RedactGate

Problem: accountants, tax firms and immigration consultants paste client data (SINs, SSNs, business numbers, emails) into cloud LLMs. RedactGate is a self-hosted OpenAI-compatible gateway that detects those identifiers, swaps them for reversible encrypted tokens before the request leaves the firm, and re-inflates the answer. Every request is logged in an HMAC hash chain with entity type counts only. The weak spot: whoever holds the audit HMAC key (an admin, an insider) can edit an old event and recompute every hash, and the local verifier still says the chain is valid.

What we built for NEAR HACKATHON: an audit anchor. A small near-sdk 5 contract (anchor.redactgate.testnet) stores append-only anchors (stream, event count, chain head) with a writer allow-list and NEP-297 event logs. The RedactGate worker writes each team's chain head to it every N minutes, signing with a NEAR function-call key that can only call anchor() and cannot move funds. An auditor exports the chain and compares it with get_latest(): any rewrite of anchored history fails with head_mismatch, even when the forger used the real HMAC key. Only an opaque stream tag (HMAC of the team id), the event count and the 64-hex head go on chain; prompts, values and team names stay inside the perimeter.

How NEAR fits: cheap, fast finality and named accounts with scoped access keys make it practical to notarize every few minutes per tenant; anyone can verify with a free view call.

Try it: README → docs/NEAR.md. pytest -q tests/test_near_anchor.py, make near-setup (free testnet account via faucet, deploy, anchor-only key), make near-demo (redact 3 prompts, anchor on NEAR, catch an insider rewrite). 14 Python + 5 contract tests. RedactGate core existed before the hackathon (tag pre-hackathon); the anchor is new on branch near-hackathon. Code written with Claude Code.