{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "microsoft-presidio", "name": "Presidio", "vendor": "Data Privacy Stack", "vendorUrl": "https://dataprivacystack.org", "kind": "sdk", "category": "guardrails", "summary": "Open-source Python library and Docker services that detect personal data in text and images and replace, mask, hash or encrypt it. Created at Microsoft and run since June 2026 by the community organisation Data Privacy Stack.", "url": "https://www.anchorterminal.com/tools/microsoft-presidio", "markdownUrl": "https://www.anchorterminal.com/tools/microsoft-presidio.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/microsoft-presidio.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/microsoft-presidio.json", "repo": "https://github.com/data-privacy-stack/presidio", "license": "MIT", "transports": [ "http" ], "packages": [ { "registry": "pypi", "name": "presidio-analyzer" }, { "registry": "pypi", "name": "presidio-anonymizer" }, { "registry": "pypi", "name": "presidio-image-redactor" }, { "registry": "pypi", "name": "presidio" } ], "auth": "none", "authNotes": "None. The Python library runs in the caller's process, and the REST containers accept any caller. The FAQ states the endpoints have no built-in authentication by design and should sit behind a gateway, reverse proxy or service mesh (https://presidio.dataprivacystack.org/faq/). Optional recognisers that call Azure AI Language, Azure Health Data Services or a language model take those services' own credentials.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with no hosted or paid option from the project and no account needed. The cost is the compute to run it, plus any outside service an optional recogniser is configured to call (https://github.com/data-privacy-stack/presidio/blob/main/LICENSE).", "priceSummary": "Free ยท OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 11231, "npmWeekly": null, "pypiWeekly": 1217281, "asOf": "2026-10-08" }, "docsUrl": "https://presidio.dataprivacystack.org", "openapi": "https://presidio.dataprivacystack.org/api-docs/api-docs.yml", "capabilities": [ "guard.pii", "guard.self-host" ], "tags": [ "sdk", "open-source", "self-hosted", "local", "python", "free", "docker", "openapi", "pii", "community-governed" ], "lastRelease": "2026-07-22", "graded": true, "anchor": { "graded": true, "score": 66, "grade": "B", "agentReady": false, "rank": 248, "ranked": true, "rankOf": 722, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 63, "payments": 60, "reliability": 78, "schema": 69, "security": 53, "transparency": 65 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 78, "points": 15.6, "reason": "Local-software reading. Installs from PyPI as `presidio-analyzer` and `presidio-anonymizer`, with Python 3.10 to 3.14 stated in the install docs and package metadata (20). Public CI on GitHub Actions tests each package on five Python versions. Six of the last eight runs on main passed, one was cancelled and the run of 8 October 2026 failed (20 of 25). 68 open issues, two of them labelled bug, and 98 open pull requests. Most issues opened since 20 September have no reply (15 of 25). Versions count up as 2.2.x for every release, feature releases included, and CHANGELOG.md has no section for 2.2.364, whose changes sit under unreleased (8 of 15). Version 2.2.364, past 1.0, though the image redactor package is 0.0.60 (15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 69, "points": 11.21, "reason": "API reading for the REST services. An OpenAPI 3.0 document covers eight paths of the analyser and anonymiser. The image redactor's /redact is not in it (22 of 25). presidio.dataprivacystack.org/llms.txt returns 404 (0). Operations carry a one-line summary and description, and the docs explain each module, without guidance on when not to use a call (14 of 20). Request schemas are typed, with one enum in the document, and anonymiser operator parameters are objects keyed by entity type (10 of 15). Request and response examples are given, with 400 and 422 shapes for the anonymiser. The analyser's 500 on missing text is not in the document (11 of 15). Tagged releases and a public changelog, though 2.2.364 has no changelog section and the document's own version reads 2.0 (12 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 69, "points": 11.21, "reason": "`/analyze` takes an entity list, a score threshold and an allow list, and leaves the decision trace off unless return_decision_process is set, so responses can be kept small (20 of 25). Text can be a string or an array for batches. There is no pagination, and none is needed for