{ "data": { "a": { "slug": "microsoft-presidio", "name": "Presidio", "vendor": "Data Privacy Stack", "vendorUrl": "https://dataprivacystack.org", "kind": "sdk", "category": "guardrails", "summary": "Open-source Python library and Docker services that detect personal data in text and images and replace, mask, hash or encrypt it. Created at Microsoft and run since June 2026 by the community organisation Data Privacy Stack.", "url": "https://www.anchorterminal.com/tools/microsoft-presidio", "markdownUrl": "https://www.anchorterminal.com/tools/microsoft-presidio.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/microsoft-presidio.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/microsoft-presidio.json", "dns": "microsoft-presidio.grade.anchorterminal.com", "repo": "https://github.com/data-privacy-stack/presidio", "license": "MIT", "transports": [ "http" ], "packages": [ { "registry": "pypi", "name": "presidio-analyzer" }, { "registry": "pypi", "name": "presidio-anonymizer" }, { "registry": "pypi", "name": "presidio-image-redactor" }, { "registry": "pypi", "name": "presidio" } ], "auth": "none", "authNotes": "None. The Python library runs in the caller's process, and the REST containers accept any caller. The FAQ states the endpoints have no built-in authentication by design and should sit behind a gateway, reverse proxy or service mesh (https://presidio.dataprivacystack.org/faq/). Optional recognisers that call Azure AI Language, Azure Health Data Services or a language model take those services' own credentials.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with no hosted or paid option from the project and no account needed. The cost is the compute to run it, plus any outside service an optional recogniser is configured to call (https://github.com/data-privacy-stack/presidio/blob/main/LICENSE).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 11231, "npmWeekly": null, "pypiWeekly": 1217281, "asOf": "2026-10-08" }, "docsUrl": "https://presidio.dataprivacystack.org", "openapi": "https://presidio.dataprivacystack.org/api-docs/api-docs.yml", "capabilities": [ "guard.pii", "guard.self-host" ], "tags": [ "sdk", "open-source", "self-hosted", "local", "python", "free", "docker", "openapi", "pii", "community-governed" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 64.8, "grade": "B", "agentReady": false, "rank": 451, "ranked": true, "rankOf": 1510, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 78, "payments": 60, "reliability": 78, "schema": 71, "security": 53, "transparency": 67 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "-3. A released fix of the listing's own described flaw with no advisory. 2.2.365 (25 October 2026) fixed `ConflictResolutionStrategy.REMOVE_INTERSECTIONS` trimming overlapping results to zero length and \"leaving the flagged text in clear\" (#2331), and chunked NER recognisers dropping an entity that straddles a chunk boundary, which \"left part of the entity in clear\" (#2362). For a personal data redaction tool, flagged data left unredacted is a described privacy flaw, read as PostHog's privacy mode leaks were. Both sit under Fixed, not Security, and OSV lists no advisory. https://github.com/data-privacy-stack/presidio/blob/main/CHANGELOG.md" ], "verdict": "MIT-licensed personal data detector with a public OpenAPI document, two releases in late October 2026 and about 1.2 million weekly PyPI downloads. The REST containers have no authentication, 2.2.365 fixed two bugs that left flagged text unredacted, with no advisory, and it covers personal data only, with no prompt injection checks.", "bestFor": "Detecting and masking personal data in prompts, outputs, logs and images on the owner's own machines, with detection tuned by entity, threshold and custom recognisers.", "strengths": [ "MIT licence, source on GitHub, and nothing to buy. No account, key or card is needed to install or run it", "OpenAPI 3.0 document for the analyser and anonymiser REST services, with request examples and 400 and 422 error shapes", "Two releases in October 2026 (2.2.365 and 2.2.366), each with a dated changelog section crediting outside contributors", "Detection is tunable per call with an entity list, a score threshold, an allow list and ad hoc recognisers", "Distroless analyser and anonymiser images since 2.2.366, with no shell or package manager, running as a non-root user" ], "weaknesses": [ "The REST containers have no authentication by design. The FAQ says to put a gateway or proxy in front", "2.2.365 fixed two bugs that left flagged personal data in clear, filed as ordinary fixes with no security advisory", "SUPPORT.md states no SLA and no official support. The project is run by volunteers since leaving Microsoft", "Covers personal data only. No prompt injection, jailbreak or content moderation checks", "The README warns that detection is automated and may miss personal data, so other protections are still needed", "No llms.txt, and the image redactor's `/redact` is missing from the OpenAPI document" ], "agentNotes": [ "Install from PyPI or pull images from ghcr.io/data-privacy-stack. The mcr.microsoft.com/presidio-* images are no longer updated", "Use Python 3.11 to 3.14. Since 2.2.366 a Python 3.10 environment resolves to older releases", "Download a spaCy model (python -m spacy download en_core_web_lg) before the first `AnalyzerEngine()` call, or