Ollama integration
Mask personal data before it reaches your Ollama models
- Every text field in the request body: user and system messages, tool and function-call arguments, and tool results, on Ollama's OpenAI-compatible endpoints
- Streaming responses
- Embeddings: the OpenAI-compatible /embeddings route and Ollama's native /api/embed and /api/embeddings, masked deterministically
- Base64, hex, and percent-encoded text inside the request is decoded and checked too
Running a model yourself with Ollama keeps prompts off third-party APIs, but it doesn't make them safe. The same applications feed the same customer records and credentials into the prompt, and a local model may sit behind shared tools, logs and vector stores.
Maskflare applies the same rules on the Ollama route as on every hosted provider. Change the client's base URL to your gateway's /v1/ollama route, authenticate with a Maskflare key, and requests are masked before they reach the Ollama server.
Set up Ollama with Maskflare
Requests go to /v1/ollama on your Maskflare gateway instead of the provider.
from openai import OpenAI
client = OpenAI(
base_url="https://YOUR_GATEWAY_HOST/v1/ollama",
api_key="mf_live_...", # a Maskflare key; Ollama itself needs no key
)
reply = client.chat.completions.create(
model="llama3.2",
messages=[{"role": "user", "content": "Summarize the call with maria.rossi@example.it"}],
)What gets masked
- Every text field in the request body: user and system messages, tool and function-call arguments, and tool results, on Ollama's OpenAI-compatible endpoints
- Streaming responses
- Embeddings: the OpenAI-compatible /embeddings route and Ollama's native /api/embed and /api/embeddings, masked deterministically
- Base64, hex, and percent-encoded text inside the request is decoded and checked too
Good to know
- The gateway must be able to reach your Ollama server over the network. The address is part of the gateway's configuration (its Ollama base URL, which defaults to http://localhost:11434/v1), not a console setting. In the console, the Ollama drawer says it uses the gateway's configured local endpoint.
- To connect it, open Connections, then AI providers, and choose Ollama. No provider key is needed or accepted. Add the models you allow under Allowed models.
- Ollama is connected in pass-through mode, and the forward proxy does not cover it, because the proxy inspects the hosted provider hosts only. Use the gateway route.
- A rule set to block stops the request before it reaches the provider and returns HTTP 403 with the matching rule keys, never the values.
Frequently asked questions
Do I need an API key for Ollama?
Not for Ollama. Your application uses a Maskflare key, and the gateway forwards to Ollama without a provider key.
Where do I set the address of my Ollama server?
In the gateway's configuration, not in the console. The gateway needs network access to that address. If you use a hosted Maskflare gateway, ask us first how it can reach your server.
Does the forward proxy cover Ollama?
No. The forward proxy covers the hosted provider hosts. Ollama is covered through the gateway route.
Are embeddings masked?
Yes. Embeddings inputs are masked deterministically, so the same value always becomes the same token, on both the OpenAI-compatible and the native Ollama embeddings routes.
Other ai providers integrations
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →