Your originals stay inside your environment. LLM Capsule swaps only the sensitive values for stand-ins of the same shape and sends those to an approved model. Results come back reconstructed for real work. Two minutes to watch it run, on one of your own documents.
CKT-77-AB12
█████
edge-04
███
09:42
██:██
✕Unusable for AI
Context-preserving substitution
CKT-77-AB12
⟨cap:ckt_1⟩
edge-04
⟨cap:edge_1⟩
09:42
09:42
✓Usable for AI
Drag the line to compare
LLM Capsule brings policy definition, structure-preserving substitution, local reconstruction, and operational records into one workflow inside your environment. The technical components that implement these functions are detailed in Architecture.
You decide what counts as sensitive
Not a fixed vendor list. Your team names the markers: circuit and asset IDs, contract references, project code names, internal metrics. When the rules change, you edit the policy and nothing about the system changes.
Swaps values for stand-ins of the same shape
Black out a field and the model loses the record. A substitute keeps the shape, so tables, hierarchies and cross-references still read as one document.
Puts the real values back into the result
The model answers in stand-ins. The mapping turns them back into real names and figures inside your environment. The output moves into the next system without anyone retyping it.
Keeps policy and run records connected
Every event lands here: which policy was active, which values changed, which model ran it, what came back restored. Your audit team replays any run end to end.
Click through the tabs to see what each step changes on screen. The example is a NOC ticket; every document goes through the same five steps.
LLM Capsule runs inside your environment. It reads documents straight from the systems already there: SharePoint, Jira and ServiceNow, Salesforce, Oracle ERP, an internal NOC console, your own portal. You move nothing, build no new pipeline and leave the architecture alone.
Existing systems call LLM Capsule from inside the environment over REST, gRPC, JDBC, Graph API, on-prem API, embedded SDK, or Slack app.
Pick from the starter pack or write your own: project codes, contract refs, network IDs, mission refs, financial terms, vulnerability labels. Add, remove or time-shift a marker whenever the rules change, and the system stays as it is. LLM Capsule logs every policy version.
Inside your environment, sensitive values become stand-ins that keep the shape of the original. Differential-privacy-based substitution (epsilon-DP, Laplace noise, k-anonymity, NER replacement) lowers re-identification risk. Tables, cross-references, and document hierarchy come through intact.
Only the protected working version travels. The original values stay inside your environment. That version goes to your approved external LLM (ChatGPT, Claude, Gemini, Perplexity), or to an on-prem lightweight model on a closed network.
LLM Capsule restores the AI response inside your environment: mapping lookup, original value substitution, context re-binding, output validation. Real names, figures and references come back to the ticket. The reconstruction mapping stays in that environment too.
LLM Capsule reads every document type below. Names and phone numbers come preset. You define the values only your company has: circuit IDs, policy numbers, lot numbers, whatever your industry runs on.
Preset what a PII tool also finds
Custom what it cannot find
If your format is not on the list, send us one document. We run it and show you the result. Run a sample proof →
Operational documents are not tidy tables. They are logs, PDFs and tickets, and the hierarchy and cross-references inside them go missing along with the values you remove. Here is one asset hierarchy handled both ways.
prompt Which circuits fall under the 30-day retention window, and who owns them?
| Location | Contract | Retention | Owner |
|---|---|---|---|
| 90 days | |||
| inherits | inherits | inherits | |
| inherits | inherits | inherits | |
| 30 days |
The tree is gone. The identifiers that tied racks to sites were removed, so the two middle rows are indistinguishable and the circuit connects to nothing.
| Location | Contract | Retention | Owner |
|---|---|---|---|
| SITE-A1 | MSA-A1-0312 | 90 days | Owner 1 |
| RACK-A1-02 | inherits | inherits | inherits |
| RACK-A1-03 | inherits | inherits | inherits |
| CKT-A1-03-7 | SLA-A1-03-7-B | 30 days | Owner 2 |
Every row stays distinct and the nesting still resolves, so the model can trace the circuit to its rack and site and answer with the owner.
Admins decide what counts as sensitive, which models may run and who sees what. They read the record of every run in the same console.
| Name | Role | Status |
|---|---|---|
| A. Miller | Team admin | Active |
| M. Reyes | Member | Password |
| J. Carter | Member | Locked |
| E. Novak | Member | Inactive |
| S. Park | Team admin | Active |
| D. Lawson | Member | Active |
| Shared source | Status |
|---|---|
| incident_ticket.docx | De-identified |
| telco_style_log.csv | De-identified |
| claims_batch_05.xlsx | De-identified |
| msa_acme_2025.pdf | De-identified |
| noc_rca_summary.docx | De-identified |
| meeting_notes_07.txt | De-identified |
| Filter | Type |
|---|---|
| Phone number | preset |
| Amount | preset |
| Date | preset |
| Customer code | custom |
| Circuit ID | custom |
| Address | preset |
Only registered models can be called.
| Action | Result | Target |
|---|---|---|
| Substitution run | success | incident_ticket.docx |
| Model call | success | gpt-5 |
| Reconstruct | success | INC-24091 |
| Source upload | failed | telco_log.csv |
| Policy updated | success | NOC-team v2 |
Pick how LLM Capsule replaces values, and use the preset markers alongside the ones your team names. Register the providers and models you allow in the same place.
Teams carry roles, and each project keeps its own sources, so one group never reads another group's documents.
Every run leaves a row: who ran it, on what, and whether it succeeded. You also see detection counts and call volume by team.
Figures come from 2,200-character documents in finance, healthcare, legal and public-sector workflows.
The time from receiving a page to finishing substitution. You can put it inside real-time NOC alerting, claims intake or clinical workflows without breaking an SLA.
Share of substituted values rebuilt from the mapping held inside your environment.
Compared against the same model reading the original document. The meaning holds on the way out and back.
LLM Capsule catches sensitive values in structured fields and in free text, custom markers included.
This covers the whole path in production workflows, from the original input to the restored output.
Each card is a workflow LLM Capsule runs in production today. The screen differs by industry.
NOC incident analysis on production traffic
Root-cause analysis runs on live ticket data. Device and circuit IDs, site references, alarm sequences and subscriber identifiers go to the model as substitutes; the originals stay in the carrier's environment and reappear in the answer.
Customers: SK Telecom / Recognition: Deutsche Telekom T Challenge 2026 finalist
Radiology report drafting, PHI restored inside the hospital
AI drafts radiology summaries inside the clinical workflow the team already uses. LLM Capsule swaps patient identifiers before the call and restores them inside the hospital network. Reviewed against HIPAA.
Ewha Womans University Medical Center (EUMC)
AI claims processing on real customer data
Claim classification, damage assessment and fraud scoring run on real policyholder records. LLM Capsule substitutes names, policy numbers and amounts for the model call, then puts the real values back on the adjuster's screen.
Kyobo Life · DB Insurance · IBK
Mission brief drafting on classified workflows
AI drafts intelligence briefs and operational summaries from classified documents. The path runs on-premises, and every run leaves an audit row under command control.
Republic of Korea Ministry of National Defense
LLM Capsule lets you run AI on work that was too sensitive before. Syntitan keeps the answers steady once that work runs every day.
Bring your real workflow. We'll set up LLM Capsule on a sample document in your environment within 30 minutes.
chest_ct_slice_042.dcm