use the Docker image", "Send both text and language to `/analyze`. A request missing either returns HTTP 500 with a JSON error field", "Pass entities and score_threshold to limit results. Many country-specific recognisers are disabled by default and need enabling in the registry YAML", "Keep the containers on a private network or behind your own authenticating proxy. They accept any caller", "Rebuild any spaCy pipeline saved with `hf_token_pipe` before upgrading to 2.2.366, which registers `presidio_hf_token_pipe` instead" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.8 } ], "editorialScores": { "ergonomics": 69, "maintenance": 78, "payments": 60, "reliability": 78, "schema": 71, "security": 53, "transparency": 76 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install presidio-analyzer presidio-anonymizer\npython -m spacy download en_core_web_lg", "http": "docker run -d -p 5002:3000 ghcr.io/data-privacy-stack/presidio-analyzer:latest\ncurl -X POST http://localhost:5002/analyze \\\n -H \"Content-Type: application/json\" \\\n -d '{\"text\": \"My phone number is 555-123-4567.\", \"language\": \"en\"}'" }, "letme": { "capability": "https://letme.dev/guard.pii", "tool": "https://letme.dev/microsoft-presidio" }, "area": "models", "provenance": { "legalEntity": "Data Privacy Stack (community organisation, no legal entity stated)", "domain": "dataprivacystack.org", "domainRegistered": "2026-04-13", "domainNote": "A library and self-hosted containers, not a service. Code is on github.com under the data-privacy-stack organisation and docs on presidio.dataprivacystack.org.", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/data-privacy-stack/presidio/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "Presidio was created at Microsoft. The transition notice says it is now a community-governed project under Data Privacy Stack and is not owned or operated by a commercial entity. The blog post announcing the move is dated 29 June 2026.", "github.com/microsoft/presidio answers 301 to github.com/data-privacy-stack/presidio, and microsoft.github.io/presidio shows a moved notice.", "The LICENSE copyright line reads Presidio Contributors. The FAQ says usage terms are the repository's licence and that there is no warranty or SLA.", "No privacy policy was found on dataprivacystack.org or the docs site. Nothing is hosted, so the field is left out.", "security.txt returns 404 on dataprivacystack.org and presidio.dataprivacystack.org. SECURITY.md uses GitHub private vulnerability reporting.", "RDAP gives 2026-04-13 as the registration date of dataprivacystack.org. The repository was created on 4 May 2018." ], "score": 58 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/microsoft-presidio.json", "live": { "slug": "microsoft-presidio", "versions": [ { "registry": "github", "name": "data-privacy-stack/presidio", "version": "2.2.366", "released": "2026-10-27", "seenAt": "2026-11-06T23:45:34.285543655Z" }, { "registry": "pypi", "name": "presidio", "version": "2.2.366", "released": "2026-10-27", "seenAt": "2026-11-06T23:45:32.29634943Z" }, { "registry": "pypi", "name": "presidio-analyzer", "version": "2.2.366", "released": "2026-10-27", "seenAt": "2026-11-06T23:45:28.205778582Z" }, { "registry": "pypi", "name": "presidio-anonymizer", "version": "2.2.366", "released": "2026-10-27", "seenAt": "2026-11-06T23:45:28.455420517Z" }, { "registry": "pypi", "name": "presidio-image-redactor", "version": "0.0.62", "released": "2026-10-27", "seenAt": "2026-11-06T23:45:30.338344924Z" } ], "githubStars": 11767, "pypiWeekly": 1405255, "securityTxt": { "url": "https://dataprivacystack.org/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:26.99229262Z" }, "domain": { "domain": "dataprivacystack.org", "registered": "2026-04-13", "source": "https://rdap.publicinterestregistry.org/rdap/domain/dataprivacystack.org", "checkedAt": "2026-11-01T14:12:18.496890091Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/data-privacy-stack/presidio/main/CHANGELOG.md", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:20:27.940726354Z", "changedAt": "2026-10-28T04:43:21.227120432Z", "fingerprint": "5ca73e364b6f" } ], "github": { "repo": "data-privacy-stack/presidio", "checkedAt": "2026-11-02T08:42:46.233623159Z", "stars": 11628, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-01T09:32:36Z", "openIssues": 94, "openPRs": 147, "issuesOpened90d": 63, "issuesClosed90d": 19, "prsMerged90d": 40, "ci": { "branch": "main", "runs": 50, "success": 49, "failure": 1, "other": 0, "latest": "success", "latestAt": "2026-11-01T09:33:59Z" }, "replies": { "sampled": 25, "unanswered": 17, "medianDays": 3.3 } }, "updatedAt": "2026-11-07T16:01:26.99229262Z" } }, "answer": "Presidio scores 64.8 (B) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories.", "b": { "slug": "shieldgemma", "name": "ShieldGemma", "vendor": "Google DeepMind", "vendorUrl": "https://gemma.ai/models/shieldgemma.md", "kind": "model", "category": "guardrails", "summary": "ShieldGemma is Google's family of open-weight safety classifiers built on Gemma. ShieldGemma 1 (2B, 9B, 27B) scores English text against hate, harassment, dangerous and sexual content policies, and ShieldGemma 2 (4B) scores images. The owner runs