Known limitations

These limits apply across CloakAPI clients and the gateway. They are stated in plain language so you can plan reviews and integrations.

If a detector flags something CloakAPI cannot tokenise, the request is still sent with a non-blocking warning; the flagged value may reach the model provider as written.
Files that cannot be read on your device (for example scanned images without text, or corrupted files) cannot be inspected; CloakAPI sends them as you attached them, with a visible notice.
Non-Latin scripts that the on-device engine does not cover (for example Thai and Khmer) are sent after a warning rather than blocked; names in those scripts may not be replaced.
The gateway checks only the shape, size, authorisation, balance and quota of a request, and removes a small fixed set of request metadata fields (such as a user ID or e-mail address) before forwarding. It does not read or change the message text.

See also How privacy works for the client-side tokenisation model.