--- title: "What Is PII Redaction? A Plain-English Guide for AI Users" description: "PII redaction means automatically removing personally identifiable information from text before it is sent to an AI." url: "https://sonomos.ai/blog/what-is-pii-redaction-ai/" source: "https://sonomos.ai/blog/what-is-pii-redaction-ai/" --- [Back to Blog](https://sonomos.ai/blog/) April 28, 20268 min readLast reviewed: May 6, 2026 PII Redaction AI Privacy Glossary Data Protection # What Is PII Redaction? A Plain-English Guide for AI Users S [Sonomos Research](https://sonomos.ai/team/) · Sonomos The Sonomos research team writes about AI privacy, data protection, and how to use generative AI safely at work. **PII redaction** is the process of automatically detecting and removing — or replacing — _personally identifiable information_ in text, images, audio, or other content before that content is shared, stored, or sent to a third party. In an AI context, PII redaction usually happens in the moment between when a user types a prompt and when that prompt is transmitted to a large language model (LLM) such as ChatGPT, Claude, or Gemini. This guide explains what PII redaction is, why it matters specifically for AI workflows, how the modern techniques work, and how to choose between them. ## What counts as PII? Personally identifiable information is any data that can be used, alone or in combination, to identify a specific person. The U.S. National Institute of Standards and Technology (NIST) and most international privacy regulations break PII into two practical buckets: - **Direct identifiers:** information that names a person on its own — full name, government ID, passport number, email address, phone number, biometric template. - **Indirect identifiers:** information that identifies a person when combined with other data — date of birth, ZIP code, employer, IP address, device fingerprint, rare medical condition. Different regimes use different vocabulary. _PHI_ (protected health information) under [HIPAA](https://sonomos.ai/glossary/hipaa/) is a regulated subset of PII tied to health care; _NPI_ (nonpublic personal information) under [GLBA](https://sonomos.ai/glossary/glba/) is the financial-services equivalent; _personal data_ under GDPR is broader still and includes anything "relating to an identified or identifiable natural person." For AI redaction purposes, treat all of these as "sensitive entities" and design the system to recognize them. ## Why PII redaction matters in AI workflows Three forces converge to make redaction essential for AI: 1. **Prompts cross a trust boundary.** Once text is sent to an LLM provider, the user no longer controls retention, access, or downstream use. Redaction keeps the sensitive bits on the user's device. 2. **Regulations apply at the point of disclosure.** HIPAA, GDPR, CPRA, and similar laws treat _sending_ regulated data to a processor as a controlled event. Redaction reduces or eliminates the controlled disclosure. 3. **AI outputs amplify exposure.** Once PII appears in a prompt, it tends to appear in the response, then in the screen-share, then in the meeting recording, then in the saved transcript. Redaction at the source breaks the chain early. In practice, a well-designed redaction layer turns "I can't use AI for this task" into "I can use AI safely for this task," which is the difference between a tool that gets quietly avoided and one that is genuinely productive. ## The four main redaction techniques Not all redaction is equal. The technique you choose changes how much utility the AI keeps and how reversible the operation is. ### 1. Removal The sensitive value is deleted. "Patient John Smith was admitted on June 4" becomes "Patient was admitted on June 4." - **Strength:** Maximum privacy; the data is simply gone. - **Weakness:** The model loses context. It cannot follow up with "what about John specifically?" because John no longer exists in the prompt. ### 2. Masking with a placeholder The sensitive value is replaced with a generic label. The example becomes "Patient [NAME] was admitted on [DATE]." - **Strength:** Preserves structure; the model still understands that there is a name and a date. - **Weakness:** Identical labels for distinct entities collapse them. Two patients become "[NAME] and [NAME]," and the model cannot tell them apart. ### 3. Pseudonymization (synthetic substitution) Each sensitive value is replaced with a realistic but fake one. "John Smith" becomes "Mira Patel"; "555-12-3456" becomes "555-99-7842." - **Strength:** The model sees a full, coherent document; it can reason about distinct entities and produce useful drafts. - **Weakness:** Without a mapping, the user cannot reliably restore the originals in the response. ### 4. Reversible tokenization Each sensitive value is replaced with an opaque token, and a local mapping links each token back to its original. "John Smith" becomes ""; the mapping is stored only on the user's device. - **Strength:** Best of both worlds — the original never leaves the device, but the user can see the response with real names restored. - **Weakness:** Requires a client-side component to manage the mapping; without one, the response is full of opaque tokens. Some AI privacy tools use reversible tokenization or pseudonymization because they preserve the most utility while keeping the source data local. Locke 1.0 uses one-way masking; reversible tokenization is planned shortly after 1.0. ## How modern PII detection actually works Detecting PII reliably is harder than it looks. A simple regular expression catches obvious patterns — Social Security numbers, credit cards, email addresses — but misses anything contextual. Effective redaction stacks three layers: 1. **Pattern matching.** Regex and rule-based detectors handle structured data: card numbers (with Luhn check), IBANs, government IDs, dates, phone numbers. 2. **[Named-entity recognition (NER)](https://sonomos.ai/glossary/named-entity-recognition/).** Lightweight machine-learning models classify spans of text as person, organization, location, medical term, or other entity types. 3. **Context rules.