Privacy
PII doesn’t reach the model provider
Every prompt your app sends to a third-party model is a potential disclosure: names, emails, phone numbers, card and account numbers, national IDs. The ecosystem’s standard answer is detect-and-redact – and redaction is one-way: the model answers about [REDACTED] and the damage moves from compliance to quality. in/guard/out screens and restores.
Side by side
| Capability | Typical DLP (cloud filters, router presets, framework middleware) | in/guard/out |
|---|---|---|
| After detection | Redact, mask, hash, or block – one-way, everywhere | Stable placeholders, restored to real values on the response |
| Answer quality | The model reasons about [REDACTED] and your user reads placeholders | Placeholders are stable per value, so references stay coherent and the final answer reads naturally |
| Entity coverage | Preset lists – e.g. email/card/IP/MAC/URL (LangChain), 7 presets (OpenRouter) | Full Presidio + spaCy NER set: names, addresses, SSNs, IBANs, and more, with a tunable threshold |
| The sensitive-value map | n/a – originals discarded or logged | In memory for one request; never written to the database |
| Logs | Whatever each app logs – often raw | Screened by default; raw logging is a deliberate, audited opt-in |
| Agent tool calls | — (arguments leave unexamined) | Taint tracking: screened values and secrets blocked from leaving via tool args |
| Deployment | Per app (middleware) or per cloud (that provider only) | On the wire – every app, every upstream, one policy |
What happens to the values
Inbound, Microsoft Presidio (with spaCy NER) detects PII above a configurable confidence threshold and replaces each value with a stable placeholder – the model, and the provider behind it, only ever see <PERSON_2> or <EMAIL_ADDRESS_1>. Outbound, as the very last stage, the placeholders are swapped back to the real values, so your application receives a normal, usable answer.
The placeholder-to-value map lives in memory for the single request and isn’t written to the database. Logs store the screened form by default. And because in/guard/out created the placeholders, it knows exactly which tokens are sensitive – which is what makes taint tracking on agent tool calls possible.
How screen & restore works
Detect
Presidio + spaCy NER find PII entities – person names, emails, phones, cards, SSNs, IBANs and more – above your configured confidence threshold. The entity set is configurable.
Screen
Each value becomes a stable placeholder, so repeated mentions map to the same token and the model can still reason about the text coherently.
Restore
The final outbound stage swaps placeholders back to real values. Your app gets usable output; the provider didn’t see the originals.
Contain
On agent traffic, taint tracking blocks screened values and detected secrets from leaving through tool-call arguments – unless the tool is explicitly allowed to receive that entity type.
Frequently asked questions
Does the LLM provider ever see real personal data?
No. PII is replaced with placeholders before any request reaches the model provider. The provider sees screened text only. Unscreened values are restored in the response your application receives.
Is the PII map stored anywhere?
No. The placeholder-to-value map exists in memory for the duration of one request and isn’t persisted. Transcript logs store the screened form by default.
Which entities are detected?
Names, emails, phone numbers, credit cards, SSNs and national IDs, IBANs, IP addresses, crypto addresses and more – powered by Presidio, with the entity list and confidence threshold configurable per deployment.
Does screening break the model’s answer?
Placeholders are stable per value, so the model reasons over consistent tokens and the restore step returns a natural answer. The grounding checks compare against the screened source, so placeholders aren’t mistaken for changed values.
Related guardrails
See PII doesn’t reach your provider
Test with real data: watch names, emails, and card numbers become placeholders before leaving your boundary. We are running a limited demo - sign up and we will get you in as soon as we can.