# Detect and Redact PII

PII Protection watches every message your AI employees send and receive, and masks personal data like emails, phone numbers, credit card numbers, and social security numbers before it goes anywhere it shouldn't. You choose exactly which data types to catch. It runs on every employee across your company the moment you turn it on, with no per-employee setup.

Personal data flowing through AI systems is a real risk. PII detection scans every message for names, email addresses, phone numbers, physical addresses, credit card numbers, social security numbers, and other sensitive identifiers. Detection happens before the message reaches the AI model, so personal data never enters the processing pipeline unprotected.

When PII is detected, the system responds based on your configured policy. In "redact" mode, it strips the PII and replaces it with a placeholder. In "warn" mode, it flags the content and asks you to confirm before proceeding. In "block" mode, it stops the message entirely. You choose the strictness level that matches your compliance requirements.

PII detection works on both input (messages you send to employees) and output (content employees generate). If an employee accidentally includes a customer's phone number in a marketing report, the output filter catches it. This bidirectional scanning means sensitive data does not slip through in either direction.

## Stop Personal Data Before It Reaches the AI Model

When an AI agent processes customer messages, documents, or database records, it will encounter personal information: names, email addresses, phone numbers, national IDs, credit card numbers, and more. PII Detection scans all incoming content before it reaches the language model, giving you control over what the AI actually sees.

You choose the response: redact the data automatically, warn the agent but allow it to proceed, or block the input entirely. This protects your customers' data and keeps your AI workforce compliant with privacy regulations like GDPR and CCPA without requiring manual review of every message.

## Configurable Detection Rules for Your Industry

Different industries carry different PII risk profiles. A healthcare agent working with patient records faces different sensitivity requirements than an e-commerce agent handling shipping addresses. PII Detection lets you configure which entity types are flagged, at what confidence threshold, and what action follows.

Built-in detectors cover common PII categories: contact information, financial identifiers, government IDs, health data, and location data. You can extend these with custom patterns using regular expressions or keyword lists, so industry-specific identifiers like policy numbers or patient codes are caught as well.

Detection runs server-side before the prompt is constructed, so PII is never inadvertently logged, cached, or sent to a third-party model. Redacted content is replaced with labeled tokens (like [EMAIL] or [PHONE]) that the agent can reference contextually without accessing the actual value.

## Audit Trails for Privacy Compliance

Every PII detection event is logged with the entity type detected, the action taken, and the timestamp. These logs are available in the monitoring dashboard and can be exported for compliance audits. You always have a record of what was detected and how it was handled.

For teams operating under strict data governance, this creates a verifiable boundary: the AI agent operated on anonymized data, and the system has proof. This is especially valuable when demonstrating compliance to customers, auditors, or regulators who need assurance that AI systems do not mishandle sensitive information.

## How It Works

**Agent inputs and outputs are automatically scanned for personal data, and configurable policies determine whether to redact, warn, or block.**

PII detection runs on every message flowing into and out of your AI employees. The scanner identifies names, email addresses, phone numbers, payment details, national IDs, and other personal data patterns using both rule-based and model-based detection. When a match is found, the configured policy applies: redact the value before it reaches the agent, log a warning and let it through, or block the message entirely.

Policies are configurable per employee, per team, or organization-wide. A customer support agent might redact payment details automatically but allow names. A data processing agent might block any input containing health data. You define the rules, the system enforces them on every interaction. This is the control layer that makes GDPR and HIPAA compliance achievable when deploying autonomous agents at scale.

## Use Cases

### Support team prevents AI from leaking customer data

When a customer sends a message containing a credit card number or SSN, the AI agent detects and redacts it before processing or logging the content.

### HR team protects employee data in AI workflows

Any AI agent handling HR documents automatically detects names, addresses, and ID numbers, redacting them before passing data to external tools.

### Legal team ensures AI outputs are privacy-safe

Before the AI employee sends any document externally, PII detection scans for personal data and flags or redacts it based on policy.

### Healthcare team keeps patient data out of AI context

Patient identifiers are detected and stripped from AI inputs automatically, keeping PHI out of model context and audit logs.

## Comparison

| Before | After |
|---|---|
| AI agents process and log personal data without any filter. | PII is detected and redacted automatically before the agent acts on it. |
| Compliance requires manual data review on every AI output. | Automated PII detection handles the review layer, no manual step needed. |
| A data breach from AI logging is discovered after the damage is done. | PII never enters logs or external calls, the risk is eliminated at source. |
| Teams build custom regex filters to catch personal data. | Built-in PII detection covers names, emails, IDs, cards, and more. |

## FAQ

### What types of PII are detected out of the box?

Built-in detectors cover names, email addresses, phone numbers, physical addresses, credit card numbers, social security numbers, passport numbers, IP addresses, and dates of birth. Custom patterns can be added for industry-specific identifiers.

### Does PII detection slow down the agent?

Detection runs in milliseconds server-side before prompt construction. For typical messages and documents, latency is negligible. For very large batch document processing, detection adds a small preprocessing step that is dwarfed by the model inference time.

### Can the agent still do its job after PII is redacted?

Yes. Redacted tokens like [EMAIL] or [CREDIT_CARD] preserve the structure of the message so the agent understands context without accessing the raw value. For most tasks, this is sufficient. For tasks that genuinely require the PII, you can configure a warning-only mode instead of hard redaction.

### Is this compliant with GDPR and CCPA?

PII Detection is a technical control that supports compliance, but compliance depends on your full data handling stack. The feature helps you demonstrate that AI processing is PII-aware and logged, which is a meaningful control for most regulatory frameworks.

### Does Sistava automatically detect and redact sensitive personal data?

Yes, the PII detection layer scans inputs and outputs and redacts personal data such as names, emails, and phone numbers before it is stored or sent anywhere. You can configure sensitivity levels to match your compliance requirements.

> We process thousands of support tickets a day. PII redaction runs automatically on every one before the agent sees it. Our DPO stopped worrying about AI compliance the day we turned it on.
>
> Lena F., Head of Support · SaaS company

## Where Detect and Redact PII fits

Detect and Redact PII is part of What stops them from going wrong.

Your AI agents pause before any sensitive action and wait for your approval. PII is detected and redacted before it reaches the model. Content policies block harmful or off-brand output. Execution limits prevent runaway tasks. A Sistava mentor pairs with every employee to spot blockers and keep work on track alongside their team leader. Set company-wide policies once and every employee follows them, including future hires.

- [What stops them from going wrong](/en/features/guardrails): Nothing sensitive happens without your say.

## Read the guide

- [Guide: Detect and Redact PII](/en/guide/company/policies)