** Heuristics that boost or suppress confidence based on surrounding tokens — "Dr. Smith" is almost certainly a person; "Smith & Wesson" almost certainly is not. The detection runs locally — on the device, in the browser — for the same reason redaction does: sending text to a cloud detector to find out whether it contains PII _also_ sends the text outside the trust boundary. ## What "local-first" PII redaction means Local-first means the detection model and the substitution logic both run on the user's device. The implications are concrete: - **No network round trip** is required to redact a prompt; latency stays under a frame. - **No vendor in the middle** has access to the unmasked text — including the redaction vendor. - **Offline capability** is preserved; redaction works on a plane or behind a corporate proxy. - **Auditability** is straightforward: the only outbound traffic is the already-redacted prompt to the AI provider. For browser-based AI tools, "local-first" usually means a browser extension that intercepts the prompt in the page's DOM, runs detection in WebAssembly or a small JavaScript model, applies tokenization, and submits the safe version. ## Frequently asked questions ### What is the difference between PII redaction and data anonymization? Redaction is an operation on a specific document or prompt: this name, in this paragraph, becomes a token. Anonymization is a property of a dataset: after processing, no individual can be re-identified, even by combining records. Redaction is a building block; anonymization is a goal that may require additional steps such as k-anonymity, l-diversity, or differential privacy. ### Does PII redaction make a workflow HIPAA compliant? Redaction reduces the disclosure of PHI but is not, by itself, sufficient for HIPAA compliance. Compliance requires policies, training, [business associate agreements](https://sonomos.ai/glossary/business-associate-agreement/) where applicable, and technical safeguards across the workflow. That said, redacting PHI before it ever reaches an AI provider materially shrinks the BAA surface and removes one of the most common modes of accidental disclosure. ### Can AI redact its own input? Asking an LLM to redact a prompt before processing it is self-defeating: the unmasked prompt has already been sent. Effective redaction must happen _before_ the request leaves the user's device, in a component the LLM never sees. ### What about images, audio, and video? The same principles extend, but the techniques differ. Image redaction uses computer vision to detect faces, license plates, and on-screen text. Audio redaction uses speech-to-text plus the same NER stack, then bleeps or substitutes the audio segment. Video combines both. As of 2026, the strongest local-first tools focus on text — the dominant input format for chat-style AI — and integrate with cloud services for media when needed. ### Is reversible tokenization safe? It is safe only if the mapping never leaves the user's device. A tool that stores the mapping in the cloud — even encrypted — has reintroduced the exact trust boundary it was supposed to remove. Look for tools that document where the mapping lives and confirm with a network inspector that no unmasked data is transmitted. ### How do I evaluate a PII redaction tool? Three quick tests: 1. Open the developer tools network panel and watch what is transmitted as you type. The unmasked prompt should never appear. 2. Read the privacy policy. It should specify zero retention of prompt content and identify exactly what telemetry, if any, is collected. 3. Check the entity coverage. A good tool documents which categories it detects (names, IDs, financial accounts, medical terms) and lets you add custom patterns for organization-specific data. ## Putting it together PII redaction is the operational layer that lets professionals use AI without trading away privacy. The mechanics matter — removal versus masking versus pseudonymization versus reversible tokenization — because each technique has different trade-offs between privacy and utility. The deployment matters even more: a redaction tool that runs in the cloud is just another processor of your data; one that runs locally is a genuine boundary. If you take only one thing from this guide: in 2026, the right place for PII redaction is the user's device, before the first byte of a sensitive prompt leaves the browser. Everything else is a compromise. Sonomos publishes this blog and makes Locke, which detects and masks sensitive information on your device before it reaches an AI model. [How Locke works](https://sonomos.ai/locke/) This article is general information about privacy and AI, not legal advice, and reading it does not create a solicitor–client or attorney–client relationship. Regulatory requirements turn on your specific facts and jurisdiction and change over time. Consult qualified counsel before relying on anything here, and check the publication and last-reviewed dates above. We may revise posts, but we do not undertake to keep any post current as the law changes. ## Reference pages for this post - [Personally Identifiable Information (PII)Glossary](https://sonomos.ai/glossary/personally-identifiable-information/) - [RedactionGlossary](https://sonomos.ai/glossary/redaction/) ## Related Articles September 1, 2026•Sonomos Research ### The Anthropic DPA Explained: Claude Data Processing Agreement Guide (2026) Anthropic offers a DPA on Claude Team, Enterprise, and the API — not on Claude.ai Free or Pro. Here is what the Anthropic DPA covers, how it handles EU-US transfers via SCCs and the DPF, what to verify before signing, and where a DPA stops. Claude DPA GDPR +2 September 1, 2026•Sonomos Research ### Claude EU Data Residency in 2026: What Anthropic Offers, and What European Teams Do Instead Anthropic does not currently offer EU data residency for Claude — every prompt is processed on US infrastructure and constitutes an EEA-to-US transfer. Here is how that compares to OpenAI, Microsoft, and Google, what the EU-US Data Privacy Framework does and does not cover, and the supplementary-measure stack European teams deploy instead. Claude Data Residency Europe +2 September 1, 2026•Sonomos Research ### Can My Employer See My Claude Chats? What's Visible in 2026 (and What Isn't) Whether your employer can see your Claude chats depends on the account (personal Claude.ai vs. work-managed Team/Enterprise), the device, and the network. Here is what is visible in each scenario — including Claude Code — and what deleting a chat actually does. Claude Workplace Privacy AI Privacy +1