Short answer
There's no single best PII redaction tool for LLMs. Presidio suits teams that want free and self-run, Limina multilingual de-identification, Nightfall company-wide DLP, Skyflow vaulting, Protecto role-based unmasking, and cloud DLP batch jobs. Maskflare, which wrote this list, fits teams that need values masked and restored across apps, people and agents.
Picking a PII tool for an LLM app comes down to three questions. Where does the data flow: live API calls, employees in a browser, agents calling tools, or datasets at rest? Does the model's answer need the real values back? And who runs it: you, or a vendor? Answer those first and the list below gets short quickly.
What should you look for in a PII redaction tool for LLMs?
- Reversibility. Redaction removes values for good. Masking with reversible tokens lets you restore them in the answer. If the model writes letters, tickets or forms, you need the second.
- Where it sits. A library you call, a gateway you route through, an endpoint agent, or a batch job. This decides how much code you write.
- Detection method. ML models are better on names and addresses in prose. Rules with checksums are better on IDs, card numbers and secrets, and they're predictable.
- Coverage that matches your data. Country IDs, languages, credentials, health data.
- Streaming and formats. Restoring values inside a streamed response, handling tool calls and embeddings.
- Hosting. Self-hosted, on-premises, or a region that fits your regulator.
The tools at a glance
| Tool | Type | Detection | Restore values | Best for |
|---|---|---|---|---|
| Maskflare | Managed gateway, SDKs, endpoint agents, MCP | Deterministic rules plus local NER, 574 detectors | Yes, incl. streaming and browser | Masking and restoring live AI traffic across apps, people and agents |
| Microsoft Presidio | Open-source library (MIT) | NER plus patterns | Build it (encrypt and decrypt) | Free, self-run, customizable detection |
| Limina (formerly Private AI) | De-identification API and container | ML models, 52 languages | Not documented | Multilingual de-identification of regulated data |
| Nightfall AI | DLP platform | ML detectors, 100+ types | Not documented | Company-wide DLP across SaaS, endpoints and AI |
| Skyflow | Data privacy vault, runtime AI data control | Polymorphic engine (vendor term) | Yes, by policy and identity | Vaulting sensitive data and identity-aware agent controls |
| Protecto | AI data control plane | 200+ data types (vendor) | Yes, for authorized users | Role- and context-based unmasking in AI workflows |
| LLM Guard (Protect AI) | Open-source scanners (MIT) | Presidio Analyzer based | Yes (Vault and Deanonymize) | Prototypes; repo archived July 2026 |
| Google Sensitive Data Protection | Cloud DLP API | InfoType detectors | Yes, with deterministic or FPE encryption | GCP data pipelines |
| AWS Comprehend PII | Cloud NLP API | ML, English and Spanish | No | Detecting or batch-redacting text on AWS |
1. Maskflare
Best for: teams that need values masked before they reach an AI provider and restored in the answer, across applications, employees and agents. Our own product, so read this one most skeptically.
You change an SDK base URL to route OpenAI, Anthropic, Gemini, Mistral, xAI, DeepSeek, Groq, Together AI or Ollama through the gateway. Streams are masked event by event and restored as they flow; embeddings get deterministic tokens. The same policy covers a desktop agent, browser protection for ChatGPT, Claude, Gemini, DeepSeek, Perplexity, Mistral Le Chat and Microsoft 365 Copilot, MCP tool calls and hooks for Claude Code, OpenAI Codex, Cursor, GitHub Copilot CLI and VS Code agent mode. Detection: 574 detectors in 53 packs, 47 country packs, 232 credential formats, plus a local named-entity layer. EU-hosted by default, on-premises for enterprise.
Limits: Not open source. SOC 2 Type II and ISO 27001 audits are in progress.
2. Microsoft Presidio
Best for: engineering teams that want a free, self-run, customizable detection library. MIT-licensed, built at Microsoft and, as of October 2026, transitioning to community ownership under the Data Privacy Stack organization. The Analyzer combines an NER model (spaCy by default) with patterns, checksums and context; the Anonymizer redacts, replaces, hashes or encrypts. There's an image redactor and a structured-data module. Built-in recognizers cover global types plus 18 countries.
Limits: it's a library, so the proxy, token store, streaming restore and policy layer are yours to build. No built-in Swiss or Dutch IDs. Full comparison: Presidio alternative.
3. Limina (formerly Private AI)
Best for: regulated organizations de-identifying documents, transcripts and datasets in many languages. Private AI rebranded as Limina on 5 March 2026. ML-based detection of 50+ entity types in 52 languages, with redaction, pseudonymization, synthetic replacement and generalization. Runs as a container in your VPC or on-premises, or as SaaS. A free Starter tier allows 75 API calls a day.
