Data Protection Service

Enterprise-style PII masking for chatbots and inbound requests. Modular design:

Module	Description
masking-core	Standalone JVM library — detectors, policies, masking pipeline (no HTTP)
protection-api	HTTP service — /v1/protect, policy admin, audit

See docs/SPEC.md for the full specification.

Built with Scala 3.3 and Apache Pekko HTTP.

Build & test

sbt test

Run the API

sbt protectionApi/run
# or background + health wait:
./scripts/start-server.sh

Default: http://0.0.0.0:8080

Curl examples & E2E

See scripts/README.md. Quick check:

./scripts/run-e2e.sh

Environment:

• DPS_PORT — listen port (default 8080)
• DPS_HOST — bind host (default 0.0.0.0)
• DPS_AUTH_TOKENS — comma-separated bearer tokens (empty = auth disabled for dev)

Example: protect chatbot JSON

curl -s -X POST http://localhost:8080/v1/protect \
  -H "Content-Type: application/json" \
  -d '{
    "tenantId": "contoso",
    "direction": "ingress",
    "contentType": "json",
    "payload": "{\"messages\":[{\"role\":\"user\",\"content\":\"Call me at 888-888-8888\"}]}",
    "fieldPaths": ["$.messages[*].content"]
  }'

Embedded library usage

import com.pratyabhi.masking.engine.DefaultMaskingEngine
import com.pratyabhi.masking.model._

val engine = DefaultMaskingEngine.global
val result = engine.protect(
  "Email me at user@example.com",
  ProtectionContext("my-tenant", contentType = ContentType.PlainText)
)
println(result.output)

Legacy strippers

Backward-compatible API (same behavior as v1):

import com.pratyabhi.masking.legacy.{CreditCardStripper, PhoneNumberStripper}

Release

sbt "release with-defaults"