span lists (14 of 20). Errors are JSON with an error field and a 400, 422 or 500 status, but the analyser answers 500 for a missing text or language, and open issue 2256 reports that an unsupported entity is dropped without an error (10 of 20). Calls are stateless and safe to retry. Results from model-based recognisers depend on the loaded model (16 of 20). Two required fields and working defaults, with a Python library only (9 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 53, "points": 9.28, "reason": "Local-software reading. The REST services have no authentication, and the FAQ says this is by design and that a gateway, proxy or service mesh should sit in front (10 of 30). The analyser only reads text and returns spans. The anonymiser returns a transformed copy and deletes nothing. There are no roles or approval steps (12 of 20). It returns positions, types and scores for the caller's own text, not content from third parties (10). Requests accept a correlation_id that is written to the service log, and return_decision_process explains each match. No audit log beyond that (9 of 15). SECURITY.md routes reports to GitHub private vulnerability reporting with acknowledgement in 48 hours, CodeQL runs in CI and workflow actions are pinned to commit hashes. No published advisories, no bug bounty and no security.txt (12 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "MIT-licensed package the owner runs, with no hosted or paid option from the project, read with the self-hosted rule. 20 for pricing, 20 for a free start and 20 for use without an account or key. No x402, MPP or L402 in the docs or source (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 63, "points": 5.51, "reason": "2.2.364 was released on 22 July 2026, 78 days before the check (20). It is the only release in the last 90 days, with 2.2.363 on 28 June just outside (5 of 20, a quarter of the line where earlier dossiers gave half for two). 30 issues were opened since 1 August and 11 are closed, main had 14 commits in the 30 days to 8 October, and 98 pull requests are open (15 of 25). Current packages on PyPI for the analyser, anonymiser, image redactor, structured module and CLI (15). Dependabot, committed uv lockfiles and CI on five Python versions, with the latest run on main failing (8 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 65, "points": 5.69, "note": "editorial 76, provenance 53", "reason": "MIT licence, with the copyright line changed from Microsoft Corporation to Presidio Contributors in July 2026 (30). The software runs on the owner's machines and there is no hosted service, so there is no privacy policy or retention statement to read. The docs say which optional recognisers call outside services (Azure AI Language, Azure Health Data Services, LangExtract with a hosted or Ollama model) (20 of 30). Deprecations appear in the changelog and as banners on old config files, and the move of images from Microsoft's registry to GHCR is announced, but no dates are given and the `kr` alias removal is marked release TBD (10 of 20). We found no telemetry code in the repository and no statement on telemetry in the docs (16 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "`/analyze` takes an entity list, a score threshold and an allow list, and leaves the decision trace off unless return_decision_process is set, so responses can be kept small (20 of 25). Text can be a string or an array for batches. There is no pagination, and none is needed for span lists (14 of 20). Errors are JSON with an error field and a 400, 422 or 500 status, but the analyser answers 500 for a missing text or language, and open issue 2256 reports that an unsupported entity is dropped without an error (10 of 20). Calls are stateless and safe to retry. Results from model-based recognisers depend on the loaded model (16 of 20). Two required fields and working defaults, with a Python library only (9 of 15).", "maintenance": "2.2.364 was released on 22 July 2026, 78 days before the check (20). It is the only release in the last 90 days, with 2.2.363 on 28 June just outside (5 of 20, a quarter of the line where earlier dossiers gave half for two). 