them.", "url": "https://www.anchorterminal.com/tools/shieldgemma", "markdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shieldgemma.json", "dns": "shieldgemma.grade.anchorterminal.com", "repo": "https://huggingface.co/collections/google/shieldgemma-67d130ef8da6af884072a789", "license": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "transports": [], "packages": [ { "registry": "huggingface", "name": "google/shieldgemma-2b" }, { "registry": "huggingface", "name": "google/shieldgemma-9b" }, { "registry": "huggingface", "name": "google/shieldgemma-27b" }, { "registry": "huggingface", "name": "google/shieldgemma-2-4b-it" }, { "registry": "ollama", "name": "shieldgemma" } ], "auth": "none", "authNotes": "No key is needed to run the model. Google's files on Hugging Face are gated, so a person logs in, reviews the Gemma licence and accepts it, and the Hub page says requests are approved immediately. Kaggle also needs an account. Ollama's library copies of ShieldGemma 1 pull with no account. Any authentication on the server is the owner's to add (checked 2026-11-06).", "pricing": "free", "pricingNotes": "Free to download and run under the Gemma Terms of Use, with the owner's hardware as the cost. Google sells no hosted ShieldGemma that we found, and the Hub's API lists no inference provider for any of the four repositories (checked 2026-11-06).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "Weights the owner downloads and runs, so there is nothing to pay per call and no payment protocol (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://gemma.ai/models/shieldgemma/model-card-v1.md", "llmsTxt": "https://gemma.ai/llms.txt", "capabilities": [ "guard.moderation", "guard.policy", "guard.self-host" ], "tags": [ "model", "open-weights", "self-hosted", "local", "free", "gated", "multimodal", "python", "ollama" ], "lastRelease": "2025-04-04", "graded": true, "anchor": { "graded": true, "score": 54, "grade": "C", "agentReady": false, "rank": 927, "ranked": true, "rankOf": 1510, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.", "bestFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "strengths": [ "Scoring mode returns the probability of `Yes` per policy from one forward pass, so the caller sets its own threshold", "Four sizes, ShieldGemma 1 at 2B, 9B and 27B for text and ShieldGemma 2 at 4B for images", "Cards give the exact guideline wording for each harm type, separately for input and output filtering, in Markdown listed in gemma.ai/llms.txt", "Google accounts replied to every Hub thread we sampled, the newest on 22 March 2026", "Safetensors only, loaded through Transformers classes with no remote code, and Ollama's library carries ShieldGemma 1" ], "weaknesses": [ "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy", "ShieldGemma 1 covers four harm types in English only, and neither generation has a prompt-injection or jailbreak category", "Each call checks one policy, so screening all four text harm types takes four passes", "Google's files need a Hugging Face or Kaggle login and licence acceptance before download", "The Gemma Terms of Use add a prohibited use policy and let Google restrict usage remotely" ], "agentNotes": [ "Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording", "Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use", "Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output", "Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category", "Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54 } ], "editorialScores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 50 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install -U transformers[accelerate]" }, "letme": { "capability": "https://letme.dev/guard.moderation", "tool": "https://letme.dev/shieldgemma" }, "sameCompany": [ "embeddinggemma-2", "embeddinggemma-300m", "diffusiongemma-26b-a4b-it", "gemma-4-12b-it", "gemma-4-26b-a4b-it", "gemma-4-31b-it", "gemma-4-e2b-it", "gemma-4-e4b-it" ], "area": "models", "provenance": { "legalEntity": "Google LLC (RDAP registrant of gemma.ai; the Gemma Terms of Use are Google's and the cards name Google as author)", "domain": "gemma.ai", "domainRegistered": "2017-12-16", "endpointOnVendorDomain": null, "terms": "https://gemma.ai/resources/terms.md", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "Nothing is hosted, so the Gemma Terms of Use stand in for terms of service and no privacy policy is scored.", "RDAP for gemma.ai, read on 6 November 2026, gives a registration date of 16 December 2017 and Google LLC as registrant, with MarkMonitor as registrar.", "gemma.ai/.well-known/security.txt answered with the site's HTML page, not a security.txt, on 6 November 2026. Google's company-wide security.txt at www.google.com is valid until 1 April 2030 and points to its vulnerability reward programme.", "gemma.ai/robots.txt and ai.google.dev/robots.txt allow our reader. huggingface.co/robots.txt allows all paths, and the Hub's model API was used for file metadata and discussion authors only.", "The Hugging Face README files sit behind the gate (raw files answered 401 without a login), so the cards were read from gemma.ai and the public model pages." ], "score": 58 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shieldgemma.json", "live": { "slug": "shieldgemma", "securityTxt": { "url": "https://gemma.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:22.210945228Z" }, "llmsTxt": { "url": "https://gemma.