cloudflare Worker
  • Magic link login – No passwords, deterministic tokens

The Problem

Technically it works. But: Chicken-egg problem. Without websites, there is no benefit for users. Without users, there is no incentive for websites.

Status

OpenPIMS is on hold. The code is on GitHub. Focus is now on PrivacyProxy and TrialCode.

Sometimes pausing is the right decision.