30 issues were opened since 1 August and 11 are closed, main had 14 commits in the 30 days to 8 October, and 98 pull requests are open (15 of 25). Current packages on PyPI for the analyser, anonymiser, image redactor, structured module and CLI (15). Dependabot, committed uv lockfiles and CI on five Python versions, with the latest run on main failing (8 of 10).", "payments": "MIT-licensed package the owner runs, with no hosted or paid option from the project, read with the self-hosted rule. 20 for pricing, 20 for a free start and 20 for use without an account or key. No x402, MPP or L402 in the docs or source (0).", "reliability": "Local-software reading. Installs from PyPI as `presidio-analyzer` and `presidio-anonymizer`, with Python 3.10 to 3.14 stated in the install docs and package metadata (20). Public CI on GitHub Actions tests each package on five Python versions. Six of the last eight runs on main passed, one was cancelled and the run of 8 October 2026 failed (20 of 25). 68 open issues, two of them labelled bug, and 98 open pull requests. Most issues opened since 20 September have no reply (15 of 25). Versions count up as 2.2.x for every release, feature releases included, and CHANGELOG.md has no section for 2.2.364, whose changes sit under unreleased (8 of 15). Version 2.2.364, past 1.0, though the image redactor package is 0.0.60 (15).", "schema": "API reading for the REST services. An OpenAPI 3.0 document covers eight paths of the analyser and anonymiser. The image redactor's /redact is not in it (22 of 25). presidio.dataprivacystack.org/llms.txt returns 404 (0). Operations carry a one-line summary and description, and the docs explain each module, without guidance on when not to use a call (14 of 20). Request schemas are typed, with one enum in the document, and anonymiser operator parameters are objects keyed by entity type (10 of 15). Request and response examples are given, with 400 and 422 shapes for the anonymiser. The analyser's 500 on missing text is not in the document (11 of 15). Tagged releases and a public changelog, though 2.2.364 has no changelog section and the document's own version reads 2.0 (12 of 15).", "security": "Local-software reading. The REST services have no authentication, and the FAQ says this is by design and that a gateway, proxy or service mesh should sit in front (10 of 30). The analyser only reads text and returns spans. The anonymiser returns a transformed copy and deletes nothing. There are no roles or approval steps (12 of 20). It returns positions, types and scores for the caller's own text, not content from third parties (10). Requests accept a correlation_id that is written to the service log, and return_decision_process explains each match. No audit log beyond that (9 of 15). SECURITY.md routes reports to GitHub private vulnerability reporting with acknowledgement in 48 hours, CodeQL runs in CI and workflow actions are pinned to commit hashes. No published advisories, no bug bounty and no security.txt (12 of 20).", "transparency": "MIT licence, with the copyright line changed from Microsoft Corporation to Presidio Contributors in July 2026 (30). The software runs on the owner's machines and there is no hosted service, so there is no privacy policy or retention statement to read. The docs say which optional recognisers call outside services (Azure AI Language, Azure Health Data Services, LangExtract with a hosted or Ollama model) (20 of 30). Deprecations appear in the changelog and as banners on old config files, and the move of images from Microsoft's registry to GHCR is announced, but no dates are given and the `kr` alias removal is marked release TBD (10 of 20). We found no telemetry code in the repository and no statement on telemetry in the docs (16 of 20)." }, "sources": [ { "what": "repository at commit 2523c7b (README, LICENSE, SECURITY.md, SUPPORT.md, CI workflows, source)", "url": "https://github.com/data-privacy-stack/presidio", "seen": "2026-10-08" }, { "what": "changelog", "url": "https://github.com/data-privacy-stack/presidio/blob/main/CHANGELOG.md", "seen": "2026-10-08" }, { "what": "project transition notice", "url": "https://presidio.dataprivacystack.org/project_transition/", "seen": "2026-10-08" }, { "what": "transition blog post, 29 June 2026", "url": "https://dataprivacystack.org/blog/presidio-project-joins-data-privacy-stack/", "seen": "2026-10-08" }, { "what": "OpenAPI document", "url": "https://presidio.dataprivacystack.org/api-docs/api-docs.yml", "seen": "2026-10-08" }, { "what": "installation docs (Python versions, GHCR images)", "url": "https://presidio.dataprivacystack.org/installation/", "seen": "2026-10-08" }, { "what": "FAQ (ownership, no built-in authentication)", "url": "https://presidio.dataprivacystack.org/faq/", "seen": "2026-10-08" }, { "what": "PyPI release history for the analyser package", "url": "https://pypi.org/pypi/presidio-analyzer/json", "seen": "2026-10-08" }, { "what": "PyPI download counts", "url": "https://pypistats.org/api/packages/presidio-analyzer/recent", "seen": "2026-10-08" }, { "what": "GitHub