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:54.388179097Z" }, "updatedAt": "2026-11-07T16:00:22.210945228Z" } }, "edges": [ { "by": 38, "category": "maintenance", "leads": "microsoft-presidio", "name": "Maintenance \u0026 community", "reasons": { "a": "2.2.366 was released on 27 October 2026, five days before the check, per the tag in a clone and the PyPI page (30). Two releases since 3 August, 2.2.365 on 25 October and 2.2.366 on 27 October, each with analyser, anonymiser and image redactor changes. Half the line for two, as earlier dossiers read it (10 of 20). Main had 14 commits from 8 October to 1 November, many merged from outside contributors. Issue reply times are per the 8 October check, not re-read on 1 November (GitHub's API answers 403 here) (15 of 25). Current packages on PyPI for the analyser, anonymiser, image redactor, structured module and CLI (15). Dependabot, committed uv lockfiles refreshed in 2.2.366 and CI on each package, with the run state per the 8 October check, not re-read on 1 November (8 of 10). 30+10+15+15+8 = 78.", "b": "Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40." }, "scores": { "a": 78, "b": 40 } }, { "by": 32, "category": "reliability", "leads": "microsoft-presidio", "name": "Reliability", "reasons": { "a": "Local-software reading. Installs from PyPI as `presidio-analyzer` and `presidio-anonymizer`. Since 2.2.366 (27 October 2026) the packages require Python 3.11 to 3.14, per the PyPI page and the package metadata (20). Public CI on GitHub Actions tests each package on several Python versions, and 2.2.366 added e2e runs against the distroless images. Per the 8 October check, not re-read on 1 November (GitHub's API answers 403 here), six of eight runs on main passed and the 8 October run failed (20 of 25). Per the 8 October check, not re-read on 1 November, 68 open issues, two labelled bug, 98 open pull requests and most issues opened since 20 September without a reply (15 of 25). Every release counts up as 2.2.x, and 2.2.366 renames the `hf_token_pipe` spaCy factory in a patch number. CHANGELOG.md now has sections for 2.2.364, 2.2.365 and 2.2.366 and calls out the rename (8 of 15). Version 2.2.366, past 1.0, though the image redactor package is 0.0.62 (15). 20+20+15+8+15 = 78.", "b": "Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46." }, "scores": { "a": 78, "b": 46 } }, { "by": 15, "category": "schema", "leads": "microsoft-presidio", "name": "Schema \u0026 documentation", "reasons": { "a": "API reading for the REST services. An OpenAPI 3.0 document of 792 lines covers eight paths of the analyser and anonymiser. The image redactor's /redact is not in it (22 of 25). presidio.dataprivacystack.org/llms.txt returns 404 on 1 November 2026 (0). Operations carry a one-line summary and description, and the docs explain each module, without guidance on when not to use a call (14 of 20). Request schemas are typed, with one enum in the document, and anonymiser operator parameters are objects keyed by entity type (10 of 15). Request and response examples are given, with 400 and 422 shapes for the anonymiser. The analyser's 500 on missing text is not in the document (11 of 15). Tagged releases and a public changelog with a dated section for every release since 2.2.364, which the 8 October check found missing. The document's own version still reads 2.0 (14 of 15). 22+0+14+10+11+14 = 71.", "b": "Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56." }, "scores": { "a": 71, "b": 56 } }, { "by": 13, "category": "transparency", "leads": "microsoft-presidio", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT licence, with the copyright line changed from Microsoft Corporation to Presidio Contributors in July 2026 (30). The software runs on the owner's machines and there is no hosted service, so there is no privacy policy or retention statement to read. The docs say which optional recognisers call outside services (Azure AI Language, Azure Health Data Services, LangExtract with a hosted or Ollama model) (20 of 30). Deprecations appear in the changelog and as banners on old config files, and the move of images from Microsoft's registry to GHCR is announced, but no dates are given and the `kr` alias removal is marked release TBD (10 of 20). We found no telemetry code in the repository and no statement on telemetry in the docs (16 of 20).", "b": "The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50." }, "scores": { "a": 67, "b": 54 } }, { "by": 8, "category": "payments", "leads": "microsoft-presidio", "name": "Payments \u0026 pricing", "reasons": { "a": "MIT-licensed package the owner runs, with no hosted or paid option from the project, read with the self-hosted rule. 20 for pricing, 20 for a free start and 20 for use without an account or key. No x402, MPP or L402 in the docs or source (0).", "b": "Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52." }, "scores": { "a": 60, "b": 52 } } ], "facts": [ { "a": "SDK + MCP", "b": "Model API", "name": "Kind" }, { "a": "Data Privacy Stack", "b": "Google DeepMind", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "", "name": "Transports" }, { "a": "None", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-27", "b": "2025-04-04", "name": "Last release" }, { "a": "no document linked", "b": "2026-04-01", "name": "Terms last updated" }, { "a": "no document linked", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "yes", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "11k