kastro.

Kastro Labs → product

Use AI. Keep the ID numbers home.

Meet DMZ.is, a product from Kastro. This is the short version. Pricing, security and benchmarks live on dmz.is.

Visit dmz.is ↗See how ↓
dmz.is · Service in preparationA Kastro product

// How it works

Detect. Mask. Restore.

Staff keep using their AI tools. dmz is designed to keep selected direct identifiers out of the prompt.

Shield · synthetic dataOn device
01 · You writeOn device

Draft a reply for Arna Jónsdóttir, ID 140182-8858. Send to demo@example.com.

Illustration of planned behaviour. All values are synthetic; test ID numbers use century digit 8.
  1. 01

    Detect

    We look for direct identifiers in the text before it is sent. The prototype covers a defined set, and benchmarks show where it misses.

  2. 02

    Mask

    Each identifier gets a visible, unique token. An ID number becomes ⟦KT-1⟧.

  3. 03

    Restore

    When unchanged tokens come back, the real value is restored on the device. Streaming restore is on the roadmap.

// Phase one detection

Icelandic matters.

Icelandic names and ID numbers do not follow English patterns. dmz is built for Icelandic, with declension handling on the roadmap.

Example of planned declension handling; not a claim about current accuracy.
CaseReal valueTo model
nom.GuðrúnXXXXXX
acc.GuðrúnuXXXXXXX
dat.GuðrúnuXXXXXXX
gen.GuðrúnarXXXXXXXX
Kennitala (ID)
Date and century digit; check digit
Icelandic names
Four case forms; planned declension handling
IS IBAN
26 characters; mod-97 check
Payment cards
13–19 digits; Luhn check
Phone numbers
+354 or local seven digits
Secrets
Keys, JWTs, bearer tokens, connection strings

Direct identifiers only. Context can still identify people.

// Product line

One core. Three ways in.

The Go core runs in the browser as WASM. Portal and Gateway will share the same core when built.

01Prototype

Shield

Staff in the browser

Side panel running the Go core in WASM. Masks and restores on the device.

Where real values liveOn the user’s device
02Planned

Portal

Sensitive work

Planned workspace that routes masked text to local models or approved API routes.

Where real values liveTemporarily in Iceland
03Planned

Gateway

Developers and internal systems

Planned compatible API gateway with secret detection and an audit metadata log.

Where real values liveTemporarily in Iceland

// For privacy and procurement

Precise words. On purpose.

Security claims should be backed by data. Explore the prototype’s limits and benchmarks on dmz.is.

See the data boundaries ↗
We sayWe don’t say
Shield masks selected direct identifiers on the deviceAnonymous text
Portal and Gateway are designed for Icelandic data boundariesZero retention without a contract
We measure accuracy per identifier type100% detection
Can support implementation of Digital Iceland rulesFull legal compliance

Everything about dmz

dmz.is ↗

Pricing, security, benchmarks and a 30-day paid pilot for teams of 10 seats or more.