What Claude sees. What it doesn't.

Eight layers of protection sit between your sensitive data and the AI model. Here's what changes — and what doesn't — when Tenet is running.

Tenet secures the MCP/Claude Code data path — prompts, tool calls, file operations, and shell commands. What Tenet covers →

01

Interception

Every message, file, and command — intercepted before Claude sees it.

Before

You paste patient intake notes into Claude. Claude reads them, processes them, generates a response. No filter, no gate, no scan.

Claude writes to a file? No check. Runs a shell command with credentials? No interception. Reads a medical record? No audit.

Every data path is wide open.

With Tenet

Four hooks intercept every interaction at every data path. Your prompts are scanned before Claude sees them. Writes, edits, and shell commands are checked before execution. File reads and web fetches are monitored on output.

Nothing passes through unchecked.

Hook When it fires What it scans
Session Start New session opens Auto-starts server, injects policy context
User Prompt You type a message Full prompt text before Claude sees it
Pre-Tool Use Claude writes / edits / executes File contents, code, shell commands
Post-Tool Use Claude reads files or fetches data Tool output (detect & advise)

Four hooks cover every data ingress and egress path — prompts, writes, edits, shell commands, and file reads.

02

Detection

Three-stage pipeline. 17+ entity types. All local. All under 20ms.

Before
Referral for James Okafor MRN: 4471829 SSN: 123-45-6789 DOB: 03/07/1985 IP:  10.0.1.42

All five identifiers pass through to the model undetected.

With Tenet
Referral for █████ ██████ MRN: ███████ SSN: ███████████ DOB: ██████████ IP:  █████████
DETECTED GIVENNAME + SURNAME ← ML model DETECTED MRN ← JSON key heuristic DETECTED SOCIALNUM ← ML model DETECTED DATEOFBIRTH ← ML + regex DETECTED IP_ADDRESS ← regex pattern

All five caught and redacted. Three detection methods, all running on your machine.

<20ms typical prompt latency
0ms network round-trips
100% on-device

Three-stage pipeline. 17+ entity types. All local. All under 20ms.

03

Redaction

Claude works with sanitized data. You see the original.

What Claude sees without Tenet
Patient Sarah Chen, DOB 1985-03-07, SSN 123-45-6789, ZIP 90210

Full PHI in the model context window. Name, exact date, SSN, full ZIP.

What Claude sees with Tenet
Patient [NAME_1], DOB 1985, SSN [SSN_1], ZIP 902**

HIPAA Safe Harbor compliant. Dates → year only. ZIP → first 3 digits. Everything else → opaque placeholder.

Standard mode

Opaque placeholders: [SSN_1], [EMAIL_2], [NAME_3]

Safe Harbor mode

HIPAA §164.514(b)(2)(i): ZIP → 3 digits, dates → year only, ages >89 → ≥90

HIPAA Safe Harbor compliant. Dates → year only. ZIP → first 3 digits. Everything else → opaque placeholder.

04

Secure Rehydration

Claude sees placeholders. You see real names. The switch is invisible & secure.

Redaction only works if you can still read the output. Tenet replaces placeholders with originals on the way back — so your workflow is unbroken, and Claude never saw the real data.

Without Tenet
Claude drafts: "The referral for [NAME_1]  has been sent."

That's what lands in your document. The original is gone.

With Tenet
What Claude wrote: "The referral for [NAME_1] has been sent." What you receive: "The referral for Sarah Chen has been sent."

Claude saw a placeholder. You see the real name.
Encrypted locally. Decrypted on output. Never transmitted.

HIPAA Rehydration is local-only. Originals are encrypted at rest and never transmitted to the model. Session tokens are scoped and auto-expire.

AES-256-GCM encryption at rest. Keys derived from macOS Keychain. Session-scoped tokens, auto-expire after 1 hour. Originals never leave your device.

05

Audit Trails

Every detection, every decision, timestamped. The actual PHI is never logged.

Before

Claude accessed appointment history for 14 patients across 3 sessions. Read an underwriting file with adverse health history. Drafted a referral letter with a full medical record number.

No record of any of it. Your compliance team can't reconstruct what happened. Neither can you.

With Tenet
{"ts":"14:32:07Z","entity":"SSN",  "hook":"PreToolUse",  "action":"redacted"} {"ts":"14:32:07Z","entity":"DATEOFBIRTH",  "hook":"PreToolUse",  "action":"safe_harbor"} {"ts":"14:32:08Z","entity":"GIVENNAME",  "hook":"UserPrompt",  "action":"redacted"}

Every event logged. Entity type, which hook fired, what action was taken, when. PHI values excluded by design.

