PII redaction
Which personal data Sentinel detects, and how it is redacted before the prompt is sent
The SUPERWISE® Sentinel PII redaction guardrail finds personal data in a prompt, such as emails, phone numbers, and government and financial IDs, and replaces each value with a placeholder before the prompt goes to the model provider. The request still proceeds, and the third-party model never sees the personal data. This is also called PII masking: each value is masked with a placeholder, so the prompt keeps its meaning.
Action: By default this guardrail remediates: each matched value is replaced with the guardrail's replacement text, REDACTED by default, which appears in the prompt as {{REDACTED}}. You can change the replacement text, or switch the guardrail to block matching requests instead. You can also narrow the scan to specific categories per Sentinel. See Manage guardrails.
For the use case in brief, see LLM gateway with PII redaction on superwise.ai.
What does PII redaction detect?
The guardrail covers a broad set of identifiers:
| Group | Categories |
|---|---|
| Contact | Email addresses, US and international phone numbers, with or without a country code, such as +1 415 555 0134 or (415) 555-0134 |
| Government IDs | US Social Security numbers (SSN), passport numbers, driver's licenses, tax IDs / EINs, national IDs |
| Financial | Credit card numbers (Visa, Mastercard, Amex, Discover), IBANs, bank account numbers |
| Network & device | IPv4 and IPv6 addresses, MAC addresses |
| Vehicle | Vehicle Identification Numbers (VIN) |
| Medical | Dates of birth, medical record numbers (MRN) |
Several of these (passport number, driver's license, tax ID, national ID, bank account number, VIN, date of birth, medical record number) are detected from a keyword plus the identifier, for example MRN: A1B2C3, so the matcher keys off the surrounding label. Since Sentinel 1.37.0, those labels are matched as whole words, which reduces false positives.
What does PII redaction not detect?
- Names, street addresses, other dates, and unlabeled record numbers. Names and most dates still reach the model.
- Bank routing numbers. They are not in the list above.
- Labeled types without their label. For the keyword-based types, the label has to sit next to the value. A column header in a pasted table does not count as a label, so values in the rows below it pass through.
To keep these out of prompts, pair Sentinel with a written rule and placeholders such as [CLIENT] or [ACCOUNT].
Example interception
Inbound prompt from application:
"Please draft a follow-up email to our customer John Smith ([email protected], phone 415-555-0132) regarding his recent invoice sent to credit card number 4532-1234-5678-9010."What the upstream LLM actually sees:
"Please draft a follow-up email to our customer John Smith ({{REDACTED}}, phone {{REDACTED}}) regarding his recent invoice sent to credit card number {{REDACTED}}."The customer name is left intact: the guardrail matches structured identifiers like those listed above, not free-text names.
See also
- Secret & credential detection: keep API keys and tokens out of prompts.
- Rudeness & toxicity: catch hostile language.
- Manage guardrails: choose which identifier types to catch.
Updated 6 days ago