# Support Privacy Firewall

*/Opportunities/Support_Privacy_Firewall*

## Opportunity Overview

**Wedge**: Target mid-market digital health and fintech startups using Zendesk or Intercom. These companies possess strict HIPAA or PCI requirements and want to deploy LLMs for ticket triage but are blocked by internal infosec teams. Expand by moving from a redaction API to providing full compliance audit trails for all AI interactions, eventually covering internal HR and IT ticketing.
**Timing**: The rapid adoption of AI customer support tools creates a new surface area for PII leaks into third-party LLM providers. Fast local models now execute with low enough latency to perform real-time contextual redaction during live chat sessions without delaying the response.
**Why This I C P**: Fintech and digital health companies experience immense pressure to automate large ticket volumes while facing strict regulatory penalties for data leaks. This dual pressure makes them immediate buyers who cannot wait for legacy security vendors to update their regex rules.
**Size Of Prize**: Approximately 50,000 mid-market and enterprise B2C companies process high volumes of sensitive support tickets. Multiplying these 50,000 entities by an average $10,000 annual software spend for data security middleware yields a $500M total addressable market.
**Gap Narrative**: Companies want to route and auto-resolve customer support tickets using LLMs, but these tickets routinely contain unstructured PII and PHI. Legacy Data Loss Prevention tools rely on rigid regex rules that fail to catch contextual sensitive data in conversational text, blocking infosec approval for AI customer service agents.
**Defensibility**: Defensibility builds through workflow lock-in and high switching costs. Once the system integrates into the support pipeline and tokenizes historical customer databases, replacing the firewall requires re-indexing years of data and rebuilding the token vault, making churn mathematically and operationally prohibitive.
**Why This Thesis**: An API middleware approach fits the problem structure perfectly. It sits invisibly between the ticket ingestion point and the downstream AI processing agent, intercepting and tokenizing sensitive entities without disrupting the existing support platform or the user experience.

## Opportunity Linked Thesis

**Thesis**: [Software](/Theses/Software)

## Opportunity Linked I C P

**Icp**: [Customer Support BPO](/CompanyTypes/Customer_Support_BPO)

## Opportunity Market Sizing

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**S A M**: ~$300-500M (mid-to-large BPOs managing high-compliance fintech, healthcare, and enterprise e-commerce accounts)
**S O M**: ~$10-25M
**T A M**: ~15,000 global customer support BPOs × ~$80,000/yr average spend on agent data security controls ≈ $1.2B
**Growth Rate**: ~15-20%/yr, driven by stricter enterprise vendor risk mandates and expanding global data privacy regulations
**Paid Comparable Spend**: ~$400-600 per agent annually on Virtual Desktop Infrastructure (VDI) licenses, clean-room physical security enforcement, and manual compliance QA teams

## Opportunity Incumbents

- [Very Good Security](/Products/Very_Good_Security) — Tool
- [Skyflow Data Vault](/Products/Skyflow_Data_Vault) — Tool
- [Microsoft Presidio](/Products/Microsoft_Presidio) — Open-Source
- [Custom Middleware Proxies](/Products/Custom_Middleware_Proxies) — DIY
- [Zendesk Data Privacy](/Products/Zendesk_Data_Privacy) — Tool
- [Evervault Enclaves](/Products/Evervault_Enclaves) — Tool
- [In-House Regex Scripts](/Products/In-House_Regex_Scripts) — DIY

## Opportunity Win Conditions

**Kill Thresholds**:
- API payload latency exceeds 150ms during peak load
- Manual unmasking requests exceed 8% of total ticket volume
- Client onboarding requires more than 10 days of custom engineering
- Zero enterprise InfoSec compliance approvals within the first 90 days
**Leading Metrics**:
- Latency added per API payload
- False-positive data redaction rate
- Percentage of tickets resolved with zero raw data exposure
- Time-to-deploy per enterprise client account
- Agent manual unmasking request rate
**What Proves Right**: BPOs route live customer support traffic through the firewall, dynamically masking PII and PCI data before it reaches the agent UI. Agents maintain their average handle time because they no longer navigate heavy Virtual Desktop Infrastructure (VDI) environments to resolve tickets. Enterprise clients accept the firewall's cryptographic audit logs as proof of compliance, enabling BPOs to bypass physical clean room requirements.
**What Proves Wrong**: Agents frequently trigger manual unmasking requests because the redaction engine over-masks the critical context needed to resolve tickets. Deployment mandates custom middleware engineering for each new enterprise client, eliminating the onboarding margin. Enterprise InfoSec teams reject the proxy architecture entirely and mandate legacy VDI setups.

