Product · CloudNerve
NerveGuard
Nordic and EU personal identifiers kept out of prompts, tool calls and logs.
Checksum-validated detection of Nordic and EU personal identifiers, applied before and after every Amazon Bedrock call, to agent tool calls and to invocation logs.
Who it's for
Banks, insurers, public bodies, health and HR companies in the Nordics using generative AI on data that contains personal identifiers.
When teams call us
A data protection officer blocking a GenAI launch, identity numbers found in Bedrock logs, or an AI agent that passes customer records between tools.
What it does
Inside NerveGuard
Nordic identity numbers
Finnish henkilötunnus, Swedish personnummer and samordningsnummer, Norwegian fødselsnummer and D-nummer, Danish CPR, Icelandic kennitala.
Business and payment IDs
Y-tunnus, organisationsnummer, CVR, EEA IBANs, EU VAT numbers, payment cards and e-mail addresses.
Checksums, not guesses
Each identifier is checked against its structure and checksum, so ordinary numbers are left alone.
Nordic context words
Finnish, Swedish, Norwegian, Danish and English context words raise confidence, including inflected Finnish forms.
Agent tool calls
Redacts tool-call arguments and results, which Amazon Bedrock Guardrails does not filter.
Log scrubber
Writes redacted copies of Bedrock invocation logs, so the originals can sit behind tighter access.
Mask, hash or tokenize
Choose how each finding is replaced.
Metrics
Finding counts in Amazon CloudWatch, as evidence the control works.
What you receive
On every run
- A Python package with the recognisers and the redaction engine
- A wrapper for the Bedrock Runtime client and agent tool calls
- A CloudFormation stack for the log scrubber
- CloudWatch metrics, alarms and a dashboard
- An accuracy report per recogniser, measured on synthetic data
How it works
Step by step
- 01
Install the package
Add the package to your application.
- 02
Wrap your Bedrock client
Prompts are redacted before the call, answers after it, and your guardrail can be called as well.
- 03
Deploy the log scrubber
Deploy the log scrubber stack to produce redacted copies of invocation logs.
- 04
Watch and tune
Watch finding counts in CloudWatch and tune the recognisers you turn on.
Built on AWS
The AWS services it uses
- Amazon Bedrock
- Amazon Bedrock Guardrails
- AWS Lambda
- Amazon S3
- Amazon CloudWatch Logs
- Amazon CloudWatch
- AWS KMS
- AWS CloudFormation
Your data
Runs in your application and your account with no external calls. The core library has no dependencies. Nothing is sent to CloudNerve.
Scope, stated plainly
What it does not do
- Detect names and street addresses in free text; pair it with a Bedrock Guardrails PII filter for those
- Scan images or documents
- Understand meaning, such as a diagnosis described in words
- Promise to catch everything: run it on a sample of your own logs before relying on it
Questions
Common questions
- Why not only Bedrock Guardrails?
- Guardrails does not validate Nordic identifiers and does not filter agent tool calls. NerveGuard adds both and can call your guardrail in the same step.
- Does it work with streaming answers?
- Yes. Streamed output is redacted as it arrives, with a short hold-back so an identifier split across chunks is still caught.
- How do we know it works on our data?
- Run the scanner on a sample of your logs first. The accuracy report shows measured recall and false positives per recogniser on synthetic data.
See NerveGuard on your own AWS data.
Book a free Intro Call with a CloudNerve architect, or ask us anything about how it would fit your accounts.