Your AI traffic,Masked.
Send prompts to any model. Send personal data to none.shim masks, logs, and tracks every model and agent call. All while optimizing your costs. One base URL, one minute swap.
uv tool install --python 3.12 --compile-bytecode shim
Works with
and more...
Products
Pick where shim sits
On a developer's machine, in front of your apps, on your own servers, or in the AI chats your team already uses.
For developers
shim-cli
Free and open source. Runs on your machine next to Claude Code, Codex, Copilot CLI and VS Code. No account.
For platform teams
AI Gateway
One base URL in front of OpenAI, Anthropic and Gemini. Works on chat messages and on PDF, Word and Excel files.
For IT and security
Enterprise
The AI Gateway on your own servers, with an audit trail you can verify, roles and budgets.
For everyone on your team
shim
Checks what your team types into ChatGPT, Claude, Gemini and other AI chats, in the browser. Early access.
The swap
One line of code.One minute setup.
Keep the client you already have. Every request, to any provider, gets redaction, policy and audit, automatically.
from openai import OpenAI client = OpenAI( api_key="sk-..." )
from openai import OpenAI client = OpenAI( api_key="sk-shim-...", base_url="https://api.getshim.tech/v1")
The mapping never leaves your gateway. The provider only ever sees the token form, and every substitution is written to the audit record.
See it on your own text
We challenge you! Come try us.
Paste a realistic sample, with made-up values, and see exactly what the provider receives, with every IBAN, card number, ID and email stripped on the way. Real engine, no signup.
Open the playgroundWhat you see
"Refund to IBAN TR33 0006 1005 1978 6457 8413 26?"
What AI sees
"Refund to IBAN <IBAN_CODE_9f3c8a…>?"
Dashboard
Capabilities
A cleaning station for AI traffic
Named after the cleaner shrimp: everything passes through, leaves lighter, and nothing that shouldn't travel gets carried along.
Hide personal data
National IDs, IBANs, phone numbers, emails and secrets detected in Turkish and English, replaced with tokens outbound and rehydrated inbound.
Optimize your inputs
Normalize prompts and turn PDFs and spreadsheets into clean Markdown, so the model reads less noise and you pay for fewer tokens.
See what your team spends
Spend broken down by key, team, project and model, so the invoice stops being a single unexplained number.
Routing & backup
Allowlist the models a team may call, pin workloads to a region, and fall back to a second provider when one degrades.
Audit log & evidence
Who called what, with which policy in force, and what was removed. Exportable as an evidence pack.
Full visibility
Latency, error and token traces per request, with a diff view showing exactly what the provider saw.
Governance
The evidence, before anyone asks.
shim won't certify you. It gives you the records and controls a KVKK, GDPR, DORA or EU AI Act audit runs on, right where the data moves.
- Only what's needed leaves. Personal data is replaced before the request crosses a border.
- A record you can't rewrite. Every call, policy version and redaction, queryable and exportable.
- Bring your own keys. Provider credentials stay in your vault. shim never becomes the owner of record.
- A human in the loop. Flag a class of request for a person to review, with every decision on the record.
Wording matters here: compliance is an outcome of your whole programme, not a feature. shim is the control and evidence layer inside it.
Pricing
Start free, pay when it carries load
Free to start on the hosted gateway. Enterprise runs on your own servers and is scoped with you.
Developer
For evaluation, prototypes, and small workloads
- 1M tokens / month
- 1,000 requests / month
- Native provider APIs
- PII detection and masking
- Community support
Enterprise
For custom deployment, oversight, and support needs
- Custom usage and team limits
- Oversight workflows and reports
- Custom deployment and support scope
- Procurement and security review
Switching to clean Markdown cut input tokens by 72%. The exact figure varies by use case.
The questions before the yes
Straight answers to what teams ask before they clean their AI traffic.
No. Not even if we wanted to. Your key is encrypted the moment it reaches us and stays in your own vault reference. The gateway keeps the handshake, never the fingerprint.
Yes. You set the rules per workspace, so you decide what gets masked, blocked, or left alone.
Depends on what slow means to you. Reading this takes about 6 seconds. In that time, shim would have run more than 60 times.
Yes, it is also built for Turkish, not adapted to it. We follow Turkish grammar and catch local identifiers like TCKN and IBAN that most English-first tools miss.
Yes. PDF, Word and Excel files are turned into clean text and checked like any other message.
Any model with an API. Your favorite is almost certainly already supported, and we are very open to special requests.
You choose in advance, per route. Sensitive traffic can stop until shim is back, while internal tools keep flowing straight to the provider.
Yes, on the Enterprise plan. We set it up to fit your own environment and rules.
LiteLLM routes your requests. It was never built to protect your data inside them. shim actually protects your data: redaction in the request path, sensitive data caught automatically, and an audit record no one can quietly rewrite. To see other tool comparisons, check our Resources menu at the top.
Have another question? Ask us here.
Put a cleaning station in front of your models.
Run a two-month pilot on your own traffic. The logs, the evidence and the numbers stay yours, whether you continue or not.
Team
Built by engineers who needed it first
Three co-founders and a GTM lead, building the infrastructure we wished we had.
Mertcan Sağlam
Co-founder
Engineering and product. Enterprise data infrastructure background: Migros data pipelines, OBASE lakehouse architecture.
Can Çağatay Sevgican
Co-founder
Engineering and product. AI engineering, full-stack development and business development.
Turgay Bulut
Co-founder
Competitive programmer. The performance and correctness engine behind the gateway core.