stars, 1.2M PyPI/wk", "b": "none", "name": "Popularity" }, { "a": "3.3/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Presidio scores 64.8 (B) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories.", "question": "Which is better for AI agents, Presidio or ShieldGemma?" }, { "answer": "No hosted endpoint is listed for Presidio. No hosted endpoint is listed for ShieldGemma.", "question": "Can an agent call Presidio and ShieldGemma without installing anything?" }, { "answer": "Presidio is open source (MIT). No open-source release is listed for ShieldGemma.", "question": "Are Presidio and ShieldGemma open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 78 against 46", "Schema \u0026 documentation, 71 against 56", "Payments \u0026 pricing, 60 against 52", "Maintenance \u0026 community, 78 against 40", "Transparency \u0026 trust, 67 against 54" ], "also": [ "Open source" ], "goodFor": "Detecting and masking personal data in prompts, outputs, logs and images on the owner's own machines, with detection tuned by entity, threshold and custom recognisers.", "slug": "microsoft-presidio", "watchFor": "The REST containers have no authentication by design. The FAQ says to put a gateway or proxy in front" }, { "aheadOn": null, "also": [ "No incidents deducted, where Presidio loses 3 points for them" ], "goodFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "slug": "shieldgemma", "watchFor": "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy" } ], "history": { "microsoft-presidio": [ { "causes": [ "security", "product" ], "date": "2026-11-01", "delta": -1.4, "from": 66.2, "fromGrade": "B", "to": 64.8, "toGrade": "B" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.1, "from": 66.1, "fromGrade": "B", "to": 66.2, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 66, "fromGrade": "B", "to": 66.1, "toGrade": "B" } ], "shieldgemma": null }, "job": { "capability": "guard.self-host", "name": "Self-hosted guardrails" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.json", "title": "Amazon Bedrock Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.json", "title": "Azure AI Content Safety (Prompt Shields) vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.json", "title": "Cisco AI Defense Inspection API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.json", "title": "Google Cloud Model Armor vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.json", "title": "Granite Guardian vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.json", "title": "Guardrails AI vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.json", "title": "Lakera Guard (Check Point AI Guardrails) vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.json", "title": "Llama Guard 4 vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.json", "title": "Mistral Moderation API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.json", "title": "NVIDIA NeMo Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.json", "title": "OpenAI Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.json", "title": "OpenAI Moderation API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.json", "title": "Prisma AIRS AI Runtime Security API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.json", "title": "AgentGate vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.json", "title": "LlamaFirewall vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-microsoft-presidio.json", "title": "Amazon Bedrock Guardrails vs Presidio", "url": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-microsoft-presidio" }, { "json": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-microsoft-presidio.json", "title": "Cisco AI Defense Inspection API vs Presidio", "url": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-microsoft-presidio" }, { "json": "https://www.anchorterminal.com/compare/google-model-armor-vs-microsoft-presidio.json", "title": "Google Cloud Model Armor vs Presidio", "url": "https://www.anchorterminal.com/compare/google-model-armor-vs-microsoft-presidio" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-microsoft-presidio.json", "title": "Guardrails AI vs Presidio", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-microsoft-presidio" }, { "json": "https://www.anchorterminal.com/compare/lakera-guard-vs-microsoft-presidio.json", "title": "Lakera Guard (Check Point AI Guardrails) vs Presidio", "url": "https://www.anchorterminal.com/compare/lakera-guard-vs-microsoft-presidio" }, { "json": "https://www.anchorterminal.com/compare/llamafirewall-vs-microsoft-presidio.json", "title": "LlamaFirewall vs Presidio", "url": "https://www.anchorterminal.com/compare/llamafirewall-vs-microsoft-presidio" }, { "json": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-mistral-moderation.json", "title": "Presidio vs Mistral Moderation API", "url": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-mistral-moderation" }, { "json": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-nemo-guardrails.json", "title": "Presidio vs NVIDIA NeMo Guardrails", "url": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-nemo-guardrails" }, { "json": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-openai-guardrails.json", "title": "Presidio vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-prisma-airs.json", "title": "Presidio vs Prisma AIRS AI Runtime Security