CipherBond Install

Local-first data protection for AI

Use frontier AI on your most sensitive work. Reveal nothing.

CipherBond pseudonymizes sensitive values before they leave your machine — swapping them for coherent stand-ins — then restores the real values locally when the response returns. The re-identification key never leaves your device.

Install Read the source

Windows v0.1.6 — validated end-to-end macOS build in validation

Install

Install in one line.

One command, a silent install — no prompts. It runs locally; your existing tools and commands don't change.

Windows · PowerShell
irm https://cipherbond.com/install.ps1 | iex

Silent, unattended install — validated end-to-end on Windows (v0.1.6).

Prefer a direct download?

cipherbond-setup.exe Windows cipherbond.dmg macOS

Latest release from GitHub. View all releases & checksums ↗

How it works

Watch a request get pseudonymized on the way out.

Your tool runs exactly as before. CipherBond intercepts each outbound request on localhost, swaps sensitive values for coherent stand-ins, and forwards it clean — nothing is sent directly.

outbound request · intercepted on localhost 
# your tool runs exactly as before
$ aider --model claude

↓ intercepted on localhost — values swapped, not deleted

  POST api.anthropic.com/v1/messages
  authorization: Bearer sk-ant-a83f…2c1 → Bearer sk-ant-7f02…9bd ·pseudonymized·
  "refactor billing in src/billing/charge.ts → src/ledger/quux.ts" ·pseudonymized·
  notify ana@acme.io → mara@vending.dev ·pseudonymized·

↑ forwarded clean — secrets stayed home

When the response returns, the stand-ins are swapped back to your real values locally — so what you read is exactly right.

Security

Built so the safe thing is the default thing.

  • Keys never leave the device

    The re-identification key lives in a local file. No vendor in the loop, nothing of yours for anyone to process.

  • Tamper-evident audit trail

    Every swap is recorded locally, so you can show exactly what left your machine and what never did.

  • Fails closed by design

    If a request can't be processed, it doesn't go out. No silent fallthrough, no leak on error.

  • Stays in your environment

    Runs as a local proxy on your machine. Nothing is sent to us — there is no us in the data path.

Deterministic pseudonymization

Coherent stand-ins, not blacked-out redactions.

The same real value always becomes the same realistic stand-in — a believable key, name, or path. The model reasons about your request correctly instead of choking on blacked-out holes, and your real values are restored locally before the response reaches you.

Keeping that mapping stable across a long document and a streamed response takes more than a lookup table. Read the engineering note

What's protected

Built to catch what you can't afford to leak.

CipherBond recognizes well-known secret formats out of the box, plus the patterns and paths you mark sensitive.

Credentials & secrets

The things that turn a leaked prompt into an incident.

  • API keys & access tokens
  • .env values and connection strings
  • Private keys & Authorization headers
  • OAuth and session tokens
sk-…AKIA…ghp_…xoxb-…-----BEGIN KEY-----

Personal data (PII)

Customer and personal details that shouldn’t train anyone’s model.

  • Emails, phone numbers, addresses
  • Names tied to records
  • Customer data pasted into prompts
  • Common ID and card-number formats
name@co.com+1 555…SSN4111 1111 …

Proprietary code & IP

The source and structure that make your product yours.

  • Files & paths you mark proprietary
  • Internal hostnames & service names
  • Unreleased source in your prompts
  • Business logic in comments
src/billing/…internal.host// pricing rules

Catches what autonomous tools send — not just what you type.

An agent ingesting a document, a coding agent dumping a .env into context, an MCP call reaching out on its own — these requests never touch a browser, so browser-era tools can't see them. CipherBond sits at the egress point on your machine, so it does.

A strong safety net — not a magic guarantee. CipherBond catches known patterns and your configured rules; review what you mark sensitive, and keep secrets out of prompts where you can.

Open source & security

Don't trust us. Read the code.

A privacy tool you can't inspect is just a different black box. The bridges and installer are open. The engine ships as public, checksummed binaries — so you can verify exactly what runs on your machine, and the key never leaves it.

The bridge Fully open source

bridge-claude-code

The per-tool integration that points Claude Code (and other CLIs) at CipherBond. Small, readable, and the same install script you pipe to your shell.

View on GitHub
The tray app Installer + releases

cipherbond

The one-click installer and tray manager for Windows and macOS, plus every release. Open an issue, read the source, file a PR.

View on GitHub
The Hub engine Signed binaries + checksums

cipherbond-hub-releases

The local proxy engine ships as public, checksummed binaries here. The engine source stays private — but every artifact you run is published with a SHA-256 you can verify.

View on GitHub

On macOS? The build is in tester validation — watch the repo to be first to the validated release.

The Cipher family

One way of working, across the lifecycle of sensitive data.

CipherBond

You're here

Guards what goes out.

Pseudonymizes sensitive values before they reach any AI, and restores them locally. Free, local, open.

CipherSigil

Proves what comes of it — the enterprise layer.

Verifiable provenance and audit for AI output across a team. The system tier.

Netherchat

Open source. The room vanishes, the proof remains.

Ephemeral, verifiable conversations. Nothing persists but the proof.

An Astralis product.