API: stars, releases, issues, CI runs, advisories", "url": "https://api.github.com/repos/data-privacy-stack/presidio", "seen": "2026-10-08" }, { "what": "old address redirects to the new organisation", "url": "https://github.com/microsoft/presidio", "seen": "2026-10-08" }, { "what": "domain registration", "url": "https://rdap.org/domain/dataprivacystack.org", "seen": "2026-10-08" } ], "openQuestions": [ "The lead named Microsoft as vendor. Presidio left Microsoft for the community organisation Data Privacy Stack (announced 29 June 2026). github.com/microsoft/presidio and microsoft.github.io/presidio redirect to the new addresses. The slug keeps the old name.", "No legal entity is named for Data Privacy Stack on its site, the docs or the licence.", "No privacy policy is published, so provenance.privacy is left out. The MIT licence stands in for terms.", "Whether the project runs no telemetry is inferred from a search of the source. The docs make no statement.", "unchecked: the governance documents in the data-privacy-stack/MVG repository were not read.", "unchecked: issue reply times were read from comment counts in the GitHub search API, not from each thread." ] }, "negative": 0, "verdict": "MIT-licensed personal data detector with a public OpenAPI document, tests on Python 3.10 to 3.14 and about 1.2 million weekly PyPI downloads. The REST containers have no authentication, the project states no SLA or support, and it covers personal data only, with no prompt injection or content moderation checks.", "bestFor": "Detecting and masking personal data in prompts, outputs, logs and images on the owner's own machines, with detection tuned by entity, threshold and custom recognisers.", "strengths": [ "MIT licence, source on GitHub, and nothing to buy. No account, key or card is needed to install or run it", "OpenAPI 3.0 document for the analyser and anonymiser REST services, with request examples and 400 and 422 error shapes", "CI runs each package on Python 3.10, 3.11, 3.12, 3.13 and 3.14, with CodeQL and Dependabot configured", "Detection is tunable per call with an entity list, a score threshold, an allow list and ad hoc recognisers", "Anonymiser operators cover replace, redact, mask, hash, encrypt and custom functions, and encrypted values can be reversed with the key" ], "weaknesses": [ "The REST containers have no authentication by design. The FAQ says to put a gateway or proxy in front", "SUPPORT.md states no SLA and no official support. The project is run by volunteers since leaving Microsoft", "One release in the 90 days to 8 October 2026 (2.2.364 on 22 July), and CHANGELOG.md has no section for it", "Covers personal data only. No prompt injection, jailbreak or content moderation checks", "The README warns that detection is automated and may miss personal data, so other protections are still needed", "98 open pull requests, and most issues opened since 20 September 2026 had no reply on 8 October" ], "agentNotes": [ "Install from PyPI or pull images from ghcr.io/data-privacy-stack. The mcr.microsoft.com/presidio-* images are no longer updated", "Download a spaCy model (python -m spacy download en_core_web_lg) before the first `AnalyzerEngine()` call, or use the Docker image", "Send both text and language to `/analyze`. A request missing either returns HTTP 500 with a JSON error field", "Pass entities and score_threshold to limit results. Many country-specific recognisers are disabled by default and need enabling in the registry YAML", "Keep the containers on a private network or behind your own authenticating proxy. They accept any caller" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66 } ], "editorialScores": { "ergonomics": 69, "maintenance": 63, "payments": 60, "reliability": 78, "schema": 69, "security": 53, "transparency": 76 }, "provenanceScore": 53 }, "connect": { "install": "pip install presidio-analyzer presidio-anonymizer\npython -m spacy download en_core_web_lg", "http": "docker run -d -p 5002:3000 ghcr.io/data-privacy-stack/presidio-analyzer:latest\ncurl -X POST http://localhost:5002/analyze \\\n -H \"Content-Type: application/json\" \\\n -d '{\"text\": \"My phone number is 555-123-4567.