# Protect Personal Data

PII Protection finds personal data in a message and replaces it with a marker before the model reads a single character of it. A pasted card number becomes [CREDIT_CARD], an email becomes [EMAIL_ADDRESS], and the same happens on the way out so nothing sensitive travels back into an email, a channel, or a ticket. You pick exactly what to protect from seven data types: email, phone, name, credit card, Social Security number, IP address, and address. The markers keep the sentence readable, so your employee understands the request perfectly and keeps working while the raw value stays out of the conversation. It runs on every message, in both directions, company-wide, from one switch.

PII protection watches every message that moves through your AI employees and redacts personal data on the fly. Email addresses, phone numbers, credit card numbers, and other identifiers are caught in the stream, before they spread into places they should not be.

Conversations are where sensitive data leaks happen casually: a customer pastes their card number into chat, a colleague forwards a thread full of personal details. The guardrail treats every channel, every message, every direction as a checkpoint.

PII Protection is not the same guardrail as Data Leakage Prevention, the card sitting right next to it on the Policies tab. Data Leakage stops an employee from revealing your system prompt, internal configuration, or tenant IDs: your secrets. PII Protection stops a customer's own email, phone number, or card number from moving unmasked through the conversation: their data. The two run independently, so you can enable either one, or both, depending on which direction you are trying to protect.

## Personal Data Caught in the Flow of Conversation

Policies and training do not stop a customer from typing their credit card into a chat window. PII protection assumes sensitive data will show up in live traffic and handles it at the message level, the moment it appears, on chat, email, Slack, voice, and every other channel.

Each message is scanned in both directions, inbound before the employee processes it and outbound before a reply is delivered, so personal data neither enters the system unprotected nor escapes it unnoticed.

## Redaction That Keeps Conversations Useful

Crude filters break workflows by deleting the very messages people need answered. The guardrail replaces detected values with structural placeholders instead, so the employee knows an email address or card number was present and continues the task without holding the raw value.

The customer experience stays smooth. People write naturally, the conversation proceeds, and the protection works silently underneath rather than bouncing messages back with errors.

## Seven Data Types, Two Checked by Default

The policy recognizes seven identifier types: Email, Phone, Name, Credit Card, Social Security Number, IP Address, and Address. When you first turn PII Protection on, Credit Card and Social Security Number come pre-checked; the other five are opt-in, one click each, on the Policies tab.

You do not choose which conversations get scanned; the entity list is the only knob. Whatever set of tags is checked applies company-wide, to every employee, on every message, immediately, with no per-employee or per-team override. If your employees handle customer support or sales, add Email and Phone; if you operate under stricter privacy requirements, add Name and Address too.

Redaction sits alongside two sibling policies on the same tab, Input Safety and Output Safety, which run at a chosen sensitivity (Low, Medium, High) to catch prompt injection and toxic replies. PII Protection has no sensitivity dial. It is a straight detect-and-mask on whatever entities you selected, nothing softer or stricter to tune.

## Detections Show Up as a Live Breakdown

The PII Protection card shows a running blocked count next to its toggle, plus a bar chart breaking detections down by entity type once anything has been caught, so you can see at a glance whether it is mostly emails, phone numbers, or something else. A recent-activity list under the chart names the last few detections with a timestamp and which employee's conversation triggered them.

Click Inspect at the top of the Policies tab to open the full guardrails activity log, filterable to the last 7 days, last 30 days, or all time. This is the same activity feed the other four policies feed into, so you can see PII detections in context with input-safety, output-safety, topic-control, and data-leakage events from the same period.

PII Protection is gated to the Founder plan and above; Starter and Builder tenants do not see the Policies tab at all. Detection runs on a small, fast model kept separate from the model your employees use for actual work, so the per-message cost is minimal, and if none of the five policies on the tab are enabled, no guardrail model call happens at all.

## Fewer Places for Sensitive Data to Live

Every system that stores a copy of personal data is a liability you have to manage. By redacting identifiers in transit, the guardrail keeps them out of conversation history, memory, and tool calls, shrinking your sensitive data footprint instead of growing it.

When privacy questions come from customers, auditors, or your own legal team, you have a concrete answer: personal data is detected and redacted in the message stream by default, on every channel, for every employee.

## How It Works

**Every message is scanned and personal data redacted, in both directions, on every channel.**

As messages flow in and out of your employees, the guardrail scans them for personal data patterns: emails, phone numbers, card numbers, and other identifiers. Detected values are replaced with structural placeholders before the message is processed or delivered.