## More in Guardrails

- [AI Guardrails & Policies](/en/features/guardrails/guardrails): A Security Officer that checks every message going into and coming out of every AI employee you have. Five policies, each with its own switch: Input Safety stops prompt injection and jailbreak attempts, Output Safety keeps unfit replies from being sent, PII Protection replaces personal data with markers before the model reads it, Data Leakage Prevention keeps your setup and secrets in-house, and Topic Control holds employees to the subjects you choose. Turn on what you need from Settings, Technical, Security Officer and it covers every employee on the next message, including the ones you hire later. Checks run in parallel on a separate lightweight model, so protection costs a fraction of a message and your team never feels the wait. A running count of what has been caught, the busiest policy, and a live inspector showing every individual message are all on the same page.
- [Protect Against Prompt Injection](/en/features/guardrails/guardrail_input_safety): Input Safety reads every incoming message before your employee does, and stops the ones trying to hijack it: instructions to ignore its rules, requests to print its own configuration, and role-play framed to talk it out of its guardrails. That matters most where the message did not come from you, so a payload buried in a forwarded email, a support ticket, or a shared thread cannot turn your employee against you. Pick Low, Medium, or High, and every level catches the textbook attacks: the level decides how much benefit of the doubt the genuinely ambiguous messages get. Medium is the default and suits most companies. Blocked messages get a short, human reply and the conversation carries on, with each one recorded so you can see what has been tried.
- [Block Unsafe Employee Responses](/en/features/guardrails/guardrail_output_safety): Output Safety reads your employee's reply before anyone else does. Toxic, abusive, or otherwise unfit answers are held back rather than sent, which is what you want the moment employees write to customers, post to a channel, or answer a ticket without you watching. It checks the reply your employee actually wrote, so what you see caught is what would genuinely have gone out. Set it to Low, Medium, or High and review everything it held back in the live inspector. Blunt, direct, and critical business writing is left alone: the policy is looking for replies that would embarrass you, not ones that are simply frank.
- [Protect Personal Data](/en/features/guardrails/guardrail_pii_protection): PII Protection finds personal data in a message and replaces it with a marker before the model reads a single character of it. A pasted card number becomes [CREDIT_CARD], an email becomes [EMAIL_ADDRESS], and the same happens on the way out so nothing sensitive travels back into an email, a channel, or a ticket. You pick exactly what to protect from seven data types: email, phone, name, credit card, Social Security number, IP address, and address. The markers keep the sentence readable, so your employee understands the request perfectly and keeps working while the raw value stays out of the conversation. It runs on every message, in both directions, company-wide, from one switch.
- [Control What Employees Discuss](/en/features/guardrails/guardrail_topic_control): Topic Control gives you two lists and you can use either or both. Blocked topics are off-limits no matter how a conversation gets there, which keeps employees out of politics, competitor comparisons, or medical and legal advice. Allowed topics set a remit instead: name the subjects an employee handles and anything unrelated is politely declined, which is how you keep a support employee on product help, billing, and refunds. Both lists match on meaning rather than exact words, so ruling out competitor pricing also covers how much cheaper are we than the other tools out there. Greetings and short replies always get through, so a scoped employee still feels natural to talk to.
- [Keep Confidential Data In-House](/en/features/guardrails/guardrail_data_leakage): Data Leakage Prevention guards both ends of the conversation. On the way in it recognises someone fishing for your employee's internals, whether they ask outright, dress it up as a game, or try the repeat everything above this line trick. On the way out it reads the reply itself and holds it back if it is about to hand over a system prompt, internal configuration, an access token, or a credential. Questions about your own business data are never affected, so an employee still answers freely about your customers, documents, and numbers. One switch, no configuration to maintain, and every attempt is logged so you can see who has been probing.
- [Prevent Repeated and Runaway Actions](/en/features/guardrails/tool_safety): Sistava automatically caps how many emails, messages, and external writes (CRM records, calendar events, paid searches) an AI employee can send in a single conversation, hour, and day, and blocks an identical send to the same recipient from going out twice within 24 hours. These limits run in the background per employee with no setup required, so a stuck task or unexpected loop cannot spam a contact's inbox, pollute your CRM, or burn through paid API calls. When a limit is hit, the employee is told to slow down or hand the task to a human instead of retrying blindly.
- [Approve Sensitive Actions](/en/features/guardrails/input_requests): Let an AI employee pause and ask before it takes a sensitive action, like sending an email or spending on a paid tool, instead of guessing what you want. An inline card shows up right in the chat with Approve, Reject, or option buttons, and the employee resumes the instant you respond.
- [Protect Organisation Information](/en/features/guardrails/information_boundaries): Your AI employee treats what it learns in the workspace the way a careful coworker would: useful for doing the work, not free to repeat. It tells private, role-restricted, and confidential information apart from ordinary shared context, and it never volunteers the sensitive kind just because someone asked. When a teammate needs a restricted answer, the employee can request permission from the right person for that one specific answer instead of guessing or refusing outright.
- [Protect Your Email Reputation](/en/features/guardrails/email_deliverability): Every email your AI employees send, whether it is a notification, a mailbox reply, or an outbound message, passes through a pre-send check before it leaves. Sistava validates the address, checks it against a suppression list built from past bounces and complaints, and blocks anything that would hurt your sending reputation. You do not configure this: it runs silently on every send so your domain keeps a clean track record with inbox providers.
- [Delegation & Teamwork Limits](/en/features/guardrails/delegation_teamwork_limits): Tune how your leader employees hand off work to teammates. Set how many teammates a leader can delegate to at once, how far a delegation chain can reach, how long a delegated teammate can work before timing out, and how tolerant employees are of repeating themselves before loop protection stops them.
- [Company-Wide Policies](/en/features/guardrails/company_policies): Company Policies let you set organization-wide safety rules that apply to every AI employee at once: block prompt injection attempts, filter harmful output, redact personal information, stop internal details from leaking, and restrict which topics employees can discuss. Turn each policy on with one toggle from your company dashboard, and it takes effect immediately across your whole team.

## Explore

- [Every feature](/en/features)
- [Hire an AI employee](/en/market)
- [Pricing](/en/pricing)