For business
What it is
Personal data (names, dates of birth, account numbers) is found and masked before anything is stored or sent to a model.
Why it matters
It shrinks regulatory exposure (GDPR, financial regulation) and makes it safe to use external AI providers and to keep data for improvement.
Risk without it
Personal data leaks into logs, search indexes and third-party prompts, where it is hard to find and harder to delete.
For engineers
How it works
Pattern rules catch structured data (account numbers, postcodes, dates); named-entity recognition catches names and places. Values are replaced by typed placeholders, and a separate, access-controlled vault maps them back only when the final document needs the real values.
Typical stack
- Microsoft Presidio
- AWS Comprehend PII
- custom rules
- KMS-encrypted token vault
Pitfalls & trade-offs
- Measure recall on your own data: missed PII is the costly error.
- Keep placeholders typed ([NAME], [ACCOUNT]) so the model still understands the sentence.
- Logs and traces need redaction too.
In this example
In
→ Jane Smith, born 04/03/1971, account 4417…
Out
[NAME], born [DATE], account [ACCOUNT]
Fictional sample · not a client system