Because redaction happens in transit, the raw values never reach conversation history, memory, or tool calls. The employee keeps the meaning it needs to do the work, and your sensitive data footprint shrinks instead of growing with every conversation.

## Use Cases

### Support chat catches a pasted card number

A customer types their card into the chat and it is redacted before the employee or any log ever holds it.

### Forwarded threads get sanitized

A colleague forwards a thread full of personal details and the identifiers are stripped on the way in.

### Outbound replies stay clean

An employee drafting a reply cannot accidentally include a customer's phone number in the message that ships.

### Privacy reviews get a clear answer

When legal asks how personal data is handled, the answer is automatic redaction on every channel by default.

## Comparison

| Before | After |
|---|---|
| Customers paste sensitive data into chat and it is stored. | It is redacted in the stream before anything keeps it. |
| Personal data spreads into logs, memory, and tools. | Raw identifiers never leave the message they arrived in. |
| Crude filters bounce messages and break workflows. | Placeholders keep conversations flowing while hiding the value. |
| Every channel is a separate privacy gap. | One layer covers chat, email, Slack, and voice. |

## FAQ

### What kinds of personal data does the guardrail catch?

Seven entity types: Email, Phone, Name, Credit Card, Social Security Number, IP Address, and Address. Credit Card and SSN are checked by default the first time you turn the policy on; the other five are opt-in tags you click to add on the Policies tab.

### Does PII protection work on every channel?

Yes. The same message-level scanning applies in web chat, email, Slack, voice, and any other channel your employees use.

### Will redaction confuse the AI employee mid-conversation?

No. Detected values are replaced with placeholders that preserve the meaning of the message, so the employee can keep working without the raw data.

### Does redacted data end up in logs or memory?

No. Redaction happens in the message stream, which keeps raw personal data out of conversation history, memory, and downstream tool calls.

### How is this different from Data Leakage Prevention?

PII Protection guards your customer's personal data going in and out. Data Leakage Prevention guards your own system prompt, internal configuration, and tenant details from being revealed. They are separate toggles on the same Policies tab and can be run together.

### What happens if the guardrail check itself fails or times out?

Outbound checks fail open by default: the reply still reaches the user rather than getting stuck, since it is your own model's text and blocking it only hurts the customer during an outage. The failure is logged and alerted so the gap gets fixed, not silently repeated.

### Can I turn on PII Protection for just one employee or team?

No. It is a single company-wide toggle on the Policies tab. Enabling it protects every employee's conversations; there is no per-employee or per-team scoping.

## Where Protect Personal Data fits

Protect Personal Data is part of What stops them from going wrong.

Your AI agents pause before any sensitive action and wait for your approval. PII is detected and redacted before it reaches the model. Content policies block harmful or off-brand output. Execution limits prevent runaway tasks. A Sistava mentor pairs with every employee to spot blockers and keep work on track alongside their team leader. Set company-wide policies once and every employee follows them, including future hires.

- [What stops them from going wrong](/en/features/guardrails): Nothing sensitive happens without your say.

## Read the guide

- [Guide: Protect Personal Data](/en/guide/company/policies)

