← All use cases

Security & compliance

Redact PII and PHI before it reaches an LLM

You redact PII and PHI before it reaches an LLM by detecting sensitive entities (names, emails, IDs, health details) and masking them before the text is sent to a model, written to a log, or stored, ideally on-device so the raw data never leaves your environment. The demo below detects and masks sensitive data entirely in your browser, with nothing uploaded.

Try it live, no sign-up

PII / PHI Redaction

Detect and mask sensitive data before it ever reaches a model or a log.

Aug 2026
EU AI Act high-risk obligations take effect, raising the compliance bar
On-device
the demo runs fully in your browser, nothing is uploaded
Top barrier
security and compliance is the most-cited blocker to AI rollout

Why this matters now

Sending personal or health data to a third-party model is a compliance risk under HIPAA, GDPR, and the EU AI Act, and logs are a common leak point that teams forget. Security and compliance are consistently named the top barrier to rolling AI out, so redaction is often the gate that unblocks everything else.

How the reliable version works

  1. 1Detect sensitive entities: names, emails, phone numbers, IDs, and health details.
  2. 2Classify each by sensitivity so masking is proportionate, not blunt.
  3. 3Mask or tokenize the values before the text leaves your control.
  4. 4Keep a reversible mapping when downstream steps legitimately need the original.
  5. 5Run detection on-device wherever possible, so raw data never leaves the browser or your servers.

Common questions

Does redaction run locally, or is my data sent somewhere?

The demo runs fully on-device in your browser, so nothing is uploaded. In production the same detection can run inside your own environment, which is the point: raw PII should never leave your control to be redacted.

Does it handle PHI for HIPAA?

Yes. Health details are treated as sensitive entities and masked like other PII. Redaction before a model call or a log write is a standard control for keeping PHI out of places it should not be.

Can the redaction be reversed for legitimate downstream use?

When needed, yes. A reversible token map lets an authorized downstream step recover the original value, while everything in between only ever sees the masked form.

Related demos, work and services

Want this built properly for your product?

Tell me what you are building and where it is stuck. I reply within one business day with an honest read on whether I can help.

Send a project inquiry