Skip to main content
Technical Deep Dive

How Data Redaction
Actually Works.

Every time someone pastes a customer email, a medical record, a credit card number, or an API key into ChatGPT, that data leaves their machine and enters a system they don't control. Data redaction stops it, catching specific patterns before they cross the network boundary. Here's how the detection works, pattern by pattern, across the four major categories: PII, PHI, PCI, and secrets.

Talk to Our TeamSee the Patterns
Quick Answer

Data redaction catches sensitive information, names, Social Security numbers, medical records, credit card numbers, API keys, and passwords, before it leaves your computer on its way to ChatGPT, Claude, or Copilot. It uses layered detection: regex patterns match structured formats like emails and credit cards, entropy analysis spots random-looking strings like API tokens, and contextual matching catches data that only becomes sensitive in context, like a diagnosis next to a patient name. Shield runs all three layers locally on your machine, so your data never reaches an external AI provider.

Pattern Categories

👤 Personally Identifiable Information

Any data that can identify a specific individual, the broadest category of sensitive data that must be caught before it leaves your network.

1

Email Address

Standard RFC 5322 email format. Detected via regex with domain validation. Common in support tickets, email transcripts, customer CRM entries, and form data pasted into prompts.

[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}
Raw Prompt
Please escalate this ticket from alex.chen@company.com, the customer hasn't received their order confirmation.
After Redaction
Please escalate this ticket from [EMAIL], the customer hasn't received their order confirmation.
Patterns Detected
alex.chen@company.com → [EMAIL]
2

Social Security Number

US SSN in XXX-XX-XXXX format, plus unformatted variants. Also catches ITIN (Individual Taxpayer Identification Number) patterns. One of the highest-risk PII types under GDPR, CCPA, and state breach notification laws.

\d{3}-\d{2}-\d{4} | \d{9} (Luhn-validated)
Raw Prompt
Employee record: Maria Santos, SSN 542-81-9032, hired 03/15/2023, department: Engineering.
After Redaction
Employee record: [NAME], SSN [SSN], hired [DATE], department: [DEPARTMENT].
Patterns Detected
542-81-9032 → [SSN]Maria Santos → [NAME]
3

Phone Number

North American (NANP) and international formats. Matches (XXX) XXX-XXXX, XXX-XXX-XXXX, +X-XXX-XXX-XXXX, and common international variants. Catches phone numbers embedded in support tickets, sales calls, and contact forms.

(\+?\d{1,3}[-.]?)?\(?\d{3}\)?[-.]?\d{3}[-.]?\d{4}
Raw Prompt
Call the client back at (312) 555-0198 or try his mobile +1-773-555-0142 if no answer.
After Redaction
Call the client back at [PHONE] or try his mobile [PHONE] if no answer.
Patterns Detected
(312) 555-0198 → [PHONE]+1-773-555-0142 → [PHONE]
4

Physical Address

Street addresses, PO boxes, and rural route numbers. Uses multi-line context matching, a street number followed by a street name, city, state, and ZIP. Catches addresses from CRM records, shipping labels, and legal documents pasted into prompts.

\d+\s+([A-Za-z]+\s*)+,\s*[A-Za-z]+\s*,\s*[A-Z]{2}\s+\d{5}
Raw Prompt
Ship replacement unit to: 742 Evergreen Terrace, Springfield, IL 62701, Attn: Shipping Dept.
After Redaction
Ship replacement unit to: [ADDRESS], Attn: [DEPARTMENT].
Patterns Detected
742 Evergreen Terrace, Springfield, IL 62701 → [ADDRESS]
5

Date of Birth

DOB in multiple formats: MM/DD/YYYY, DD-MM-YYYY, YYYY-MM-DD, and written forms like 'January 15, 1985'. Often paired with age indicators. Critical for age-restricted data handling under COPPA and GDPR.

(?:DOB|born|birth).{0,20}(?:\d{1,2}[/-]\d{1,2}[/-]\d{2,4}|(?:Jan|Feb|...)\w*\s+\d{1,2},?\s+\d{4})
Raw Prompt
Patient intake: James Wilson, DOB 09/14/1992, blood type O+, no known allergies.
After Redaction
Patient intake: [NAME], DOB [DATE], blood type [VALUE], no known allergies.
Patterns Detected
09/14/1992 → [DATE]James Wilson → [NAME]
Governing Frameworks
GDPR (EU)CCPA (California)CPRAPIPEDA (Canada)LGPD (Brazil)State Breach Notification Laws

Architecture

How Redaction Stops Data at the Network Boundary

Your Appprompt + secretsPII · PHI · PCI🛡️ Shield RedactionRegex → Entropy → Contextemail → [EMAIL] · SSN → [SSN]sk-... → [API_KEY] · PAN → [CC]clean prompt only🤖 AI ProviderChatGPT / ClaudeAI responserehydrate locallyresponse with original dataYour MachineExternal Internet

The redaction engine runs entirely on your machine, in the green boundary. Raw prompts containing names, SSNs, medical records, credit card numbers, and API keys arrive from your application. Shield identifies patterns using regex, entropy analysis, and contextual matching, then replaces each sensitive value with a typed placeholder ([EMAIL], [SSN], [API_KEY]). Only the cleaned prompt crosses the red boundary to the AI provider. When the response comes back, Shield can optionally rehydrate it, swapping placeholders back to original values, so you see a complete result, but the AI provider never had the real data.