## Opportunity Build Profile

**Hardest Part**: Guaranteeing near-100% recall on sensitive data redaction across highly unstructured, typo-ridden user chat logs without falsely masking the technical identifiers agents need to resolve the underlying issue.
**Min Viable Scope**: Deliver a real-time text redaction proxy exclusively for Zendesk webhook traffic in English. Deliberately exclude OCR for screenshots, audio redaction, multi-language support, and bi-directional unmasking.
**Cold Start Problem**: Training robust detection models requires massive datasets of actual customer support logs containing real PII, which companies refuse to share with unproven vendors. Break this by licensing generic customer service corpuses, injecting synthetic PII via LLMs, and offering a local-only container deployment for early design partners.
**Time To First Value**: 1 to 2 days of integration, gated by routing Zendesk or Intercom webhook traffic through the redaction proxy.
**Data Moat Available**: true
**Technical Difficulty**: High

## Neighborhood

### Where the gap lives

- [Manage Customer Service](/Processes/Manage_Customer_Service) — latent gap · Processes
- [Customer and Personal Service](/Knowledge/Customer_and_Personal_Service) — latent gap · Knowledge

### Incumbent in

- [Zendesk Data Privacy](/Products/Zendesk_Data_Privacy) — incumbent in · Products
- [Skyflow Data Vault](/Products/Skyflow_Data_Vault) — incumbent in · Products
- [Very Good Security](/Products/Very_Good_Security) — incumbent in · Products
- [Custom Middleware Proxies](/Products/Custom_Middleware_Proxies) — incumbent in · Products
- [Evervault Enclaves](/Products/Evervault_Enclaves) — incumbent in · Products
- [In-House Regex Scripts](/Products/In-House_Regex_Scripts) — incumbent in · Products
- [Microsoft Presidio](/Products/Microsoft_Presidio) — incumbent in · Products

### Applies thesis

- [Customer Support BPO](/CompanyTypes/Customer_Support_BPO) — applies thesis · CompanyTypes

### Embodies

- [Software](/Theses/Software) — embodies · Theses

### Similar Opportunities

- [Contextual PII Firewall](/Opportunities/Contextual_PII_Firewall) — similar · Opportunities
- [AI API Scrubbing for Cloud](/Opportunities/AI_API_Scrubbing_for_Cloud) — similar · Opportunities
- [Document Sanitization Layer](/api/md.md/Opportunities/Document_Sanitization_Layer) — similar · Opportunities
- [PII Redaction Pipeline](/Opportunities/PII_Redaction_Pipeline) — similar · Opportunities
- [Document Sanitization Layer](/Opportunities/Document_Sanitization_Layer) — similar · Opportunities
- [PHI Redaction API](/Opportunities/PHI_Redaction_API) — similar · Opportunities
- [Continuous HIPAA Remediation](/api/md.md.md/Opportunities/Continuous_HIPAA_Remediation) — similar · Opportunities
- [Escalation Routing API](/Opportunities/Escalation_Routing_API) — similar · Opportunities
- [Support Context API](/Skills/Reading_Comprehension/Opportunities/Support_Context_API) — similar · Opportunities
- [Code Compliance Triage](/Opportunities/Code_Compliance_Triage) — similar · Opportunities
- [PHI Telemetry Auditor](/Opportunities/PHI_Telemetry_Auditor) — similar · Opportunities
- [Continuous Compliance Automation](/Opportunities/Continuous_Compliance_Automation) — similar · Opportunities
- [Copyright Egress Gateway](/Opportunities/Copyright_Egress_Gateway) — similar · Opportunities
- [AI Public Records Redaction](/Opportunities/AI_Public_Records_Redaction) — similar · Opportunities
- [Managed Log Compliance](/Opportunities/Managed_Log_Compliance) — similar · Opportunities
- [Request Routing Fabric](/Opportunities/Request_Routing_Fabric) — similar · Opportunities
- [Automated Compliance Reporting Generation](/Opportunities/Automated_Compliance_Reporting_Generation) — similar · Opportunities
- [Compliance Audit Service](/Opportunities/Compliance_Audit_Service) — similar · Opportunities
- [Automated Ticket Triage](/Opportunities/Automated_Ticket_Triage) — similar · Opportunities
- [Cross-System Audit Mapping for Compliance Teams](/Opportunities/Cross-System_Audit_Mapping_for_Compliance_Teams) — similar · Opportunities