Six ways in. One policy behind all of them.

1. Your application — two lines

Provider-agnostic. Works with OpenAI, Anthropic, Gemini or anything else, because you keep making the model call yourself.

npm install @sdlc-cc/privacy-client

import { SdlcClient } from "@sdlc-cc/privacy-client";

const privacy = new SdlcClient({
  endpoint: "https://api.sdlc.cc",
  apiKey: process.env.SDLC_API_KEY,   // sk_sdlc_*
});

const { cleanText, redactions } = await privacy.scrubText(userText);
// send cleanText to your model; log redactions (counts only)

Python, Go and plain HTTP need no SDK — it is one POST:

curl -sS https://api.sdlc.cc/v1/dlp/scrub \
  -H "Authorization: Bearer $SDLC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text":"wire to IBAN GB33BUKB20201555555555 for alice@example.com"}'

Runnable Express, Python and Go quickstarts live in examples/ in the repository, each with a test that runs against a stub gateway.

2. Employees in the browser — nothing for them to configure

Force-install through Chrome or Edge policy and supply the endpoint and key by managed configuration. The employee never types a setting, and the protection state is visible on the page.

# Operator issues the cohort key and managed config in one step
sdlcctl pilot activate \
  --api https://api.sdlc.cc \
  --organization acme --organization-name "Acme" --cohort pilot \
  --admin-bearer-file /secure/admin-bearer \
  --client-key-file /secure/cohort.key \
  --managed-config-file /secure/managed.json \
  --evidence-file /secure/activation.json \
  --rollback-file /secure/rollback.json

3. Claude Code / Anthropic SDKs — Windows, macOS, Linux

Full story on the Claude Code gateway product page. Download the native installer from /downloads/ (Windows .exe, macOS .app zip) so Claude Code calls the sdlc gateway (https://api.sdlc.cc), not api.anthropic.com. Users should not edit environment variables by hand. The key needs the messages scope (still issued after activation).

# Public downloads (also rebuilt with):
#   bash scripts/publish-claude-code-gateway-downloads.sh
# → landing/downloads/claude-code/*.exe / *.app.zip

# Windows — double-click the .exe
SdlcClaudeCodeGatewaySetup-windows-amd64.exe

# Windows silent / Intune
SdlcClaudeCodeGatewaySetup-windows-amd64.exe -silent `
  -api-key sk_sdlc_... -gateway https://api.sdlc.cc

# macOS — unzip and open the .app
open "sdlc-Claude-Code-Gateway-macos-arm64.app"

After install, fully quit and reopen Claude Code, then run the installer with -verify. Claude Desktop GUI may ignore the env — use Desktop Guard there. Signed MSI / notarized DMG remain Planned.

4. Codex / OpenAI-shaped clients (Preview)

Full story on the Codex gateway product page. Download the installer from /downloads/ so Codex sets openai_base_url=https://api.sdlc.cc/v1. Exact POST /v1/responses and /v1/chat/completions scrub-forward when the gateway host has OPENAI_API_KEY. Legacy /v1/completions and query-string variants still return UNSUPPORTED_MODEL_WRITE. Durable enforcement parity with Claude Code remains Planned.

# After installer (or manually in ~/.codex/config.toml)
openai_base_url = "https://api.sdlc.cc/v1"
# OPENAI_API_KEY=sk_sdlc_...  (messages scope)

# Alternate Preview paths
Application → sdlc-cc-cf-gw → /v1/dlp/scrub → AI Gateway → provider
# or explicit POST /v1/dlp/scrub then call OpenAI yourself

5. Your own environment

Same engine, same API, under your control. Docker Compose for a pilot, Helm for production, with an immutable image digest.

./deploy/private-appliance/install.sh --env-file /secure/appliance.env

6. Agents and MCP hosts

A stdio MCP server exposing exactly one tool, scrub_text. It governs what an agent explicitly passes to the tool. It does not intercept the host application's ordinary chat, and we do not describe it as if it does.