RuneLM is a fail-closed data-sanitization proxy that sits between your application and any LLM provider. Every outbound prompt is classified, pseudonymized, and routed by sensitivity; responses are rehydrated only at the placeholders the proxy created on the way out. There is no cleartext fallback code path.
Classify (nine-stage pipeline: regex entity types, NER, and operator-defined lists, where later stages can only escalate a level, never lower it) → pseudonymize (deterministic, session-scoped, type-preserving, salted placeholders) → route by tier (HIGH stays local; MEDIUM goes to contracted providers carrying a current DPA; LOW may go anywhere) → rehydrate only what the outbound map created. Only the HIGH path gives full isolation; the MEDIUM path is probabilistic risk reduction under contract.
The community core is open source (Apache-2.0, v0.1.0a0). The PyPI package is on its way; today you install from source:
git clone https://github.com/BlackUnicornSecurity/runelm.git
cd runelm
pip install -e .