PII detection and masking for LLMs

Most production prompts contain something you would rather not send to a third-party LLM: a customer email, an internal ticket id, a name, an IP address, an API key copied into a debugging prompt. Once that text leaves your network, you lose control of it. PII masking shrinks that exposure surface before the provider call ever happens.

1. Step 1

   Detect

   The inbound prompt is scanned for the supported entity set on every request.

2. Step 2

   Map

   Each detected value is mapped to a deterministic placeholder for that request, e.g. PERSON_1, EMAIL_2.

3. Step 3

   Forward

   Only the masked prompt is forwarded to the provider using your BYOK credentials.

4. Step 4

   Receive

   The provider response may reference the same placeholders.

5. Step 5

   Rehydrate

   The gateway restores the original values from the in-memory mapping.

6. Step 6

   Discard

   The mapping is dropped after the response is returned. Nothing is persisted.

Most AI features send more sensitive data to providers than teams expect, because the data arrives inside otherwise ordinary text. These are the request paths where it usually happens:

• Chat and assistant interfaces

  Users paste emails, account numbers, contracts and screenshots of records into free-text fields.

• RAG pipelines

  Retrieved chunks carry identifiers from source documents into the prompt, even when the user's question contains none.

• Support and ticket summarization

  Transcripts contain names, addresses, phone numbers and payment references by construction.

• Internal tools and copilots

  Debugging prompts routinely include API keys, tokens, connection strings and production identifiers.

Application-level filtering has to be re-implemented for every one of these paths and drifts as features change. Detection at the gateway applies the same controls to all of them, including the ones added after the original review — see the per-hop data path for exactly where it runs.

The current beta detects the following entity types. The catalog is evolving — additional locales and identifiers are tracked as future work.

Not yet supported: Norwegian fødselsnummer (tracked as future work).

• Placeholders follow a stable {TYPE}_{N} shape
• Detection runs per-request; no cross-request state
• Mapping is held in memory only, then discarded
• Unknown placeholders in responses pass through untouched

• Norwegian fødselsnummer not yet supported
• No claim of regulated-data compliance (HIPAA / SOC 2 / PCI)
• Detection is best-effort; review for your own data types
• Placeholders are not stable across separate requests

• Stop customer data leaving your stack

  Mask names, emails and phone numbers before they hit OpenAI or Anthropic.

• Protect support transcripts

  Run AI summarization over tickets without forwarding raw PII.

• Safe developer experimentation

  Iterate on prompts without re-running data-protection reviews.

• Keep secrets out of prompts

  Catch API keys and tokens accidentally pasted into prompts.

What is PII masking?

PII masking is the practice of detecting personal or sensitive identifiers in text and replacing them with placeholders before sending the text to a third-party system. In Privian's case, masking runs at the gateway before any provider call and is reversed on the way back via rehydration.

Does the model ever see the original values?

No. Only the masked prompt — with placeholders like PERSON_1, EMAIL_2 — is forwarded to the provider.

What sensitive data types are supported in the beta?

Common personal identifiers (names, emails, phone numbers, IP addresses), financial identifiers (credit card numbers, IBANs), national IDs (US SSN, Canadian SIN), and developer secrets (JWTs, OpenAI keys, GitHub tokens, AWS keys, generic API keys, env-style secrets). See the supported entities section for the full current list.

Are placeholders stable across requests?

No. Placeholders are stable within a single request only. The mapping is held in memory for the duration of the request and discarded after the response is rehydrated.

Does Privian store raw prompts?

No. Raw prompts and responses are never persisted. Only structural counters are kept for observability.

How do you prevent PII from reaching OpenAI?

Route requests through a gateway that inspects content before the outbound call. Privian detects supported entities in the prompt, replaces them with placeholders, and forwards only the masked text to OpenAI using your own credentials. The response is rehydrated inside the gateway.

Can you use ChatGPT or the OpenAI API with customer data?

It depends on your legal basis, your provider agreement and what the data is. A common risk-reduction pattern is to avoid sending raw identifiers at all: mask names, emails, phone numbers and account identifiers before the provider call so the model receives the structure of the request without the identifying values. That is a control, not a compliance certification.

What is the difference between PII masking, redaction, anonymization and tokenization?

Redaction removes data irreversibly. Anonymization transforms data so individuals cannot be re-identified. Tokenization substitutes values with tokens resolvable from a stored vault. Privian's masking is reversible within a single request only — the mapping lives in memory, restores the response, and is then discarded, so there is no persistent token vault.

Does PII masking add latency?

Detection and mapping run in-process before the provider call, so overhead is small relative to model inference time. The dominant cost of an LLM request remains the provider round-trip. Measure with your own prompt sizes and traffic.

Is masking enough for GDPR or HIPAA?

No single control makes a system compliant. Masking reduces what leaves your boundary, which is often a meaningful part of a data-protection argument, but obligations also cover legal basis, contracts, retention, access control and incident response. Privian makes no HIPAA, SOC 2 or PCI claims at this time.

Is Norwegian fødselsnummer supported?

Not yet. Norwegian national ID detection is tracked as future work for the beta and is not currently part of the supported entity set.

• Category: Prompt Privacy
• Concepts: PII Masking
• Concepts: Rehydration
• Glossary: What is PII masking?
• Product: Rehydration
• Product: LLM Gateway
• Guide: Add PII masking to OpenAI
• API reference
• Category: AI Security Layer
• Reference: Data path
• Trust Center
• Privian Blueprint (evaluation package)
• Pricing and packaging
• Enterprise AI procurement framework
• AI vendor due diligence checklist
• Solution: OpenAI data privacy
• Solution: Claude data privacy
• Solution: HIPAA-ready AI architecture
• Solution: RAG privacy