pii redaction · llm security · gdpr · ai compliance · guide

PII redaction for LLM applications: the complete guide (2026)

Design an LLM redaction flow: detection, local mappings, reply restore, streaming limits and practical acceptance checks for your application.

Godfrey Lebo Founder, Sether July 9, 2026 · updated October 17, 2026 · 12 min read

Sether™ / Field notes pii redaction A useful task. Fewer exposed details. A practical guide to the AI privacy boundary.

What is PII redaction for LLM applications?

A prompt is an application payload. If a user types "Hi, I’m Sarah Chen, my email is sarah@acme.com, calling about order 4532", those values reach the provider unless your application changes the payload first. HTTPS protects transport; it does not hide the values from the intended recipient. Redaction replaces supported matches before that request, with restoration later when the task needs the originals back.

SetherThe idea, illustrated Your map. Your side.

Keep the replacement mapping on your side of the integration. The model can receive a token such as <EMAIL_uuid> in place of a matched email, and your app can restore that token from its vault. This is a reduction in disclosed detail, not proof that the remaining message is anonymous: an order reference or the surrounding story may still identify someone. The mechanics are in Reversible PII redaction: how redact-then-restore works.

Why this became urgent in 2026

An AI feature adds a data recipient and often another place where prompts, replies or logs can persist. Before launch, ask a concrete question: which fields does this task need, and which can remain in your application? Then review the resulting data flow with the people responsible for security, privacy and contracts. That produces a useful engineering requirement without relying on a blanket regulatory deadline or promising that redaction resolves every obligation.

If you are wondering whether your specific setup is a problem, start with Is it GDPR-compliant to send customer data to OpenAI? That post walks the actual legal reasoning instead of fear-mongering.

Where to redact: library, gateway, or browser

These are complements, not competitors. A library protects your product's API calls; an extension protects the copy-paste habits of the humans in your company. We cover the human side in How to stop pasting sensitive data into ChatGPT.

Detection: patterns, labels, and NER

No single technique catches everything. Production redaction layers stack three:

1. Validated patterns identify candidate structured values, with checks such as Luhn for cards and mod-97 for IBANs. These checks reject some invalid candidates; they do not prove a value belongs to a person or eliminate false matches.
2. Label anchoring uses nearby cues such as "name: Sarah Chen" or "DOB: 12/04/1991". Coverage depends on the enabled labels, scripts and value formats.
3. NER (named-entity recognition) can identify entities in free prose where shape and labels offer less signal. It adds model and evaluation costs. Known-term lists and custom detectors are other options for specific vocabularies.

Regex vs NER for PII detection explains coverage and evaluation choices. Local inference can avoid sending text to a separate detection service; it also adds model-loading and runtime responsibilities to assess.

Not just PII: API keys and secrets

The same pipeline that catches emails should catch sk-... OpenAI keys, AWS access keys, GitHub tokens, Slack tokens, Stripe keys, JWTs, and high-entropy strings. Developers paste config into AI chats constantly, and a leaked provider key is a worse day than a leaked email address. Sether ships this as a separate detector pack (8 detectors including a Shannon-entropy catch-all) that you enable alongside the basic pack.

The streaming trap: values split across chunks

Streaming introduces a second boundary: a detector may receive sarah@ac and me.com in different chunks. Scanning chunks independently can miss the joined email. Sether uses a configurable hold-back distance (safeDistanceBytes, default setting 256) and additional buffering guards. These are bounded safeguards, so test long values, custom detectors and actual transport framing rather than treating the default as a guarantee for every possible input.

The chunk-boundary discussion shows a reproducible example, partition-test design and the current implementation’s buffering limits. Use those examples to test the actual code path and retain the failing partitions as regression fixtures.

The tool landscape, honestly

Choose by integration shape and measured coverage. Presidio exposes configurable detection and anonymization operators, including a deanonymizer for reversible operations. Sether focuses on an in-process redact/vault/restore flow for TypeScript and Python. Compare both on representative prompts and deployment constraints; the longer Presidio comparison explains what to test.

A minimal implementation

In TypeScript (full walkthrough):

import { Sether } from '@raeven-co/sether';
import { Readable } from 'node:stream';

const sether = new Sether();

// Outgoing: pipe the prompt through redact() before it leaves
const safeForLLM = Readable.from([userMessage]).pipe(sether.redact());

// Incoming: pipe the model reply through restore() before the user sees it
const safeForUser = llmResponse.pipe(sether.restore());

In Python (full walkthrough):

from sether import Sether

sether = Sether()

safe = sether.redact_sync(user_message)    # tokens out
reply = call_openai(safe)
restored = sether.restore_sync(reply)      # real values home

Trusting the redactor itself

A redaction layer handles sensitive inputs, so inspect its source, dependencies, storage and network behavior. Review the exact version you plan to deploy, including optional models and wrappers. The supply-chain hardening account documents a historical scan, not a permanent security rating or certification.

Use a fictional support ticket as an acceptance fixture. Mark the email as a required replacement, leave the refund question readable, and make the model reply echo the token. Verify the outgoing payload, the restored reply and your error logs separately. A passing round trip proves the mapping works; it does not prove that every sensitive field was detected.

The 10-point checklist

1. List every place your code sends text to an LLM provider (including background jobs and evals).
2. Review provider roles, applicable agreements and any required customer disclosures for the actual data flow.
3. Put a redaction layer in each request path (library or gateway).
4. Enable structured-PII detectors with validation (email, phone, card + Luhn, SSN, IBAN + mod-97, IPs).
5. Enable the secrets pack (provider keys, tokens, JWTs, high-entropy).
6. Turn on label-anchored identity detection, multilingual if you serve non-English users.
7. Add NER if your prompts carry free-text names (support tickets, chat, documents).
8. Verify streaming safety: test a value split across chunk boundaries.
9. Keep the matching vault available for the reply, with deliberate access, capacity and retention limits; test missing and expired mappings.
10. Give employees a browser-side guard for direct ChatGPT/Claude/Gemini use.

Written by Godfrey Lebo

Founder of Sether. Ships production software for a living and reads every comment below. More about the team.