Limits: it's an API you call, not a gateway. Its older PrivateGPT redact-and-restore product no longer appears on its site. Full comparison: Limina alternative.
4. Nightfall AI
Best for: security teams that want one DLP platform across SaaS apps, endpoints, email and AI tools. Founded in 2018, Nightfall integrates with Slack, Google Drive, Jira, Confluence, Salesforce and more, offers a browser extension that redacts sensitive data before it's sent to AI apps, an MCP gateway and Firewall for AI, a scan API with SDKs that returns a redacted payload.
Limits: redact or block; we found no documented restore of values into answers. Full comparison: Nightfall alternative.
5. Skyflow
Best for: companies that want sensitive data stored in a vault, with tokens everywhere else, and identity-aware controls for agents. Founded in 2019, Skyflow now markets runtime AI data control that masks and rehydrates data by policy, identity and context, with an MCP gateway and MCP Server SDK.
Limits: a vault integration is a bigger project than a proxy, and pricing is sales-led. Full comparison: Skyflow alternative.
6. Protecto
Best for: teams that want masked data in LLM and agent workflows with unmasking decided by role and context. Protecto describes itself as an AI data control plane for LLMs, agents and MCP pipelines. It uses entropy-based tokens that are consistent within a namespace, restores values for authorized users, claims 200+ sensitive data types, and deploys as SaaS, in your VPC or on-premises. It offers REST APIs and a Python SDK.
Limits: the accuracy figures on its site are vendor claims; we couldn't find an independent benchmark. Employee browser coverage isn't a stated focus.
7. LLM Guard (Protect AI)
Best for: prototypes and learning. LLM Guard is an MIT-licensed set of input and output scanners. Its Anonymize scanner builds on the Presidio Analyzer and stores originals in a Vault; the Deanonymize output scanner puts them back. Protect AI was acquired by Palo Alto Networks in July 2025.
Limits: the GitHub repository was archived on 9 July 2026 and is read-only. You can still use or fork it, but don't expect fixes.
8. Cloud DLP: Google Sensitive Data Protection and AWS Comprehend
Google Sensitive Data Protection is best for teams already on Google Cloud that want de-identification in data pipelines. It supports reversible pseudonymization with deterministic encryption (AES-SIV) and format-preserving encryption (FPE-FFX), re-identified with the original key; HMAC hashing is one-way.
AWS Comprehend is best for detecting PII in English or Spanish text on AWS. Real-time analysis returns entity types, scores and offsets for documents up to 100 KB; redaction runs as an asynchronous batch job and replaces values with asterisks. Country-specific types cover the US, UK, Canada and India.
Limits for both: they're building blocks. Neither is an LLM proxy, so wiring them into each provider's request format, and restoring values in streamed answers, is your work.
How do you choose?
| If your situation is… | Start with |
|---|---|
| Prototype, no budget, Python team | Presidio |
| De-identify clinical notes or call transcripts in many languages | Limina |
| DLP across Slack, Drive, email and AI | Nightfall |
| Move PII out of your databases into a vault | Skyflow |
| Unmasking decided per role in agent workflows | Protecto or Skyflow |
| Batch pipelines on GCP or AWS | Google Sensitive Data Protection or AWS Comprehend |
| Live AI traffic where answers need the real values, plus employees and agents | Maskflare |
Whatever you shortlist, test it on 200 of your own prompts. Count misses and over-masking separately: a tool that masks every number will look great on recall and break your product.
Frequently asked questions
What's the best free PII redaction tool for LLMs?
Microsoft Presidio, if you have engineers to build the proxy and restore logic around it. LLM Guard is also free, but its repository was archived in July 2026.
Which tools can restore the original values in the LLM's answer?
Based on public docs as of October 2026: Maskflare, Skyflow, Protecto, and LLM Guard (via its Deanonymize scanner). Presidio and Google Sensitive Data Protection can reverse values with a key, but you wire that into the LLM flow yourself.
Is ML-based detection better than rules?
For names and addresses in free text, usually. For national IDs, card numbers and API keys, rules with checksum validation are more precise and predictable. Many teams care most about the second group.
Why doesn't this list include accuracy numbers?
Vendors measure on different datasets, so their numbers aren't comparable. We'd rather you test on your own data than trust anyone's marketing, including ours.
Did Maskflare write this list?
Yes. We've tried to be fair and we link to each vendor's docs so you can check every claim.
About the author
Guides from the engineers who build Maskflare's gateway, detection engine, desktop agent and SDKs. Every code sample is run against the product before it's published, and every limit we mention is one we hit ourselves.