Skip to main content

Redact Personal Data Before the Model Call

The pii-detector control finds personal identifiers, such as email addresses, Social Security numbers, and card numbers. It replaces them before the model gets the request. For example, My SSN is 123-45-6789 goes to the model as My SSN is [REDACTED:SSN]. PII Detector gives the full field reference.

Select the action​

actionResult for a match in the request
redactThe gateway replaces the match and sends the request. This value is the default.
blockThe gateway rejects the request with HTTP 400 and the error code content_policy_violation.

Response redaction runs with each value. On Chat Completions, Responses, and Messages, the control also redacts the model response.

Add the control​

Put this file in a new test directory:

policy-config.yaml
pack:
  name: pii-protection
  version: 1.0.0
  enabled: true
policies:
  chain:
    - pii-detector
policy:
  pii-detector:
    action: redact
    healthcare_mode: false
    pci_mode: true
    detect_patterns: []
    redaction:
      marker_format: label
      include_metadata: true
      preserve_length: false
      custom_markers: {}

pci_mode: true adds payment card numbers, CVV or CVC values, and expiration dates. healthcare_mode: true adds HIPAA identifiers, such as names, addresses, and medical record numbers.

Test the control without a provider​

Add test cases to the testing section of the file. Then run:

verdictan policy lint --file policy-config.yaml
verdictan policy test --json

A redacted request has the overall reason redact.applied. The nested policy_results entry names the match, such as pii.ssn_detected.

A verdict does not show the forwarded text. To see the replacement, send a synthetic identifier through a test gateway. Then examine the redaction result.

Know the limits​

  • The detectors are regular expressions and validators, not a model. Numbers such as order IDs can match by mistake, and unusual formats can stay unchanged.
  • The reason code names only the first match. Use detection_count and the redaction metadata for the other matches.
  • The control ignores a detect_patterns entry with incorrect syntax and gives no error. Lint the pack and test each pattern.
  • With stream: true, the client gets no tokens until the provider has finished, because the gateway redacts the full text first.

Next steps​

  • PII Detector: each field, the detection coverage, and the response headers.
  • DLP Filter: secrets and confidential patterns that are not personal identifiers.
  • Data Routing Policy: keep regulated data on approved provider targets.