What's logged

Entity type, confidence score, which hook fired, what action was taken, timestamp, session ID

What's NOT logged

The actual sensitive data — PHI is excluded from audit entries, enforced at the code level

SOC 2 Monitoring (CC7.1) and change management (CC8.1). HIPAA §164.312(b) audit controls via append-only logging.

Every detection timestamped. Entity type, hook, action. PHI values never logged — enforced at the code level.

06

Human-in-the-Loop Gates

You're always in control. Tenet asks before acting on anything sensitive.

Before
Claude writes to compliance filing: form_adv_draft.docx Client SSN: 987-65-4321   → No review gate → No approval required → File written immediately
With Tenet
Tenet intercepts the write: PII detected in Write operation. 1 entity: SOCIALNUM (0.97)   APPROVE (redacted) BLOCK

You decide. Tenet remembers your choice for identical situations — no repeated prompts.

Mode Behavior Best for
Auto Redact and proceed (or block, based on policy) Day-to-day workflow
HITL Pause and ask: "PII detected. Use redacted version?" High-stakes operations
Block Stop the operation entirely Maximum safety
SOC 2 Logical access controls (CC6.1, CC6.3). Decision memory provides auditable consent records.

Three modes: Auto, HITL, Block. Decision memory means no repeated prompts for identical situations.

07

Policy Bundles (Tenets)

One command to activate HIPAA mode. Pre-configured for healthcare, finance, and security.

Before

Same settings for a doctor, a broker, and a sysadmin. No way to say "this is healthcare data" or "this is a financial context." The tool doesn't know what compliance regime you're operating under.

One-size-fits-all. No compliance awareness.

With Tenet
$ tenet install --profile hipaa-safe-harbor   ✓ 15 entity types activated ✓ Safe Harbor transforms enabled ✓ fail_open: false (fail-closed) ✓ All 12 regex patterns active

Automatic prompt classification routes detected entity types to the right policy.

Profile Use case Key settings
HIPAA Safe Harbor Healthcare 15 entity types, Safe Harbor transforms, fail-closed
HIPAA Minimum Necessary Narrow healthcare 8 entity types, stricter threshold (0.80)
Financial Banking / insurance Credit cards, account numbers, tax IDs
Security InfoSec Passwords, usernames, IP addresses
Tenet for Enterprises

Looking for organization-wide policy enforcement? Deploy standardized tenets across your team from a central configuration. Audit aggregation, WORM-compliant log retention, and BAA support available.

Talk to us about enterprise controls →

One command activates HIPAA, Financial, or Security mode. Extensible via custom JSON tenets.

08

Local-Only Architecture

Nothing leaves your machine. Period.

Typical cloud PII detection
Your text → API call → Cloud server              ↓           Detection runs remotely              ↓ Results ← API call ← Cloud server

Your data leaves your machine to be scanned. The detection service sees your PHI.

Tenet
Your text → localhost:19990              ↓           ONNX model on your CPU              ↓ Results ← localhost:19990

Loopback only. Not accessible from the network. No external API dependencies.

SOC 2 Collection limitation (P3), encryption in transit (P7), network boundary controls (CC6.6).

~300MB model runs on your CPU via ONNX Runtime — no GPU required, loopback-only, no data leaves your machine.

Evaluating Tenet for your organization?
For security, compliance, and engineering reviewers: Technical Architecture →

Detection accuracy, by the numbers.

0.985 Avg AUC across 6 HIPAA-critical PII types
15 of 18 HIPAA Safe Harbor identifiers covered
6 languages EN · ES · FR · DE · IT · NL

+ Clinical NER — diagnoses, treatments, and lab tests detected to auto-activate HIPAA mode

+ Multilingual — PHI detection works across the languages your patients speak

Validated on 2,710 annotated samples · synthetic data · real-world performance may vary

HIPAA Tenet covers the technical safeguard layer. HIPAA compliance also requires a BAA with Anthropic, staff training, breach notification procedures, and a designated privacy officer. Tenet is built to satisfy §164.312 technical controls — your compliance team handles the rest. Full compliance checklist →

Need Enterprise controls?

Healthcare providers, insurers, and financial institutions deploy Tenet with a BAA, organization-wide policies, and dedicated compliance support.

Let's talk about Enterprise controls →

Try it now

Tenet is available as a research preview for macOS. Download, install, and connect to Claude Cowork in under five minutes.

Download for Mac (.dmg)