\", \"language\": \"en\"}'" }, "letme": { "capability": "https://letme.dev/guard.pii", "tool": "https://letme.dev/microsoft-presidio" }, "notable": [ "Presidio moved from Microsoft to Data Privacy Stack, a community organisation with a Technical Steering Committee. The announcement is dated 29 June 2026, and the old GitHub and docs addresses redirect (https://presidio.dataprivacystack.org/project_transition/)", "Container images are published to ghcr.io/data-privacy-stack. The mcr.microsoft.com/presidio-* images stay available for older tags and are no longer updated (https://presidio.dataprivacystack.org/installation/)", "Release 2.2.364 on 22 July 2026 and 2.2.363 on 28 June 2026. `presidio-analyzer` had 1,217,281 PyPI downloads in the week to 8 October 2026 (https://pypistats.org/api/packages/presidio-analyzer/recent)", "The analyser combines named entity recognition (spaCy by default, or Stanza, transformers and GLiNER), regular expressions, checksums and context words. The source tree holds more than 90 predefined recogniser modules, many country-specific and disabled by default (https://github.com/data-privacy-stack/presidio/tree/main/presidio-analyzer/presidio_analyzer/predefined_recognizers)", "The README warns that detection is automated and there is no guarantee that all sensitive information is found (https://github.com/data-privacy-stack/presidio)", "SUPPORT.md states the project has no SLA or official support (https://github.com/data-privacy-stack/presidio/blob/main/SUPPORT.md)" ], "area": "models", "details": [ { "label": "Packages", "value": "`presidio-analyzer` and `presidio-anonymizer` 2.2.364, `presidio-image-redactor` 0.0.60, `presidio-structured` 0.0.8, `presidio-cli` 0.0.9, and the `presidio` meta-package" }, { "label": "Languages", "value": "Python 3.10 to 3.14" }, { "label": "REST endpoints", "value": "Analyser: `/analyze`, `/recognizers`, `/supportedentities`, `/health`. Anonymiser: `/anonymize`, `/deanonymize`, `/anonymizers`, `/deanonymizers`, `/health`. Image redactor: `/redact`" }, { "label": "Detection", "value": "Named entity recognition (spaCy, Stanza, transformers, GLiNER), regular expressions, checksums, context words, allow lists and ad hoc recognisers" }, { "label": "Anonymiser operators", "value": "replace, redact, mask, hash, encrypt, keep, custom, and decrypt for reversal" }, { "label": "Images", "value": "OCR with Tesseract or Azure Document Intelligence, for standard image types and DICOM medical images" }, { "label": "Container images", "value": "`ghcr.io/data-privacy-stack/presidio-analyzer`, `presidio-anonymizer` and `presidio-image-redactor`" }, { "label": "Authentication", "value": "None built in. Deploy behind your own gateway or proxy" }, { "label": "Telemetry", "value": "None found in the source (searched 2026-10-08). The docs make no statement" }, { "label": "Releases in 90 days", "value": "1 (2.2.364 on 2026-07-22)" } ], "provenance": { "legalEntity": "Data Privacy Stack (community organisation, no legal entity stated)", "domain": "dataprivacystack.org", "domainRegistered": "2026-04-13", "domainNote": "A library and self-hosted containers, not a service. Code is on github.com under the data-privacy-stack organisation and docs on presidio.dataprivacystack.org.", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/data-privacy-stack/presidio/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "Presidio was created at Microsoft. The transition notice says it is now a community-governed project under Data Privacy Stack and is not owned or operated by a commercial entity. The blog post announcing the move is dated 29 June 2026.", "github.com/microsoft/presidio answers 301 to github.com/data-privacy-stack/presidio, and microsoft.github.io/presidio shows a moved notice.", "The LICENSE copyright line reads Presidio Contributors. The FAQ says usage terms are the repository's licence and that there is no warranty or SLA.", "No privacy policy was found on dataprivacystack.org or the docs site. Nothing is hosted, so the field is left out.", "security.txt returns 404 on dataprivacystack.org and presidio.dataprivacystack.org. SECURITY.md uses GitHub private vulnerability reporting.", "RDAP gives 2026-04-13 as the registration date of dataprivacystack.org. The repository was created on 4 May 2018." ], "score": 53, "checks": [ { "check": "Legal entity named", "value": "Data Privacy Stack (community organisation, no legal entity stated)", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "dataprivacystack.org, registered 2026-04-13 (under a year)", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the MIT licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/microsoft-presidio.json", "live": { "slug": "microsoft-presidio", "pages": [ { "url": "https://raw.githubusercontent.com/data-privacy-stack/presidio/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:24:05.686879193Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "609d3fe25dbc" } ], "updatedAt": "2026-10-08T18:24:05.686879193Z" } } }