API", "url": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-prisma-airs" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-microsoft-presidio.json", "title": "AgentGate vs Presidio", "url": "https://www.anchorterminal.com/compare/agentgate-vs-microsoft-presidio" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-microsoft-presidio.json", "title": "Granite Guardian vs Presidio", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-microsoft-presidio" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-microsoft-presidio.json", "title": "Llama Guard 4 vs Presidio", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-microsoft-presidio" } ], "panel": null, "scores": [ { "by": 32, "edge": "microsoft-presidio", "key": "reliability", "microsoft-presidio": 78, "name": "Reliability", "shieldgemma": 46, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 15, "edge": "microsoft-presidio", "key": "schema", "microsoft-presidio": 71, "name": "Schema \u0026 documentation", "shieldgemma": 56, "weight": 13 }, { "by": 3, "edge": "shieldgemma", "key": "ergonomics", "microsoft-presidio": 69, "name": "Agent ergonomics", "shieldgemma": 72, "weight": 13 }, { "by": 0, "edge": "", "key": "security", "microsoft-presidio": 53, "name": "Security \u0026 auth", "shieldgemma": 53, "weight": 14 }, { "by": 8, "edge": "microsoft-presidio", "key": "payments", "microsoft-presidio": 60, "name": "Payments \u0026 pricing", "shieldgemma": 52, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 38, "edge": "microsoft-presidio", "key": "maintenance", "microsoft-presidio": 78, "name": "Maintenance \u0026 community", "shieldgemma": 40, "weight": 7 }, { "by": 13, "edge": "microsoft-presidio", "key": "transparency", "microsoft-presidio": 67, "name": "Transparency \u0026 trust", "shieldgemma": 54, "weight": 7 } ], "summary": "Presidio scores 64.8 (B) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories. Both do self-hosted guardrails.", "tasks": null, "tutorials": [], "verdicts": { "microsoft-presidio": "MIT-licensed personal data detector with a public OpenAPI document, two releases in late October 2026 and about 1.2 million weekly PyPI downloads. The REST containers have no authentication, 2.2.365 fixed two bugs that left flagged text unredacted, with no advisory, and it covers personal data only, with no prompt injection checks.", "shieldgemma": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma", "json": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.min.md" }, "markdown": "Presidio scores 64.8 (B) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories. Both do self-hosted guardrails.\n\n- Presidio: grade B, 64.8/100, rank #451 of 1510. Markdown https://www.anchorterminal.com/tools/microsoft-presidio.md · JSON https://www.anchorterminal.com/api/v1/tools/microsoft-presidio.json\n- ShieldGemma: grade C, 54/100, rank #927 of 1510. Markdown https://www.anchorterminal.com/tools/shieldgemma.md · JSON https://www.anchorterminal.com/api/v1/tools/shieldgemma.json\n- Best guardrails and safety filters for AI agents: https://www.anchorterminal.com/best/guardrails/index.md\n- All 155 guardrails comparisons: https://www.anchorterminal.com/compare/guardrails/index.md\n\n## Which one, for what\n\n### Presidio (B)\n\nGood for: Detecting and masking personal data in prompts, outputs, logs and images on the owner's own machines, with detection tuned by entity, threshold and custom recognisers.\n\nAhead on:\n- Reliability, 78 against 46\n- Schema \u0026 documentation, 71 against 56\n- Payments \u0026 pricing, 60 against 52\n- Maintenance \u0026 community, 78 against 40\n- Transparency \u0026 trust, 67 against 54\n\nAlso in its favour:\n- Open source\n\nWatch for: The REST containers have no authentication by design. The FAQ says to put a gateway or proxy in front\n\n### ShieldGemma (C)\n\nGood for: Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.\n\nAlso in its favour:\n- No incidents deducted, where Presidio loses 3 points for them\n\nWatch for: No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Presidio +38\n\n- Presidio (78): 2.2.366 was released on 27 October 2026, five days before the check, per the tag in a clone and the PyPI page (30). Two releases since 3 August, 2.2.365 on 25 October and 2.2.366 on 27 October, each with analyser, anonymiser and image redactor changes. Half the line for two, as earlier dossiers read it (10 of 20). Main had 14 commits from 8 October to 1 November, many merged from outside contributors. Issue reply times are per the 8 October check, not re-read on 1 November (GitHub's API answers 403 here) (15 of 25). Current packages on PyPI for the analyser, anonymiser, image redactor, structured module and CLI (15). Dependabot, committed uv lockfiles refreshed in 2.2.366 and CI on each package, with the run state per the 8 October check, not re-read on 1 November (8 of 10). 30+10+15+15+8 = 78.\n- ShieldGemma (40): Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.