// For Stafrænt Ísland vendors
Use AI on government work without sending direct identifiers out.
Stafrænt Ísland rules restrict kennitölur, secrets, logs and confidential material in open AI tools. dmz is being built to mask selected identifiers and supply useful audit metadata.
Rule → control map
Mapping in progress
Requirement areadmz controlCoverage
Kennitölur and other direct identifiersThe Shield prototype masks selected identifiers on device. Gateway is a planned path for developer tools.Partial
Secrets and logsThe prototype blocks selected secrets. General log detection remains planned.Partial
Confidential material and case recordsTenant dictionaries and an upload policy are planned; context still needs human review.Process
Purpose, benefit and quality reviewMetadata export and a manual evidence process will be designed with initial customers.Planned
This is not a compliance certificate. Metadata alone cannot prove that all rules are followed.
Gateway · planned
One base URL in your developer tool.
Planned OpenAI- and Anthropic-compatible API for OpenCode, Cline, Continue and scripts. No subscription-token pass-through.
# example planned configuration OPENAI_BASE_URL=https://api.dmz.is/v1
Audit · example format
Metadata. Never bodies.
A planned event records who, when, which entity types and route. The schema will be validated with customers.
{
"event": "prompt.redacted",
"user": "u_synthetic",
"surface": "gateway",
"entities": { "kennitala": 1 },
"body_stored": false
}