What is prompt security?

The problem

LLM-backed features make it easy to forward more data to a third-party model than anyone intended. A support agent pastes a ticket. A copilot wraps a customer record. A prototype reads a row out of production. In each case, the prompt that leaves your system is often richer in personal data than any single log line, and it goes to an external provider you do not control.

Prompt security is the practice of treating the prompt itself as a security boundary — the same way you treat a database query, an outbound API call, or an event published to a queue.

Definition

Prompt security is a set of controls applied to a prompt before it leaves your infrastructure for a model provider. Those controls typically include:

• Detecting and masking personal data (names, emails, phone numbers, account identifiers)
• Stripping or substituting secrets (API keys, tokens, credentials)
• Enforcing input size and shape (rejecting oversize or malformed payloads)
• Routing to an approved provider and model
• Producing an auditable record of what left the system

Prompt security is concerned with what your application sends. Prompt-injection defense is concerned with what untrusted users try to smuggle in. They are complementary, not interchangeable. See Prompt security vs. prompt injection for a side-by-side comparison.

How it works in practice

A typical prompt-security flow sits between your application and the LLM provider — usually as a gateway:

Your app
   │  prompt with raw customer data
   ▼
Prompt-security layer
   │  detect → mask → validate → route
   ▼
Model provider
   │  response references masked tokens
   ▼
Prompt-security layer
   │  rehydrate tokens → return to caller
   ▼
Your app

Privian implements this flow as a single HTTP call to POST /v1/gateway. The request is a JSON object with { model, prompt, stream }. The gateway masks PII in-memory, forwards the masked prompt to the upstream provider, rehydrates the response, and returns it to the caller. No raw prompt or response content is persisted.

What "secure" actually means

Different teams mean different things by prompt security. A useful decomposition:

• Privacy — does the provider see customer data? Masking addresses this directly.
• Confidentiality — is the prompt encrypted in transit? TLS handles this; do not skip it.
• Retention — does the prompt sit in logs forever? Zero retention means the gateway does not persist prompt or response bodies.
• Access — who in your org can read prompts in flight? Limit this to the people who actually need to debug.

See Zero retention for how Privian handles the second and third points.

Tradeoffs

Prompt security is not free. Three honest tradeoffs:

• Latency. Detection and masking add a few milliseconds. The cost is small but non-zero.
• Recall. No detector catches 100% of personal data. You should design for defense in depth — masking plus access controls plus minimal data collection upstream.
• Capability loss. When you mask aggressively, the model has less context. For most chat and summarization workloads, deterministic placeholders preserve enough structure for the model to reason well. For tasks that genuinely need the raw value, you have to make a deliberate choice.

How Privian fits

Privian provides prompt security as a thin HTTP layer in front of OpenAI, Anthropic, Google and other providers. You point your client at the gateway, send the prompt, and get a rehydrated response back. The masking, routing, and audit happen inside the gateway. See the LLM Gateway page for the product overview, or the first-request guide for a working example.