python · pii redaction · openai · fastapi · tutorial

How to redact PII from LLM prompts in Python

Build a Python redact-and-restore flow with Sether. Check vault sharing, supported wrappers, streaming behavior and JSON-safe restoration.

Godfrey Lebo Founder, Sether July 9, 2026 · updated October 17, 2026 · 8 min read

Sether™ / Field notes python Keep Python prompts deliberate. Select supported details to replace before the model.

Why does my Python app leak PII to LLM providers?

Because that is the default. Whatever string you pass to the OpenAI or Anthropic client goes to their servers verbatim, and user input carries names, emails, and pasted card numbers more often than anyone expects.

SetherThe idea, illustrated Your map. Your side.

The fix is a redaction step in the request path: swap personal values for tokens before the call, swap them back in the reply. This post shows how in Python; the background and the tool landscape are in the complete guide.

Install

pip install sether

# or with the wrapper for your LLM client:
pip install "sether[openai]"
pip install "sether[anthropic]"
pip install "sether[httpx]"

Install sether from PyPI and review the requirements for the release you deploy. The Python 0.4.0 release notes cover the JSON-safe restore APIs and compatibility changes. Phone detection uses the phonenumbers package.

The redact-then-restore round trip

from sether import Sether

sether = Sether()

user_message = "Hi, I'm Sarah, my email is sarah@acme.com"

safe = sether.redact_sync(user_message)
# -> "Hi, I'm Sarah, my email is <EMAIL_uuid>"

reply = call_openai(safe)               # your existing call

restored = sether.restore_sync(reply)   # real values back

Redaction stores token-to-original entries and restoration reads those entries. Reusing one instance is the simplest setup. Separate instances can restore through a shared configured vault, while a fresh default vault has no earlier mappings. Test the behavior when entries are missing, expired or evicted.

Why the design works this way, and what the vault stores, is covered in Reversible PII redaction: how redact-then-restore works.

Which integration path should I use?

The wrappers cover supported client request and reply shapes. The extras install the libraries those wrappers use. Keep integration fixtures for your selected SDK version and response modes; “drop-in” does not mean that every endpoint or future shape is automatically handled.

How do I cover a whole FastAPI or Flask app?

If a service forwards text from several routes, middleware can centralize part of the transformation. Verify which request and response fields it touches and keep its placement deliberate. Data redacted on inbound requests reaches your route handler already transformed; that is a different boundary from wrapping only the outbound provider call.

Place it like any other ASGI middleware in FastAPI, and scope it to the routes that forward text to a provider rather than your whole API. SetherWSGIMiddleware does the same job for Flask and other WSGI apps. Both ship in the base package with no extra dependency.

Does it handle streaming responses?

Yes, both sync and async streaming. This matters because streaming is where naive redaction silently fails: a value split across two chunks passes a per-chunk regex on both sides.

Sether preserves surrounding text between chunks with bounded buffering, rather than scanning each chunk in isolation. Configure and test long values, final fragments and your actual event framing. The chunk-boundary post explains both the failure mode and the limits of bounded buffering.

What do tokens and the vault look like?

Tokens have a type prefix and fresh identifier per match. They reference vault entries rather than encoding originals. The model can still alter or omit them, and unmatched text or context can still identify someone, so validate the edited prompt and resulting reply.

The default vault lives in process memory. The library does not send that mapping to the model provider. If you implement a persistent or shared vault, its access controls, tenant separation and retention become part of your application’s design.

What gets detected?

• Basic pack (default): email, phone (via phonenumbers), credit card with Luhn validation, SSN, IPv4, IPv6, IBAN with mod-97 validation.
• Secrets pack (opt-in): AWS access keys, OpenAI keys, Anthropic keys, GitHub PATs, Slack tokens, Stripe keys, JWTs, and high-entropy strings (Shannon entropy of 3.5+ bits per character).
• Identity pack (opt-in): label-anchored name, date of birth, passport, and address, with labels recognised across Latin, CJK, Cyrillic, and Arabic scripts.

How do I test it?

Assert the round-trip property: restoring a redacted string returns the original exactly. Also assert the redacted form no longer contains the raw value.

from sether import Sether

def test_round_trip():
    sether = Sether()
    original = "Reach me at sarah@acme.com or +14155552671"

    redacted = sether.redact_sync(original)
    assert "sarah@acme.com" not in redacted
    assert "+14155552671" not in redacted

    restored = sether.restore_sync(redacted)
    assert restored == original

For a production acceptance fixture, capture a fictional outbound request, a reply that echoes its token, a reply with an unknown token, and an expired vault entry. If the result drives a tool, validate arguments and authorization before acting. A successful restore does not authorize sending an email or writing a record.

The full Python library remains free under MIT, including decoys and restore. Optional Pro in the official tools is a separate product tier; there is no Sether per-redaction quota in these SDK calls. See pricing for that distinction.

Limitations and maturity, honestly

Follow the release notes for the version you install rather than assuming perfect feature parity from a shared design. Python 0.4.0 and TypeScript 0.8.0 both add JSON-aware restoration, with some different streaming behavior. Review both articles if your system mixes the two languages.

• Free-text names ("tell Chidi I sent it") are out of scope for pattern and label detection. That class needs NER; see Regex vs NER for PII detection.
• The default vault is in-memory, so redact and restore must happen in the same process unless you plug in a shared store.
• Redaction is a technical measure that helps with data minimisation. It is not a compliance certificate on its own.

Docs live at /docs/python, the source is at github.com/raeven-co/sether, and you can try detection in the browser sandbox first.

Written by Godfrey Lebo

Founder of Sether. Ships production software for a living and reads every comment below. More about the team.