self-hosted · agent-first · GDPR-by-design
blurd is a single-binary redaction service. POST an image, get back a job id, poll or fetch by code. The original is decoded, detected, redacted and discarded — never written to disk. Only the redacted output, a SHA-256 and metadata persist.
Source bytes are dropped right after decode. Queues are in-memory and byte-bounded — no spool files, ever. If it's not redacted, it's not on disk.
Low-confidence results are flagged needs_review. The dashboard's editor lets an operator draw extra black boxes on top — additive masks only, never reveal.
JSON envelope everywhere, typed errors with exit codes, --help-json for discovery, scoped keys as tenants, portable key export between instances.
SQLite, Postgres or MongoDB metadata. Local FS or S3 blobs. Compose profiles, a Helm chart that refuses unsafe configs, multi-replica job leases. ~750 MB RSS.
Per-request TTL on blobs, a hard storage.max_bytes cap with expired-first reclaim, per-IP rate limits, 30-day audit retention. Safe to demo on a 4 GB box.
130 ms median detect+redact on 2 cores. 160+ black-box conformance checks run identically against all three metadata backends.
$ blurd init && blurd models pull && blurd serve
$ curl -X POST http://127.0.0.1:8770/v1/images \
-H "X-Api-Key: blk_..." --data-binary @photo.jpg
{"ok":true,"data":{"job_id":"j_01J..."}} # 202 — async
$ curl "http://127.0.0.1:8770/v1/blobs/by-code/order-4421" \
-H "X-Api-Key: blk_..." -o redacted.jpg
The full pipeline: detection, redaction, dashboard, three metadata backends, Helm chart.
Everything in OSS, plus the company-facing layer, delivered as a licensed tarball.
Download link emailed instantly after payment, valid 24 h.