LLM Capsule substitutes the sensitive values but keeps the structure and relationships the model needs. Your approved model runs on that protected version, and Capsule rebuilds the real values inside your environment.
Substitute, run on the approved model path, reconstruct inside your environment. All three happen within one request.
Plays on its own. Click the last step to reconstruct it yourself.
The original values stay in a reconstruction mapping in your environment.
Stand-in values appear here.
Only the protected version travels the approved model path.
external · VPC · on-prem
Capsule looks the values up inside your environment. No original values are sent back to the model.
Only the ⟨capsule:…⟩ form leaves your environment. Your original values and the reconstruction mapping stay inside.
Masking removes the value, so the answer comes back incomplete. A privacy vault keeps your mapping in its own cloud.
Capsule keeps both in your environment and reconstructs the answer there.
circuit_id = ██████on node ███history ████
values + mapping→ external cloud
circuit_id = ⟨capsule:circuit_1⟩on node ⟨capsule:node_1⟩history kept
On-prem, VPC and controlled networks. Structured documents, not a demo dataset.
Works onBGP logs · circuit IDs
Returns asReconstructed incident ticket
Works onAsset IDs · ICS alerts
Returns asUpdated field work order
Works onClinical notes · medical record IDs
Returns asReconstructed EHR record
Works onMission logs · operation briefs
Returns asCommand brief · audit trail
Operational data changes weekly. When quality drifts, answers move between runs and last month’s approved result has nothing behind it. Syntitan, CUBIG’s AI-ready data platform, keeps the data in a state AI can use and makes that state verifiable on every run.
Data you could not send to a model runs on your approved path, and the real values come back in the answer. The rest of the workflow is untouched.
Quality and consistency are checked on every run, and the data state behind each one is recorded, so you can re-run it at audit and show the basis.
Nothing to rebuild when it moves into production.
We collected the questions workflow owners and approvers ask first.
Yes. The approved model path can be an external API, a VPC endpoint or a local model. Only the protected version travels that path.
Capsule can run on-prem, in a VPC or in a controlled network. You set the deployment boundary and the approved model path during architecture review.
Start with one representative workflow: logs, tickets, tables, PDFs, scans, or any other operational record you already work with.
No. Capsule substitutes the values before the model call and reconstructs the result afterward, so prompts and the model itself stay as they are. What changes is the integration point, and that depends on your workflow and model endpoint.
Your team does, per workflow. That includes the business identifiers and references a standard PII detector would miss.
The deployment boundary, the approved model path, the substitution policy, where the original values and the reconstruction mapping live, and how the result is reconstructed.
One representative payload, the model path you want to use, and the output your workflow needs. We run the full round trip on it.
They run on the same platform path. Capsule opens the blocked data path so the workflow can run in your environment; Syntitan operates that workflow in production and keeps the data state behind each run. Teams generally start with Capsule and one workflow, and connect Syntitan when they need production scale.
See what stays in your environment and how the real values come back in the answer.