Built an inline proxy for LLM egress after watching PII walk out the door

SOC analyst here, posting a tool I built and looking for input from

other blue teams facing the same thing.

The problem: employees using ChatGPT and Copilot paste customer data

into prompts. National ID numbers, account numbers, transaction

details. Our DLP caught maybe 30% of it because the detection logic

was built for "five credit cards in an email body," not for prose

paragraphs with a national ID embedded mid-sentence heading to

api.openai.com.

Cloud LLM gateways would have solved the detection side but they need

your prompts to transit their servers. In a regulated environment

that's a non-starter before the technical conversation even begins.

So: Tamga. A self-hosted reverse proxy that sits in front of the LLM

providers.

What it does per request:

- Three fast scanners run sequentially (PII, secrets, custom regex),

each under 500µs

- Slower scanners with network I/O run in parallel

- Policy engine decides pass, redact or block

- Audit log written to Postgres with hash chaining so tampering shows

Detection coverage is documented against the OWASP LLM Top 10 in the

repo. Compliance mapping for the regulations I had to work under is

there too.

AGPL-3.0.

What I'd like to hear from this community:

How are you handling LLM egress right now? Anyone actually satisfied

with their current tooling, or is everyone improvising?

For those running Purview with Copilot governance — where does it

fall short in practice?

Indirect prompt injection through RAG documents is the threat I'm

least confident about. Has anyone seen it exploited in the wild yet,

or is it still mostly theoretical?

The adversarial suite in the repo has 62 vectors and 29 currently

bypass the scanners. Documented rather than hidden. If you find

another one, SECURITY.md has the disclosure path and I'll credit you

in the release notes.