\n\n### Reliability: Presidio +32\n\n- Presidio (78): Local-software reading. Installs from PyPI as `presidio-analyzer` and `presidio-anonymizer`. Since 2.2.366 (27 October 2026) the packages require Python 3.11 to 3.14, per the PyPI page and the package metadata (20). Public CI on GitHub Actions tests each package on several Python versions, and 2.2.366 added e2e runs against the distroless images. Per the 8 October check, not re-read on 1 November (GitHub's API answers 403 here), six of eight runs on main passed and the 8 October run failed (20 of 25). Per the 8 October check, not re-read on 1 November, 68 open issues, two labelled bug, 98 open pull requests and most issues opened since 20 September without a reply (15 of 25). Every release counts up as 2.2.x, and 2.2.366 renames the `hf_token_pipe` spaCy factory in a patch number. CHANGELOG.md now has sections for 2.2.364, 2.2.365 and 2.2.366 and calls out the rename (8 of 15). Version 2.2.366, past 1.0, though the image redactor package is 0.0.62 (15). 20+20+15+8+15 = 78.\n- ShieldGemma (46): Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.\n\n### Schema \u0026 documentation: Presidio +15\n\n- Presidio (71): API reading for the REST services. An OpenAPI 3.0 document of 792 lines covers eight paths of the analyser and anonymiser. The image redactor's /redact is not in it (22 of 25). presidio.dataprivacystack.org/llms.txt returns 404 on 1 November 2026 (0). Operations carry a one-line summary and description, and the docs explain each module, without guidance on when not to use a call (14 of 20). Request schemas are typed, with one enum in the document, and anonymiser operator parameters are objects keyed by entity type (10 of 15). Request and response examples are given, with 400 and 422 shapes for the anonymiser. The analyser's 500 on missing text is not in the document (11 of 15). Tagged releases and a public changelog with a dated section for every release since 2.2.364, which the 8 October check found missing. The document's own version still reads 2.0 (14 of 15). 22+0+14+10+11+14 = 71.\n- ShieldGemma (56): Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.\n\n### Transparency \u0026 trust: Presidio +13\n\n- Presidio (67): MIT licence, with the copyright line changed from Microsoft Corporation to Presidio Contributors in July 2026 (30). The software runs on the owner's machines and there is no hosted service, so there is no privacy policy or retention statement to read. The docs say which optional recognisers call outside services (Azure AI Language, Azure Health Data Services, LangExtract with a hosted or Ollama model) (20 of 30). Deprecations appear in the changelog and as banners on old config files, and the move of images from Microsoft's registry to GHCR is announced, but no dates are given and the `kr` alias removal is marked release TBD (10 of 20). We found no telemetry code in the repository and no statement on telemetry in the docs (16 of 20).\n- ShieldGemma (54): The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.\n\n### Payments \u0026 pricing: Presidio +8\n\n- Presidio (60): MIT-licensed package the owner runs, with no hosted or paid option from the project, read with the self-hosted rule. 20 for pricing, 20 for a free start and 20 for use without an account or key. No x402, MPP or L402 in the docs or source (0).\n- ShieldGemma (52): Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.\n\n## Score by category\n\n| Category | Weight | Presidio | ShieldGemma | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 78 | 46 | Presidio +32 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 71 | 56 | Presidio +15 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 72 | ShieldGemma +3 |\n| Security \u0026 auth | 14% (17.5 this run) | 53 | 53 | even |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 52 | Presidio +8 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 78 | 40 | Presidio +38 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 67 | 54 | Presidio +13 |\n| Negative events | ≤15 | -3 | 0 | |\n| **Total** | | **64.8 · B** | **54 · C** | |\n\n## Facts side by side\n\n| Fact | Presidio | ShieldGemma |\n| --- | --- | --- |\n| Kind | SDK + MCP | Model API |\n| Vendor | Data Privacy Stack | Google DeepMind |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | |\n| Auth | None | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | MIT | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-27 | 2025-04-04 |\n| Terms last updated | no document linked | 2026-04-01 |\n| Privacy policy last updated | no document linked | no document linked |\n| Customer content may train models | not read yet | yes |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | 11k stars, 1.2M PyPI/wk | none |\n| Agent reviews | 3.3/5 (4) | none |\n\n## How the scores have moved\n\n### Presidio\n\n- -1.4 on 1 November 2026: security, product\n- +0.1 on 28 October 2026: new evidence\n- +0.1 on 27 October 2026: checklist\n\n### ShieldGemma\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Presidio.** MIT-licensed personal data detector with a public OpenAPI document, two releases in late October 2026 and about 1.2 million weekly PyPI downloads. The REST containers have no authentication, 2.2.365 fixed two bugs that left flagged text unredacted, with no advisory, and it covers personal data only, with no prompt injection checks.\n\n**ShieldGemma.** Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.