PII Handling in LLM Apps

An LLM call ships your input to an external provider. The moment that input contains names, emails, account numbers, or health and financial details, you have a data-protection problem that a normal internal API does not. Handling it is about controlling what personal data crosses that boundary and under what terms — not hoping it never does.

Detect and redact before sending

The strongest control is not sending the PII at all. Detect it in the input — pattern matching for structured identifiers like card and account numbers, named-entity recognition for names, emails, and addresses — and replace it with placeholders before the prompt leaves your system. The model reasons over the placeholders; you re-insert the real values in the response afterwards.

import re

def redact(text):
    tokens = {}
    def sub(kind, pattern, t):
        def rep(m):
            key = f"[{kind}_{len(tokens)}]"
            tokens[key] = m.group(0)
            return key
        return re.sub(pattern, rep, t)
    text = sub("EMAIL", r"[\w.+-]+@[\w-]+\.[\w.-]+", text)
    text = sub("CARD",  r"\b\d{13,16}\b", text)
    return text, tokens

def restore(text, tokens):
    for key, val in tokens.items():
        text = text.replace(key, val)
    return text

Redaction is imperfect — NER misses things and regex over-matches — so treat it as one layer, not a guarantee, and combine it with the terms and retention controls below.

Get the provider terms right

• Use the enterprise/API tier that contractually excludes your data from training, and confirm it in writing — consumer tiers often do not.
• Sign a data processing agreement (DPA) with the provider if you handle personal data under GDPR or similar law.
• Know the provider's retention window for API inputs and whether a zero-retention option is available for sensitive workloads.

Retention and region

Apply the same discipline to your own systems. Do not log raw prompts and completions containing PII in plaintext; redact before logging, encrypt at rest, and set a retention window with automatic deletion. If you operate under data-residency rules, use provider endpoints in the required region and confirm data does not leave it.

PII handling in LLM apps is a boundary-control exercise: redact what you can before it leaves, contract correctly for what must go, and retain as little as possible on both sides. Decide the policy explicitly, because "we sent everything and hoped" is not a defence you want to make to a regulator.