Data Protection
What Is PII Redaction?
- Personal information
- Policy actions
- Data workflows
Short answer
PII redaction is the detection of personally identifiable information, such as names, email addresses, IBANs and ID numbers, followed by removing or replacing it so that people and systems who don't need the value never see it. It's applied to documents, logs, support tickets and, more and more, to prompts sent to AI models.
What does PII redaction actually do?
Picture a support agent at 4:40 pm with a queue of refund tickets. She pastes one into an AI assistant to draft a reply: "Customer Ada Lovelace (ada@example.com) wants CHF 2,400 refunded to IBAN CH93 0076 2011 6238 5295 7." That sentence holds three pieces of personal data. PII redaction is the step that finds them and swaps them out before the text goes anywhere it shouldn't.
Every redaction system does two jobs. Detection decides which characters are personal data. The action decides what replaces them. Detection is the hard part: an IBAN has a checksum you can verify, a person's name doesn't. The action is a policy choice, and it decides whether the redacted text is still useful afterwards.
| Action | Result | Can it be undone? |
|---|---|---|
| Original | Refund CHF 2,400 to Ada Lovelace, ada@example.com | - |
| Redact | Refund CHF 2,400 to [PERSON], [EMAIL] | No |
| Mask (reversible token) | Refund CHF 2,400 to mf_mask_170b..., mf_mask_9c2e... | Yes, by the token holder |
| Partial | Refund CHF 2,400 to A* L*, a**@example.com | No |
| Hash (HMAC) | Refund CHF 2,400 to 4f1a9c..., 8be20d... | No, but equal values match |
What counts as PII?
There's no single list. US guidance such as NIST SP 800-122 talks about information that can distinguish or trace an individual's identity. GDPR's "personal data" is wider and covers anything relating to an identifiable person, including online identifiers. HIPAA has its own 18 identifiers for health data. In practice, a redaction policy needs to cover four groups:
- Direct identifiers: names, email addresses, phone numbers, national IDs such as a US Social Security number, a Swiss AHV number or a German tax ID.
- Financial identifiers: IBANs, card numbers, account numbers.
- Online identifiers: IP addresses, device IDs, customer IDs from your own systems.
- Quasi-identifiers: date of birth, postcode, job title. Harmless alone, identifying in combination.
Secrets such as API keys and database passwords aren't PII, but they leak through exactly the same channels, so most teams redact them in the same pass. For how PII differs from health and card data, see PII vs PHI vs PCI.
How is PII detected?
| Approach | Good at | Weak at |
|---|---|---|
| Patterns plus validators | Structured values with checksums: IBANs (mod 97), card numbers (Luhn), many national IDs | Free-text values without a format |
| Context keywords | Telling a date of birth from any other date, an account number from an order number | Text where the keyword is missing |
| Dictionaries and word lists | Person names, your own product or project codes | Rare or unusual names |
| Exact Data Match | Values from your own records, such as customer numbers | Data you haven't loaded |
| Machine-learning models | Names and addresses in messy prose | Explaining decisions, consistent latency |
Maskflare uses all of them. Its deterministic engine has 574 detectors in 53 packs: 56 global detectors, 232 credential and secret formats, 21 healthcare detectors, person names and 47 country packs covering all EU-27 states plus the US, UK, Switzerland and others. On top of that, a local named-entity layer finds names, places and other free-text details; it runs inside Maskflare, with no third-party AI service. The playground's explain view shows why each value matched. On our 228-case Swiss benchmark the combination found 100% of values with no false positives. For your own customer list, add a dictionary or Exact Data Match.
Redaction, masking or blocking: which action fits?
Plain redaction is final. That's right for a document going to a court or a log nobody will read the original of. It's wrong when someone still needs the value: an AI that drafts "Dear [PERSON]" leaves a human to fix every reply. Maskflare lets each rule pick its own action:
- Mask: a reversible token, restored later where the answer repeats it.
- Redact: a label such as [EMAIL], with no way back.
- Partial: keep the first or last N characters, like the last four digits of a card.
- Hash: an HMAC per organization, so equal values still match.
- Format-preserving encryption (FF1): looks like the original format and can be decrypted with the key.
- Alert or block: let it through and record it, or stop the request.
The difference between redaction and masking gets its own page: data redaction vs data masking. Reversible masking is explained in what is reversible tokenization.
Where is PII redaction used?
- AI prompts and responses, before text reaches OpenAI, Anthropic, Gemini or another provider. See PII redaction for AI prompts.
- Application logs, so a stack trace doesn't carry a customer's email into your log platform. See PII redaction for logs.
- Customer support, where tickets and chat transcripts are full of names and account numbers.
- Test and analytics data, copied out of production.
- Documents shared outside the company.
How do you add PII redaction in front of an AI model?
- Pick a starting profile. Maskflare has one-click profiles for GDPR (EU/EEA), UK GDPR, HIPAA Safe Harbor, PCI DSS v4.0 and US PII (CCPA/CPRA).
- Run the rules in shadow mode for a few days. Requests go through unchanged and you see what would have been masked.
- Point your SDK at the gateway by changing the base URL to
https://<your-gateway>/v1/<provider>. - Switch on restoring for the gateway key if users should see real values in answers.
- Tune allowlists for false positives, then enforce.
from openai import OpenAI
# Same SDK, same code. Only the base URL changes.
client = OpenAI(base_url="https://<your-gateway>/v1/openai")
reply = client.chat.completions.create(
model="gpt-4o-mini",
messages=[{"role": "user", "content": "Draft a refund reply to Ada Lovelace, ada@example.com"}],
)What are the limits of PII redaction?
Redaction isn't anonymization. Take out the name and IBAN but leave "the only cardiologist in Vaduz" and you've still identified someone. Detection misses some things, especially unusual names and identifiers written in a non-standard way. Maskflare's optional image scanning uses classic OCR in English only, and audio in voice sessions isn't masked at all, only the text events. And redaction is one control among several: it doesn't replace access control, retention rules or encryption at rest.
Frequently asked questions
Is PII redaction the same as data masking?
Not quite. Redaction removes the value for good. Masking replaces it with something else, such as a token or a partial value, and some masking can be reversed. Many tools, Maskflare included, offer both as actions.
Can PII redaction be reversed?
True redaction can't. If you need the original back later, for example in an AI answer, use reversible masking, where a token store maps each token to its value.
Does PII redaction make data anonymous under GDPR?
Only if nothing left in the data can identify the person by reasonably likely means. Most redacted business text still contains quasi-identifiers, so it usually stays personal data.
How fast is PII redaction in an AI gateway?
With Maskflare's default rules it adds about 2 ms median to a 10 KB chat request (4.3 ms p99), and about 10 ms with all 574 detectors on.
Does Maskflare store the prompts it redacts?
No. Prompts and responses aren't logged or stored. Records hold metadata and counts only. The originals behind reversible tokens are kept encrypted for 30 days so they can be restored.