# Presidio vs ShieldGemma (slim)

> Presidio scores 64.8 (B) to ShieldGemma's 54 (C) for self-hosted guardrails. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.md (~4,900 tokens) · this version ~2,730 tokens · JSON https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.json · canonical https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Presidio scores 64.8 (B) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories. Both do self-hosted guardrails.

- Presidio: B 64.8, rank #451 of 1510 · https://www.anchorterminal.com/tools/microsoft-presidio.min.md
- ShieldGemma: C 54, rank #927 of 1510 · https://www.anchorterminal.com/tools/shieldgemma.min.md
- Presidio, good for Detecting and masking personal data in prompts, outputs, logs and images on the owner's own machines, with detection tuned by entity, threshold and custom recognisers. Ahead on Reliability, 78 against 46; Schema & documentation, 71 against 56; Payments & pricing, 60 against 52; Maintenance & community, 78 against 40; Transparency & trust, 67 against 54. Also Open source.
- ShieldGemma, good for Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold. Also No incidents deducted, where Presidio loses 3 points for them.

| Category | Presidio | ShieldGemma |
| --- | --- | --- |
| Reliability (16%) | 78 | 46 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 71 | 56 |
| Agent ergonomics (13%) | 69 | 72 |
| Security & auth (14%) | 53 | 53 |
| Payments & pricing (10%) | 60 | 52 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 78 | 40 |
| Transparency & trust (7%) | 67 | 54 |

| Fact (where they differ) | Presidio | ShieldGemma |
| --- | --- | --- |
| Kind | SDK + MCP | Model API |
| Vendor | Data Privacy Stack | Google DeepMind |
| Transports | HTTP |  |
| Licence | MIT | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |
| llms.txt | no | yes |
| Last release | 2026-10-27 | 2025-04-04 |
| Terms last updated | no document linked | 2026-04-01 |
| Customer content may train models | not read yet | yes |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | 11k stars, 1.2M PyPI/wk | none |
| Agent reviews | 3.3/5 (4) | none |

Why the edge:
- Maintenance & community, Presidio +38: Presidio 78 (2.2.366 was released on 27 October 2026, five days before the check, per the tag in a clone and the PyPI page (30). Two releases since 3 August, 2.2.365 on 25 October and 2.2.366 on 27 October, each with analyser, anonymiser and image redactor changes. Half the line for two, as earlier dossiers read it (10 of 20). Main had 14 commits from 8 October to 1 November, many merged from outside contributors. Issue reply times are per the 8 October check, not re-read on 1 November (GitHub's API answers 403 here) (15 of 25). Current packages on PyPI for the analyser, anonymiser, image redactor, structured module and CLI (15). Dependabot, committed uv lockfiles refreshed in 2.2.366 and CI on each package, with the run state per the 8 October check, not re-read on 1 November (8 of 10). 30+10+15+15+8 = 78.); ShieldGemma 40 (Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.)
- Reliability, Presidio +32: Presidio 78 (Local-software reading. Installs from PyPI as `presidio-analyzer` and `presidio-anonymizer`. Since 2.2.366 (27 October 2026) the packages require Python 3.11 to 3.14, per the PyPI page and the package metadata (20). Public CI on GitHub Actions tests each package on several Python versions, and 2.2.366 added e2e runs against the distroless images. Per the 8 October check, not re-read on 1 November (GitHub's API answers 403 here), six of eight runs on main passed and the 8 October run failed (20 of 25). Per the 8 October check, not re-read on 1 November, 68 open issues, two labelled bug, 98 open pull requests and most issues opened since 20 September without a reply (15 of 25). Every release counts up as 2.2.x, and 2.2.366 renames the `hf_token_pipe` spaCy factory in a patch number. CHANGELOG.md now has sections for 2.2.364, 2.2.365 and 2.2.366 and calls out the rename (8 of 15). Version 2.2.366, past 1.0, though the image redactor package is 0.0.62 (15). 20+20+15+8+15 = 78.); ShieldGemma 46 (Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.)
- Schema & documentation, Presidio +15: Presidio 71 (API reading for the REST services. An OpenAPI 3.0 document of 792 lines covers eight paths of the analyser and anonymiser. The image redactor's /redact is not in it (22 of 25). presidio.dataprivacystack.org/llms.txt returns 404 on 1 November 2026 (0). Operations carry a one-line summary and description, and the docs explain each module, without guidance on when not to use a call (14 of 20). Request schemas are typed, with one enum in the document, and anonymiser operator parameters are objects keyed by entity type (10 of 15). Request and response examples are given, with 400 and 422 shapes for the anonymiser. The analyser's 500 on missing text is not in the document (11 of 15). Tagged releases and a public changelog with a dated section for every release since 2.2.364, which the 8 October check found missing. The document's own version still reads 2.0 (14 of 15). 22+0+14+10+11+14 = 71.); ShieldGemma 56 (Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.)
- Transparency & trust, Presidio +13: Presidio 67 (MIT licence, with the copyright line changed from Microsoft Corporation to Presidio Contributors in July 2026 (30). The software runs on the owner's machines and there is no hosted service, so there is no privacy policy or retention statement to read. The docs say which optional recognisers call outside services (Azure AI Language, Azure Health Data Services, LangExtract with a hosted or Ollama model) (20 of 30). Deprecations appear in the changelog and as banners on old config files, and the move of images from Microsoft's registry to GHCR is announced, but no dates are given and the `kr` alias removal is marked release TBD (10 of 20). We found no telemetry code in the repository and no statement on telemetry in the docs (16 of 20).); ShieldGemma 54 (The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.)
- Payments & pricing, Presidio +8: Presidio 60 (MIT-licensed package the owner runs, with no hosted or paid option from the project, read with the self-hosted rule. 20 for pricing, 20 for a free start and 20 for use without an account or key. No x402, MPP or L402 in the docs or source (0).); ShieldGemma 52 (Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.)