Compliance

How Frameworks Map to Redaction Requirements

HIPAA
Scope: Protected Health Information, the 18 identifiers
Ensure confidentiality, integrity, and availability of all electronic PHI. Business Associate Agreements required for any vendor handling PHI.
How Shield helps: Redacts all 18 HIPAA identifier categories before prompts reach external AI providers. Because Shield runs locally, no Business Associate Agreement is needed, the AI provider never receives PHI.
PCI DSS v4.0
Scope: Cardholder data, PAN, CVV, track data, PINs
Protect stored cardholder data; encrypt transmission across open networks; never store CVV after authorization. Requirement 3.4 mandates rendering PAN unreadable.
How Shield helps: Detects and redacts PANs (credit card numbers) using Luhn validation, BIN range checking, and format detection. CVV codes are caught via proximity matching. No cardholder data reaches external AI providers.
GDPR
Scope: Personal data of EU/EEA residents
Lawful basis required for processing personal data; data minimization; purpose limitation. Cross-border data transfers restricted without adequate safeguards.
How Shield helps: Prevents personal data from leaving the local network boundary during AI interactions. Data minimization is enforced automatically, only cleaned prompts reach external processors, satisfying the 'least data necessary' principle.
SOC 2
Scope: Security, availability, and confidentiality controls
Service organizations must implement controls protecting customer data. TSC criteria include logical access controls, data confidentiality, and system monitoring.
How Shield helps: Acts as a technical control for the confidentiality trust service criterion. Customer data in AI prompts is redacted locally, providing verifiable evidence that sensitive data is not transmitted to external services during AI usage.

FAQ

Common Questions

You can, for simple patterns. Regex catches structured data like email addresses and credit card numbers reliably. But it misses context-dependent PII: names that look like regular words ('April', 'Grace'), addresses written in prose ('the office on Michigan Ave'), and clinical terms that are PHI only when paired with a patient identifier. Shield layers regex, entropy detection, named entity recognition, and contextual pattern matching on top of each other. Regex is the first pass, not the only pass.
PII (Personally Identifiable Information) is the broadest category, any data that can identify an individual: names, emails, SSNs, phone numbers, IP addresses. PHI (Protected Health Information) is a subset defined by HIPAA, any health-related data that can be linked to an individual, including the 18 HIPAA identifiers like medical record numbers, diagnosis codes, and device serial numbers. PCI (Payment Card Industry) data is specifically credit card numbers, CVV codes, and payment authentication data. A single piece of data can fall into multiple categories: a patient's credit card number is both PCI and PHI.
It shouldn't, when done right. Shield uses contextual replacement: an email becomes [EMAIL], a name becomes [NAME], a medical record number becomes [MRN]. The AI can still understand the structure of the request and provide relevant answers about the pattern of the data, not the specific person it belongs to. For use cases where you need the real data in the response (like personalized reports), Shield rehydrates the response locally, replacing placeholders with original values on your machine, after the AI has processed the request.
Entropy analysis. API keys, tokens, and passwords have high Shannon entropy. They look random in a way that natural language doesn't. Shield computes entropy on sliding windows of text. When a substring has entropy above a configured threshold and doesn't match known safe patterns (like base64-encoded images or UUIDs), it's flagged. This catches custom API keys, auto-generated passwords, and proprietary token formats, not just the ones with known prefixes like sk- or ghp_.
Yes. Regex patterns for structured data formats (phone numbers, SSNs, credit card numbers, email addresses) are language-independent. For named entity recognition, Shield's patterns include common name structures from multiple languages and writing systems. Address formats are matched against international conventions, not just US street addresses. That said, NER-based detection of unstructured names is strongest in Latin-alphabet languages; CJK and Arabic-script name detection is an area of ongoing improvement.
Yes, for the sensitive parts. Shield runs as a local proxy on your computer. When you send a prompt to ChatGPT or Claude, the prompt goes through Shield first. Shield scans the text, identifies patterns, replaces sensitive values with placeholders ([NAME], [EMAIL], [SSN]), and only then forwards the cleaned prompt to the AI provider. The AI provider never sees the original data. The redaction mapping, which placeholder maps to which original value, stays entirely on your machine. If you need the original values back in the AI's response, Shield swaps them back in locally before showing you the result.

Related Articles

AI Prompt Sanitization Playground
See redaction in action: paste any text and watch Shield detect and replace sensitive data patterns in real time.
LLM Security Checklist
The complete checklist for securing your AI usage, from prompt sanitization to logging and access control.
Secret Detection: Entropy vs. Regex
Why regex alone misses API keys and tokens, and how entropy analysis catches what patterns can't.

Stop Sensitive Data Before It Reaches an AI Provider

Shield installs in minutes and starts catching PII, PHI, PCI data, and secrets immediately, running locally on your machine, with patterns you can customize. Your data never leaves your network.

Talk to Our TeamHow Shield Works

Last updated: July 17, 2026