## More in Guardrails

- [AI Guardrails & Policies](/en/features/guardrails/guardrails): A Security Officer that checks every message going into and coming out of every AI employee you have. Five policies, each with its own switch: Input Safety stops prompt injection and jailbreak attempts, Output Safety keeps unfit replies from being sent, PII Protection replaces personal data with markers before the model reads it, Data Leakage Prevention keeps your setup and secrets in-house, and Topic Control holds employees to the subjects you choose. Turn on what you need from Settings, Technical, Security Officer and it covers every employee on the next message, including the ones you hire later. Checks run in parallel on a separate lightweight model, so protection costs a fraction of a message and your team never feels the wait. A running count of what has been caught, the busiest policy, and a live inspector showing every individual message are all on the same page.
- [Protect Against Prompt Injection](/en/features/guardrails/guardrail_input_safety): Input Safety reads every incoming message before your employee does, and stops the ones trying to hijack it: instructions to ignore its rules, requests to print its own configuration, and role-play framed to talk it out of its guardrails. That matters most where the message did not come from you, so a payload buried in a forwarded email, a support ticket, or a shared thread cannot turn your employee against you. Pick Low, Medium, or High, and every level catches the textbook attacks: the level decides how much benefit of the doubt the genuinely ambiguous messages get. Medium is the default and suits most companies. Blocked messages get a short, human reply and the conversation carries on, with each one recorded so you can see what has been tried.
- [Block Unsafe Employee Responses](/en/features/guardrails/guardrail_output_safety): Output Safety reads your employee's reply before anyone else does. Toxic, abusive, or otherwise unfit answers are held back rather than sent, which is what you want the moment employees write to customers, post to a channel, or answer a ticket without you watching. It checks the reply your employee actually wrote, so what you see caught is what would genuinely have gone out. Set it to Low, Medium, or High and review everything it held back in the live inspector. Blunt, direct, and critical business writing is left alone: the policy is looking for replies that would embarrass you, not ones that are simply frank.
- [Control What Employees Discuss](/en/features/guardrails/guardrail_topic_control): Topic Control gives you two lists and you can use either or both. Blocked topics are off-limits no matter how a conversation gets there, which keeps employees out of politics, competitor comparisons, or medical and legal advice. Allowed topics set a remit instead: name the subjects an employee handles and anything unrelated is politely declined, which is how you keep a support employee on product help, billing, and refunds. Both lists match on meaning rather than exact words, so ruling out competitor pricing also covers how much cheaper are we than the other tools out there. Greetings and short replies always get through, so a scoped employee still feels natural to talk to.
- [Keep Confidential Data In-House](/en/features/guardrails/guardrail_data_leakage): Data Leakage Prevention guards both ends of the conversation. On the way in it recognises someone fishing for your employee's internals, whether they ask outright, dress it up as a game, or try the repeat everything above this line trick. On the way out it reads the reply itself and holds it back if it is about to hand over a system prompt, internal configuration, an access token, or a credential. Questions about your own business data are never affected, so an employee still answers freely about your customers, documents, and numbers. One switch, no configuration to maintain, and every attempt is logged so you can see who has been probing.
- [Prevent Repeated and Runaway Actions](/en/features/guardrails/tool_safety): Sistava automatically caps how many emails, messages, and external writes (CRM records, calendar events, paid searches) an AI employee can send in a single conversation, hour, and day, and blocks an identical send to the same recipient from going out twice within 24 hours. These limits run in the background per employee with no setup required, so a stuck task or unexpected loop cannot spam a contact's inbox, pollute your CRM, or burn through paid API calls. When a limit is hit, the employee is told to slow down or hand the task to a human instead of retrying blindly.
- [Approve Sensitive Actions](/en/features/guardrails/input_requests): Let an AI employee pause and ask before it takes a sensitive action, like sending an email or spending on a paid tool, instead of guessing what you want. An inline card shows up right in the chat with Approve, Reject, or option buttons, and the employee resumes the instant you respond.
- [Protect Organisation Information](/en/features/guardrails/information_boundaries): Your AI employee treats what it learns in the workspace the way a careful coworker would: useful for doing the work, not free to repeat. It tells private, role-restricted, and confidential information apart from ordinary shared context, and it never volunteers the sensitive kind just because someone asked. When a teammate needs a restricted answer, the employee can request permission from the right person for that one specific answer instead of guessing or refusing outright.
- [Protect Your Email Reputation](/en/features/guardrails/email_deliverability): Every email your AI employees send, whether it is a notification, a mailbox reply, or an outbound message, passes through a pre-send check before it leaves. Sistava validates the address, checks it against a suppression list built from past bounces and complaints, and blocks anything that would hurt your sending reputation. You do not configure this: it runs silently on every send so your domain keeps a clean track record with inbox providers.
- [Delegation & Teamwork Limits](/en/features/guardrails/delegation_teamwork_limits): Tune how your leader employees hand off work to teammates. Set how many teammates a leader can delegate to at once, how far a delegation chain can reach, how long a delegated teammate can work before timing out, and how tolerant employees are of repeating themselves before loop protection stops them.
- [Detect and Redact PII](/en/features/guardrails/pii_detection): PII Protection watches every message your AI employees send and receive, and masks personal data like emails, phone numbers, credit card numbers, and social security numbers before it goes anywhere it shouldn't. You choose exactly which data types to catch. It runs on every employee across your company the moment you turn it on, with no per-employee setup.
- [Company-Wide Policies](/en/features/guardrails/company_policies): Company Policies let you set organization-wide safety rules that apply to every AI employee at once: block prompt injection attempts, filter harmful output, redact personal information, stop internal details from leaking, and restrict which topics employees can discuss. Turn each policy on with one toggle from your company dashboard, and it takes effect immediately across your whole team.

## Explore

- [Every feature](/en/features)
- [Hire an AI employee](/en/market)
- [Pricing](/en/pricing)