The model reads the note. It never reads the name.

Your clinical-summary product calls a frontier model. Safe Harbor says eighteen classes of identifier don't leave the box. The app's base URL is the only thing that changes.

It points at hoody-exec instead of the gateway. A worker script reads each request, swaps names, dates, MRNs, and phone numbers for tokens: [PT_7], [DOB_7]: and keeps the mapping in hoody-sqlite on the same server. The tokenized prompt goes to the Hoody AI Gateway under the container's own identity, 5% over provider cost, drawn from AI Balance. The response comes back through the same worker; tokens become names again before the app sees a byte.

The provider received a document about [PT_7]. The table that knows who [PT_7] is has one address, and it's in your rack.

The model reads the note. It never reads the name.