Keeping PII Out of AI Prompts Without Breaking the Feature
Sending a user's personal data straight into a prompt is the fastest way to build an AI feature that fails a compliance review. The fix doesn't have to compromise what the feature does — it just has to happen in the right order.
Mask before the prompt, unmask after
The pattern that holds up well is a sanitization step that detects and replaces personal data — names, emails, phone numbers, ID numbers — with placeholder tokens before the text ever reaches the model, then substitutes the real values back into the response afterward. The model reasons over the structure and content of the request without ever seeing the actual personal data, and the end user still gets a response with their real information in it.
Named entity recognition catches more than regex alone
Regex patterns handle structured data well — email formats, phone number formats, ID numbers with a known shape. They miss names, addresses, and other personal information that doesn't follow a fixed pattern. Combining regex for structured fields with a named-entity-recognition pass for unstructured personal information (open-source NER libraries handle this reasonably well) catches a much larger share of what actually needs to be masked than either approach alone.
Decide what counts as PII for your specific context before writing the pipeline
Not every use case has the same definition of sensitive data — healthcare and legal contexts have categories (medical conditions, case details) that a general-purpose PII detector won't flag by default. Defining the actual sensitive-data categories for the specific product before building the masking pipeline avoids a false sense of security from a generic off-the-shelf list that doesn't match the real risk.
This is infrastructure, not a one-time filter
Masking needs to run consistently on every request that touches the model, including edge cases like data embedded in file uploads or forwarded conversation history — not just the obvious top-level input field. Treating it as shared middleware that every AI-touching code path runs through, rather than a check added to one specific endpoint, is what keeps it from quietly having gaps six months later.