Install the SDK
You need Node 18 or later. The SDK is a tarball on the Tightlip download page. It is not published on the npm registry. See Installation for details.
npm install https://tightlipai.com/downloads/tightlip-0.1.0.tgzProtect and review
protect() finds names, case numbers, emails and other identifiers. It swaps each one for a placeholder such as [PERSON_1]. It returns the placeholder text, the vault that maps placeholders back to real values, and what it found. Show the placeholder text to the person before anything is sent.
// quickstart.mjs (Fictional example)
import { protect, restore, PLACEHOLDER_INSTRUCTION } from 'tightlip';
const input =
'Draft a reply to our client Rosalind Achterberg about Case No. 2:25-cv-01482. ' +
'Her email is rosalind.a@example.com.';
// 1. Protect. This runs on your machine.
const { text, vault, counts, detections } = protect(input, { profile: 'legal' });
// 2. Review what will be sent.
console.log(text);
console.log(counts);
for (const d of detections) console.log(d.type, d.text);Draft a reply to our client [PERSON_1] about Case No. [CASE_NUMBER_1]. Her email is [EMAIL_1].
{ PERSON: 1, CASE_NUMBER: 1, EMAIL: 1 }
PERSON Rosalind Achterberg
CASE_NUMBER 2:25-cv-01482
EMAIL rosalind.a@example.comSend and restore
Send the placeholder text to your model. Put PLACEHOLDER_INSTRUCTION in the system prompt so the model copies placeholders exactly. When the answer comes back, restore() puts the real values back using the same vault.
// 3. Send only the placeholder text, with PLACEHOLDER_INSTRUCTION as the system prompt.
// Replace this stand-in with your own provider call.
async function callYourModel({ system, user }) {
return 'Dear [PERSON_1], here is an update on [CASE_NUMBER_1]. I will copy [EMAIL_1] on the filing.';
}
const reply = await callYourModel({ system: PLACEHOLDER_INSTRUCTION, user: text });
console.log(reply);
// 4. Restore the real values, on your machine.
console.log(restore(reply, vault));Dear [PERSON_1], here is an update on [CASE_NUMBER_1]. I will copy [EMAIL_1] on the filing.
Dear Rosalind Achterberg, here is an update on 2:25-cv-01482. I will copy rosalind.a@example.com on the filing.The stand-in returns a fixed reply so the example runs without a provider key. Your real call receives text and the instruction. It never receives vault.
The system prompt text
This is the exact value of PLACEHOLDER_INSTRUCTION in version 0.1.0.
Some details in this conversation were replaced with placeholders in square brackets, such as [PERSON_1], [ORG_2], [EMAIL_1] or [CASE_NUMBER_1]. Each placeholder stands for one real value that is kept private. Treat each placeholder as the real name, number or detail it stands for. [PERSON_1_FIRST] and [PERSON_1_LAST] are the first and last name of [PERSON_1]. Whenever you refer to one, copy the placeholder exactly as written, including the square brackets, capital letters, underscores and number. Do not translate, reformat, merge or split placeholders, and do not guess or comment on the hidden values.