Data protection
PII and PHI stripping for AI
With PII and PHI stripping turned on in Company → Models & Privacy, Autessa scans each prompt before it reaches any AI model, yours or Autessa’s, and swaps personal and health information for numbered placeholders such as [SSN_1] or [EMAIL_2]. The model sees only placeholders; the real values go back into the reply, including streamed replies and tool calls.
The problem
What problem does it solve?
Teams want AI on real customer and patient records, but every prompt is data leaving for a model. Redacting by hand does not scale, and redacting with another third-party model just moves the problem.
How it works
- 1
Turn it on
One company-wide switch in Models & Privacy.
- 2
Built-in detection
Email addresses, phone numbers, Social Security numbers, credit card numbers, IP addresses, IBANs and dates of birth are always detected while it is on.
- 3
Add custom rules
Give each a name, a type in capitals such as EMPLOYEE_ID, and a plain-language description of what to remove.
- 4
Put values back
When the reply returns, placeholders become the original values, so you and your tools see the real data.
Every option
PII and PHI stripping for AI: settings and options
| Setting | What it does |
|---|---|
| PII & PHI stripping | On or off for the company. |
| Custom rule | Name, Type and What to remove. |
| Applies to | Agents, multi-agents, AI review checks, LLM Call tools, compaction, evaluations, sandbox, synthetic data and AutessaScript llm. |
| Model connections (BYOK) | Your own provider keys, encrypted with your company key, write-only, last four shown. |
| No automatic fallback | A call set to your key never falls back to an Autessa model. |
Permissions
Who can do what?
| Who | What they can do |
|---|---|
| Members with Manage Team Members | See and change Models & Privacy. |
| Anyone who can edit an agent or LLM Call tool | Choose one of the company’s connected models. |
WHERE AI IS INVOLVED
Custom rules are matched by Autessa’s own privately hosted model, so the text being checked is not sent to a third-party provider for detection.
What to know
- Stripping greatly reduces the personal data a model sees, but it is not a guarantee. Test it with realistic examples before relying on it for regulated data.
- It does not apply to the builder copilots, Analytics Ask, Video Studio or embeddings.
Connections
How PII and PHI stripping for AI connects to the rest of Autessa
Reports, policies and security questionnaires are on the Autessa Trust Center.
FAQ
PII and PHI stripping for AI: questions
Does stripping work with my own OpenAI or Anthropic key?
Yes. It applies whether the model is yours or Autessa’s.
Will my tools see placeholders instead of real values?
No. Placeholders are replaced with the originals in replies and tool calls, so tools get the real data.
Can I add my own data types?
Yes. Describe them in plain language as custom rules, such as “Employee IDs: the letter E followed by six digits”.
Get started with PII and PHI stripping for AI
With PII and PHI stripping on, personal and health data in every prompt becomes a numbered placeholder such as [SSN_1] before it reaches any model, and the real values return in the answer.
Reports, policies and questionnaires live on the Autessa Trust Center.
100% customizable, code and all
Make Autessa Security & Compliance fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours