Evaluation guide
OpenAI Privacy Filter, Presidio, or a managed gateway: how the approaches differ
- 01Identify sensitive valuesDetect
- 02Replace with stable tokensMask
- 03On API traffic, restore inside your boundaryRestore
Direct answer
OpenAI Privacy Filter, Microsoft Presidio and a managed PII gateway keep personal data out of AI requests, but differ in who owns the work. Privacy Filter is an open-weight model you run. Presidio is an open-source framework you assemble and tune. A managed gateway is a hosted service you set policy on. Pick by what your team wants to own.
Three deployment models for the same underlying problem
All three approaches answer the same question: is personal data found and handled before it reaches an AI provider or leaves an internal boundary? Where they differ is deployment. Privacy Filter is a model you run inference on yourself. Presidio is a Python framework combining pattern recognizers, checksum validation and named-entity recognition that a team wires into its own request pipeline. A managed gateway sits in front of traffic as a service, with detection, masking and restoring handled on the gateway's side of the call.
None of the three is a drop-in replacement for the others without adopting its deployment model along with it. Choosing between them is closer to choosing a hosting model than choosing a detection algorithm.
What OpenAI Privacy Filter is, as of October 2026
OpenAI released Privacy Filter in April 2026 as an open-weight model for detecting and redacting personal data in text, under the Apache 2.0 license, with weights on Hugging Face and GitHub. As reported at release, it has about 1.5 billion parameters in total with roughly 50 million active per token, accepts up to 128,000 tokens of context, and labels text in a single pass as a token-classification model rather than generating output. OpenAI describes it as small enough to run locally, and it can be fine-tuned.
It sorts what it finds into eight broad categories: names, addresses, email addresses, phone numbers, URLs, dates, account numbers (such as card and bank account numbers) and secrets (such as passwords and API keys). OpenAI reported an F1 score of about 96 percent on the PII-Masking-300k benchmark, and 97.43 percent on a version of that dataset it corrected for annotation errors. Those are OpenAI's own figures on a public benchmark, not results on your data.
OpenAI is also clear about the limits: it can miss uncommon identifiers and ambiguous references, it can over- or under-redact when context is short, and human review and domain-specific evaluation stay important in legal, medical and financial work. Note what it isn't, too. It's a detector you host, not a feature of the OpenAI API, and it doesn't keep a mapping to restore the original values in a model's answer. That part you build.
- Open weights under Apache 2.0, run on your own hardware
- Eight broad categories, labelled in one pass
- Long context, up to 128,000 tokens
- Fine-tunable for your own data
- No built-in restoring, provider integration or policy layer
What Presidio and a managed gateway are
Microsoft Presidio is an open-source, MIT-licensed framework with two parts: an analyzer that finds entities using pattern recognizers, checksums, context words and a named-entity model for names, and an anonymizer that replaces, masks, hashes or encrypts what was found. Its encrypt operator is reversible, so placeholders can be decrypted later with the same key. It's mature, widely used and free, and it's strongest on names in English prose. LiteLLM ships a guardrail that calls Presidio containers you deploy.
A managed gateway such as Maskflare takes a different route. Applications change their AI SDK's base URL and every request is masked before it reaches the provider, with values restored in the answer, streamed responses and tool-call arguments included. Maskflare's detection is deterministic, with a local named-entity layer on top: 574 detectors in 53 packs, including 47 country packs and 232 credential and secret formats, with checksum validation and handling of encoded and look-alike characters. It's hosted in the EU by default, with on-premises deployment available for enterprise.
Side by side: how the three approaches compare
The comparison below covers the points that usually decide the choice. It describes each tool as documented or reported as of October 2026; test on your own data before treating any of it as settled.
- Detection method: Privacy Filter is a learned token-classification model. Presidio combines rules and checksums with a named-entity model. Maskflare is deterministic for identifiers (patterns, checksums, context keywords and word lists), with a local named-entity layer for names and free text.
- Coverage: Privacy Filter reports eight broad categories. Presidio ships dozens of recognizers and you add your own. Maskflare ships 574 detectors, including country-specific national IDs, tax and bank identifiers across 47 country packs, and 232 secret formats.
- Names: learned approaches do well on unusual names in free text, which is why Maskflare adds a local named-entity layer to its word lists and context rules. Test names from your own data on every candidate.
- Restoring originals: Privacy Filter leaves it to you. Presidio can decrypt values encrypted with its operator. Maskflare restores tokens in answers, including while streaming, and tokens resolve for 30 days.
- Provider integration: Privacy Filter and Presidio see only the text you pass them, so you parse each provider's request format yourself. A gateway reads the whole request body for nine providers, including tool calls, embeddings and batch files.
- Determinism and explainability: rules give the same answer every time and can show which rule matched and why. Model outputs can shift between versions and are harder to explain to an auditor.
- Where data goes: Privacy Filter and Presidio stay entirely inside your environment. A hosted gateway processes requests outside it, in Maskflare's case in the EU by default, and logs metadata and counts only.
- Cost of ownership: Privacy Filter costs inference hardware and model upgrades. Presidio costs integration, tuning and hosting time. A managed gateway costs a subscription and policy work.
What each approach asks a team to own
Running Privacy Filter well means owning inference hosting, model version upgrades, latency in the request path, and everything around detection: placeholders, a vault for originals, restoring in streams, and an audit trail. Running Presidio well means owning detector configuration, custom recognizers for organization-specific identifiers, and an ongoing process for tuning false positives and false negatives against real traffic. A managed gateway shifts the detection engine and the provider plumbing to the vendor. What a team owns instead is policy: which data types to mask, which actions to apply, and which environments a rule covers.
- Privacy Filter: self-hosted inference, model updates, and the restore and policy layers
- Presidio: detector configuration, custom recognizers, provider parsing and ongoing tuning
- Managed gateway: policy configuration, with detection, streaming and restoring handled by the vendor
Which one fits which team
Choose Privacy Filter if you already run open-weight inference, your data is mostly free text in the categories it covers, and you're prepared to build restoring and policy around it. Choose Presidio if you want a free, configurable library, English names are your main risk, and you have the engineering time to integrate and tune it. Choose a managed gateway if you need many countries' structured identifiers and secrets covered, values restored in streamed answers, the same rules across apps, employees and coding agents, and audit evidence without running another service.
- Strict no-external-processing rule: Privacy Filter or Presidio, or an on-premises gateway
- Prototype or batch job on English text: Presidio
- Long free-text documents, team already hosts models: Privacy Filter
- Production chat, RAG and tool calls across several providers: a managed gateway
Where these approaches tend to get combined, not chosen exclusively
In practice, teams often start with Presidio for a proof of concept, since it's free and self-hostable, then move part or all of a workflow to a managed gateway once the redaction path needs production guarantees: regional processing, restoring in streamed answers, audit-safe logging, and rules that other teams can review. Privacy Filter appeals to teams already running open-weight infrastructure who would rather keep detection in the same stack, and it can sit next to a rule-based engine as a second opinion on free text.
Comparative accuracy between the three depends on implementation and dataset. The fairest test is your own traffic: run the same few hundred realistic prompts through each and count, per data type, what each one misses and what each one over-masks. Any benchmark Maskflare publishes will use a representative, disclosed corpus rather than a vendor-selected one.
Related PII guidance
Frequently asked questions
What is OpenAI Privacy Filter?
An open-weight model OpenAI released in April 2026 under the Apache 2.0 license that detects and redacts personal data in text. It runs on your own hardware, labels eight broad categories in one pass, and can be fine-tuned. It doesn't restore original values.
Is Presidio good enough for production use on its own?
It can be, for teams willing to own ongoing tuning and integration work. Many production deployments pair Presidio-style detection with additional policy, streaming, logging and deployment infrastructure built around it.
Does using a managed gateway mean giving up control over detection logic?
No. Policy, meaning what gets masked, redacted or blocked and in which environments, stays yours to configure, including custom rules for your own identifiers. What moves to the vendor is maintaining the detection engine and the provider integrations.
Which is most accurate?
It depends on your data. Learned models tend to do better on unusual names in free text; rule-based engines with checksums do better on structured identifiers such as IBANs, national IDs and secrets. Test all candidates on the same representative data, per data type.
Can these approaches run alongside each other?
Yes. It's common to prototype with an open-source tool and later route production traffic through a managed layer, or to keep both for different workflows with different operational requirements.