AI safety middleware
for .NET.

Screens inputs for prompt injection, PII, toxicity, and 19 harm categories before they reach your LLM. Runs in process, so your inputs never leave your infrastructure for scanning. One NuGet install, four lines of code.

$dotnet add package Invarix.Guard
See pricing Talk to sales
19
harm categories
50+
languages of PII coverage
11
PII entity types
0 ms
cloud round trip
What it catches

Six scanners.
One middleware call.

Built for .NET teams shipping LLM features to production. Everything runs in your process, on your hardware, under your logging.

01

Prompt injection & jailbreaks

Instruction overrides, role hijacking, delimiter injection, social engineering. An ML classifier catches novel attack phrasings that pattern lists miss.

02

Multilingual PII

Emails, phones, SSNs, Luhn validated cards, person names, addresses, passports, tax IDs, in 50+ languages. Redact PII in place or block it outright.

03

Toxicity & semantic harm

Multilingual toxicity detection plus 19 harm categories: hate, violence, self harm, user distress, exploitation. Classified in the source language, no translation hop.

04

Evasion resistant

Normalization defeats leetspeak, zero-width characters, homoglyphs, Base64, and markdown tricks before the models ever see the input.

05

No scanner egress

Models run in process. Your inputs never leave your infrastructure for scanning. One fewer cloud hop, one fewer processor in your privacy review. Works fully offline for local LLM and air gapped deployments.

06

ASP.NET Core native

Drop in middleware: AddInvarixGuard, UseInvarixGuard, done. Or call the scanning engine standalone from any .NET 8+ app.

Program.cs
.NET 8+
using Invarix.Guard.Extensions;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddInvarixGuard(options => options
    .BlockInjection()
    .BlockPII()
    .BlockToxicContent());

var app = builder.Build();
app.UseInvarixGuard();  // ← adds the safety middleware to the pipeline
app.MapPost("/chat", (ChatRequest r) => Results.Ok(new { reply = "safe" });
app.Run();
Pricing

Buy once,
run it forever.

Self serve for product teams, custom for everyone else.

Community

$0
free under Elastic License 2.0

Free for evaluation, internal tools, and commercial products. The main restriction: you can't offer it to third parties as a hosted or managed service (Elastic License 2.0).

  • Prompt injection and jailbreak detection, heuristics plus ML
  • PII detection and redaction across 50+ languages
  • Multilingual toxicity classification
  • 19 semantic harm categories, plus custom categories you define
  • ASP.NET Core middleware or standalone scanning engine
Install from NuGet ↗

Custom Solution

Let's talk
tailored to your environment

For teams with regulated, multi environment, or air gapped deployments that need something the standard tiers don't cover.

  • Direct technical scoping with the founder
  • Custom contractual terms
  • Air gapped or sovereign cloud deployment guidance
  • Bespoke harm categories developed with your team
Talk to Sales
FAQ

Questions we
get a lot.

Why not a cloud content safety API?
Cloud content safety APIs bill per call, and every prompt leaves your infrastructure to be scanned. Invarix.Guard runs in process with no scanner egress: zero per call scanning cost, and your inputs never leave your box even when the LLM call itself goes to a cloud provider. You get 19 harm categories, multilingual PII detection, and redaction built in. Built for teams that can't send sensitive prompts to a third party scanner in the first place.
Why not a hosted prompt scanning service?
Hosted scanning services classify your prompts on the vendor's infrastructure: an extra network hop on the request path, another data processor in your privacy review, and a per call bill. If that fits your threat model, they're a reasonable choice. Invarix.Guard is for teams where it doesn't: finance, healthcare, public sector, legal, defense, and anyone running local or air gapped LLMs.
What support comes with Professional?
None, and that's stated up front: no email, no chat, no SLA. The README and repo docs are the resource. That's part of how a one time lifetime price works instead of a recurring subscription. If your team needs vendor support commitments, we're honestly not the right fit.
How do license keys work?
After purchase you receive an Ed25519 signed license token by email. Set INVARIX_GUARD_LICENSE as an environment variable, or pass it to the registration call in code. The token is verified fully offline against a public key baked into the package. No licensing server, no phone home, no persistent network dependency. Air gapped deployments work out of the box.
Does my license expire?
No. Professional is a lifetime license, per company: one payment, no renewals, no expiry, and all future updates included. The token validates offline against a public key baked into the package, and nothing remote can revoke or expire it. The version you bought keeps running.
Can I run Invarix.Guard in an air gapped environment?
Yes. Drop the models directory into place from the public release, set AutoDownloadModels = false, and the library never makes a network call. License validation is also fully offline.
What's your model licensing situation?
All four detector models are open weight checkpoints sourced from Hugging Face. Per model attribution and the specific upstream license for each model lives in the public models repository at github.com/AlexBatten/invarix-guard-models so you can audit which model came from where, and under what license, before adopting.
Is there an accuracy benchmark I can see?
Yes. We benchmarked Invarix.Guard head to head against the open source DeBERTa-v3 prompt injection model that LLM Guard wraps internally, and against Microsoft Presidio on PII detection. 2,450 multilingual prompts, 210 synthetic PII rows, plus adversarial robustness perturbations. It beats Presidio on PII F1 with zero false positives on that test set, and matches the dedicated injection model at comparable latency, with the full guard stack running in process. Read the full benchmark.