SHIM
An open-source trust-boundary gateway that sits in front of OpenAI, Anthropic and Gemini API traffic to redact PII, enforce rate limits, and track usage without touching your app code.
🔗 Visit SHIM
Description
Every time your app calls OpenAI, Anthropic or Gemini, whatever your users typed — including emails, phone numbers, or card numbers they shouldn't have shared — goes straight to that provider. SHIM sits in between as a checkpoint: it catches and blanks out that sensitive information before the request leaves, without you having to change a line of your app's code.
SHIM is a Python/FastAPI gateway, distributed as a Docker container, that transparently proxies traffic to OpenAI, Anthropic and Gemini. It detects and redacts PII (emails, phone numbers, credit cards, IBANs, national IDs, provider secrets), enforces rate limits (requests/tokens per minute), blocks repeat-loop request patterns, and tags every request with cost/usage attribution via an X-Shim-Tag header. The open-source Community Edition (Apache-2.0) needs no database and keeps state process-local; a paid Enterprise Edition (Elastic License 2.0) adds multi-tenancy, persistent audit logs, RBAC and budget controls.
💬 Our review
The short version: SHIM is a compliance-and-privacy checkpoint for LLM API traffic that you can drop in front of OpenAI, Anthropic and Gemini calls without touching your application code.
Most teams handle PII redaction with custom middleware written ad hoc per project; SHIM packages that as a reusable gateway covering three major providers at once, plus rate limiting and cost tracking most homegrown solutions skip. The free Community Edition is genuinely useful for a single-instance deployment, but its process-local state means it won't share rate-limit or audit state across multiple replicas — that's what the paid Enterprise tier is for. Worth adopting now if you're under GDPR or AI Act-style pressure and want redaction without an app rewrite; the Enterprise tier only matters once you're running it at scale across multiple instances.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Community Edition gratuite (Apache-2.0) ; Enterprise payante (Elastic License 2.0, prix non public)
Pros
Une seule passerelle pour OpenAI, Anthropic et Gemini sans changer le code applicatif
Rédaction PII complète (emails, cartes, IBAN, identifiants nationaux)
Édition Community gratuite et sans dépendance externe
Cons
Détection PII best-effort, pas de garantie à 100%
État local par processus en Community, pas de partage entre répliques
Historique des requêtes non conservé sans l'édition Enterprise payante