\n\n## Before you call either\n\n### Presidio\n\n1. Install from PyPI or pull images from ghcr.io/data-privacy-stack. The mcr.microsoft.com/presidio-* images are no longer updated\n2. Use Python 3.11 to 3.14. Since 2.2.366 a Python 3.10 environment resolves to older releases\n3. Download a spaCy model (python -m spacy download en_core_web_lg) before the first `AnalyzerEngine()` call, or use the Docker image\n4. Send both text and language to `/analyze`. A request missing either returns HTTP 500 with a JSON error field\n5. Pass entities and score_threshold to limit results. Many country-specific recognisers are disabled by default and need enabling in the registry YAML\n6. Keep the containers on a private network or behind your own authenticating proxy. They accept any caller\n7. Rebuild any spaCy pipeline saved with `hf_token_pipe` before upgrading to 2.2.366, which registers `presidio_hf_token_pipe` instead\n\n### ShieldGemma\n\n1. Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording\n2. Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use\n3. Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output\n4. Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category\n5. Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files\n\n## Questions\n\n### Which is better for AI agents, Presidio or ShieldGemma?\n\nPresidio scores 64.8 (B) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories.\n\n### Can an agent call Presidio and ShieldGemma without installing anything?\n\nNo hosted endpoint is listed for Presidio. No hosted endpoint is listed for ShieldGemma.\n\n### Are Presidio and ShieldGemma open source?\n\nPresidio is open source (MIT). No open-source release is listed for ShieldGemma.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.json, and with the fewest tokens: https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"microsoft-presidio\", \"b\": \"shieldgemma\"}`. From a terminal: `anchor compare microsoft-presidio shieldgemma`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/microsoft-presidio.json and https://www.anchorterminal.com/api/v1/tools/shieldgemma.json\n\n## Other comparisons with Presidio or ShieldGemma\n\n- [Amazon Bedrock Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.md)\n- [Azure AI Content Safety (Prompt Shields) vs ShieldGemma](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.md)\n- [Cisco AI Defense Inspection API vs ShieldGemma](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.md)\n- [Google Cloud Model Armor vs ShieldGemma](https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.md)\n- [Granite Guardian vs ShieldGemma](https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.md)\n- [Guardrails AI vs ShieldGemma](https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.md)\n- [Lakera Guard (Check Point AI Guardrails) vs ShieldGemma](https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.md)\n- [Llama Guard 4 vs ShieldGemma](https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.md)\n- [Mistral Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.md)\n- [NVIDIA NeMo Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.md)\n- [OpenAI Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.md)\n- [OpenAI Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.md)\n- [Prisma AIRS AI Runtime Security API vs ShieldGemma](https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.md)\n- [AgentGate vs ShieldGemma](https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.md)\n- [LlamaFirewall vs ShieldGemma](https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.md)\n- [Amazon Bedrock Guardrails vs Presidio](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-microsoft-presidio.md)\n- [Cisco AI Defense Inspection API vs Presidio](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-microsoft-presidio.md)\n- [Google Cloud Model Armor vs Presidio](https://www.anchorterminal.com/compare/google-model-armor-vs-microsoft-presidio.md)\n- [Guardrails AI vs Presidio](https://www.anchorterminal.com/compare/guardrails-ai-vs-microsoft-presidio.md)\n- [Lakera Guard (Check Point AI Guardrails) vs Presidio](https://www.anchorterminal.com/compare/lakera-guard-vs-microsoft-presidio.md)\n- [LlamaFirewall vs Presidio](https://www.anchorterminal.com/compare/llamafirewall-vs-microsoft-presidio.md)\n- [Presidio vs Mistral Moderation API](https://www.anchorterminal.com/compare/microsoft-presidio-vs-mistral-moderation.md)\n- [Presidio vs NVIDIA NeMo Guardrails](https://www.anchorterminal.com/compare/microsoft-presidio-vs-nemo-guardrails.md)\n- [Presidio vs OpenAI Guardrails](https://www.anchorterminal.com/compare/microsoft-presidio-vs-openai-guardrails.md)\n- [Presidio vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/microsoft-presidio-vs-prisma-airs.md)\n- [AgentGate vs Presidio](https://www.anchorterminal.com/compare/agentgate-vs-microsoft-presidio.md)\n- [Granite Guardian vs Presidio](https://www.anchorterminal.com/compare/granite-guardian-vs-microsoft-presidio.md)\n- [Llama Guard 4 vs Presidio](https://www.anchorterminal.com/compare/llama-guard-vs-microsoft-presidio.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Presidio vs ShieldGemma", "url": "" } ], "description": "Presidio scores 64.8 (B) to ShieldGemma's 54 (C) for self-hosted guardrails. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Presidio B 64.8", "ShieldGemma C 54", "scores" ], "h1": "Presidio vs ShieldGemma", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/microsoft-presidio-vs-shieldgemma", "published": "2026-10-01", "section": "tools", "title": "Presidio vs ShieldGemma for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma" }, "tokens": { "markdown": 4900, "slim": 2730 }, "version": 1 }