PII & Data Loss Prevention

Protect sensitive data across prompts and outputs

14 PII types with business logic validation, configurable redaction policies, and enterprise compliance for GDPR, HIPAA, and SOC 2.

14

PII types

< 15ms

Full PII scan

SHA-256

Audit trail hashing

How It Works

Detect and redact PII in every request.

1

Scan request content

14 detection types with business logic validation analyze prompts and tool arguments.

2

Apply redaction policy

Per-type policies determine masking, hashing, or blocking behavior.

3

Log and forward

Immutable audit trail records detections. Safe content forwarded to the LLM.

14 PII Types

Comprehensive sensitive data detection.

TypeValidationCategory
SSNUS format + checksumIdentity
EmailRFC-compliant parsingIdentity
PhoneInternational formatsIdentity
Driver's LicenseUS state formatsIdentity
PassportInternational formatsIdentity
Credit CardLuhn algorithmFinancial
Bank AccountUS routing validationFinancial
IBANInternational identifiersFinancial
Medical RecordHealthcare identifiersHealthcare
IP AddressIPv4 and IPv6Technical
MAC AddressHardware identifiersTechnical
API KeyService tokensTechnical
URL / DomainWeb address parsingTechnical
GPS CoordinatesLocation dataTechnical
Redaction Methods

Four strategies for handling sensitive data.

MethodBehaviorExample
mask_completeReplace with [TYPE_REDACTED] tokenjohn@co.com → [EMAIL_REDACTED]
mask_partialKeep format, hide sensitive portions4532-1234-****-9012
hash_and_storeSHA-256 hash for audit trailSSN → Hash: a4b2c8...
block_requestReject request entirelyRequest blocked: PII_DETECTED

What's included

Detection, redaction, and compliance — built in

Every request gets automatic PII scanning with configurable policies and compliance-ready audit trails.

14 PII types with validation
Business logic detection (not just regex)
Context-aware false positive reduction
Complete & partial masking
SHA-256 hashing for audit trails
Block requests containing PII
Per-type configurable policies
GDPR compliance support
HIPAA PHI detection
SOC 2 confidentiality controls
ReDoS-resistant pattern design
Immutable audit logging

Policy Configuration

Configure redaction behavior per PII type with granular control.

{
  "pii_policies": {
    "email": {
      "action": "mask_partial",
      "preserve_domain": true
    },
    "ssn": {
      "action": "block_request",
      "alert_security_team": true
    },
    "credit_card": {
      "action": "hash_and_mask",
      "preserve_last_four": true
    }
  }
}

Detection Response

Every detection includes type, location, and action taken.

{
  "pii_detected": [
    {
      "type": "credit_card",
      "action": "mask_partial",
      "original_hash": "a4b2c8...",
      "masked": "4532-****-****-9012"
    },
    {
      "type": "email",
      "action": "mask_partial",
      "masked": "j***@company.com"
    }
  ]
}

Context-Aware Detection

Business logic validation reduces false positives on legitimate data like order numbers and product IDs.

Enterprise Compliance

Built-in support for GDPR, HIPAA, and SOC 2 with audit trails and data residency controls.

Zero-Copy Analysis

Bounded memory algorithms scan requests in under 15ms without copying sensitive data.

Start protecting sensitive data

PII detection and redaction included with every plan. No extra cost.

Get started freeRead the docs