Shim Wiki

Short for personally identifiable information. Anything that points to one real person, alone or together with other details. A national ID does it on its own. A postcode plus a birth date often does too.

In Shim · Shim spots emails, phone numbers, card numbers, IBANs, Turkish IDs, tax numbers and secrets.

See also TCKN, Tokenization

The 11-digit Turkish national ID number. It names a person outright and shows up everywhere in banking and support text. Its built-in checksum makes it easy to catch reliably.

In Shim · Detected by format and checksum, so a mistyped number is not flagged.

See also PII, VKN

The 10-digit Turkish tax number, given to companies and to people with tax obligations. It often travels next to personal details in customer records.

In Shim · Detected as its own type, separate from TCKN.

See also TCKN, PII

Swapping a sensitive value for a stand-in that means nothing on its own. The model sees a placeholder where an email address used to be, and can still write a sensible answer around it.

In Shim · Every detected value becomes a placeholder before the request leaves.

See also Reversible redaction, PII

Hiding a value on the way out and putting it back on the way in. The model never sees the real data, and your team still gets an answer with the real details filled in.

In Shim · The mapping lives only for that one request. The provider sees placeholders, your app gets the real values back.

See also Tokenization, Pseudonymization vs anonymization

Pseudonymized data can be traced back by whoever holds the key. Anonymized data cannot be traced back by anyone. Under KVKK and GDPR only the second one leaves the scope of the law.

In Shim · Shim pseudonymizes, because it has to restore values in the reply. We say so plainly.

See also Reversible redaction

A rule that data must be stored, and often processed, inside a certain country. It is about geography. It is not the same as sovereignty, which is about whose laws can reach the data.

See also Cross-border data transfer, On-prem

Sending personal data out of the country whose rules cover it. Pasting customer data into a model hosted abroad counts, even if nobody meant it as a transfer.

In Shim · Masking before the provider call changes what actually leaves. Whether your flow still counts as a transfer is a question for your lawyer.

See also Data residency, Adequacy decision

An official finding that another country protects personal data well enough, so data can flow there without extra paperwork. Few countries have one, so most transfers rely on contracts instead.

See also Standard contractual clauses, Cross-border data transfer

Ready-made contract text that adds the protections an adequacy decision would give. Helpful on paper, but signing it does not change where the data goes or who can read it.

See also Adequacy decision

An EU AI Act label for systems that can seriously affect people, like credit scoring or hiring. It comes with heavier duties: risk management, logging and human oversight.

See also Human oversight, Audit trail

Under the EU Digital Operational Resilience Act, a tech supplier so important that its failure could shake the banks relying on it. Those suppliers get direct oversight, and banks get stricter vendor checks.

See also Audit trail

One checkpoint between your apps and model providers like OpenAI, Anthropic and Gemini. It is where you apply keys, limits, privacy rules and logging once, instead of in every app.

In Shim · Shim is an AI gateway that keeps requests provider-native, so you only change the base URL.

See also BYOK, On-prem

Running software on your own servers instead of a vendor cloud. Teams choose it when prompts, keys and records are not allowed to leave the building.

In Shim · Shim Enterprise runs on your own servers, and its license is checked offline.

See also Data residency, AI gateway

Short for bring your own key. You use your own provider account through a tool, so the billing, limits and relationship with the provider stay yours.

In Shim · Provider keys are stored encrypted, or kept in your AWS, GCP or Azure secret manager.

See also AI gateway

Text that a model mistakes for an instruction. It can come from a user, or hide inside something the model reads, like a web page or a file. The hidden kind is the tricky one.

In Shim · Shim CLI flags text in files that tries to give your coding agent orders. It reports it and leaves the content unchanged.

See also AI gateway

A record good enough for someone who was not there to see what happened. What makes it an audit trail and not just a log is that quiet edits get noticed.

In Shim · Every request writes a row with data types and counts, never the values themselves.

See also Hash chain, Human oversight

A list of records where each one carries a fingerprint of the one before. Change an old record and every fingerprint after it breaks. Tampering becomes something you can check, not just trust.

In Shim · Audit rows are chained per organization and anchored daily. You can verify the chain from the console.

See also Audit trail

Making sure a person can understand, question and overrule what an automated system did. Naming someone responsible is not enough. There has to be a real review and a record of it.

In Shim · Flag requests by model, data type or severity for a person to review. Their decision goes into the audit trail.

See also High-risk AI system, Audit trail