Data Loss Prevention (PII & Secrets)
Detect and redact personal data before it reaches the LLM provider, and scrub leaked secrets out of model responses — including streamed ones.
Features
Input PII Redaction
Prompts are scanned for SSNs, emails, phone numbers, credit cards (Luhn-validated), API keys, passports, IBANs, crypto wallets and more, and redacted before egress to the provider — per message, across multi-turn conversations.
Output Secret Redaction
Model responses are scrubbed of leaked credentials the model shouldn't emit — API keys, access tokens, private keys, and system-prompt disclosures. Configure redact (replace) or block (cut the response off).
Streaming DLP
Output redaction covers streamed responses too. Secrets split across chunk boundaries are caught before any partial secret is emitted; a never-terminating key fails closed rather than leaking.
Configurable Actions
Per policy: block the request/response, redact with placeholders ([REDACTED]), warn, or allow-and-log. Manage it all from the Security Policies page — input PII types and output redaction alike.