Docs / AMS / Govern / Personal data
View as MarkdownPersonal data
Turn on personal data protection, choose what Mindset looks for, add and test your own patterns, and see what was caught.
After this page, you can decide what happens to personal data before it reaches a model provider, add patterns of your own, and check what Mindset has caught. When the invoice exceptions agent reads an invoice with a supplier contact's email and IBAN on it, this is the setting that decides whether the provider sees them.
What this is
Personal data protection finds personal data in what an agent sends to a model and swaps each value for a placeholder before the provider sees it. It's off until an admin turns it on. You set it once for the whole org in Settings → Governance, in the Personal data card. Only org admins can change it.
Nothing is ever blocked or refused for containing personal data. Detected values are replaced, and the message carries on.
What is protected, and when
| Question | Answer |
|---|---|
| What's the default? | Off. Messages reach the model provider exactly as written |
| What turns it on? | The org policy, What happens to personal data in transit, set to any option other than Off |
| Is there a per-connection switch? | Only on AI model connections, labeled PII protection. It's on by default |
| What does the per-connection switch do? | It can only remove protection. Turned off, calls through that model connection skip the check. It can't add protection when the org policy is off |
| With the org policy off, does the switch do anything? | No. Nothing is scrubbed anywhere, whatever the switch says |
| Do agent conversations follow the switch? | No. Agent conversations follow the org policy and ignore the switch. The switch applies only to $llm calls made through that connection, for example from a function |
| What happens to a detected value? | It's replaced by a placeholder token. Nothing is blocked |
| Are images scrubbed? | No. Images skip scrubbing at every setting, and so does anything a model reads off an image |
Changing the PII protection switch asks you to confirm. Turning it off is recorded in the audit log.
The four policy options
Pick one under What happens to personal data in transit, then click Save.
| Option | What happens |
|---|---|
| Off: personal data is not substituted | Messages reach the provider as written. The default |
| Redact permanently: the real value never comes back | The assistant and every tool it calls see placeholders, so anything that needs the real value fails |
| Redact, with audited access to the real value | Replaced before the provider sees it, restored on the way back. Each restore is recorded in the audit trail |
| Redact in transit only | Replaced before the provider sees it and restored straight away on the way back |
What a placeholder looks like depends on the class. Each one keeps the shape of the original and comes from a range that's never issued to anyone: an email becomes an address ending @redacted.invalid, a card number becomes a 16-digit number that still passes the Luhn check, and an IP address becomes one in 192.0.2.x. Values your own patterns catch become a short marker instead.
Choose what Mindset looks for
Under What to look for there are six built-in classes, each with its own switch. All are on by default.
| Class | How it's recognized |
|---|---|
| Shape match, no checksum available | |
| Phone | Parsed as a number, not shape-matched |
| Card | 13 to 19 digits passing the Luhn checksum |
| IBAN | Country code and check digits, mod-97 validated |
| National ID | Structurally validated (US SSN today) |
| IP address | Octet-range checked v4, conservative v6 |
A class you switch off is still detected, then discarded before substitution. It isn't replaced, and it isn't counted while it's off.
Add and test your own pattern
Under Your own patterns, you add a regular expression for something the built-in classes don't know, such as a supplier account number on your invoices.
- Enter a Name, for example "Supplier account".
- Enter the Pattern: a regular expression, without delimiters or flags.
- Paste some sample text into Test against. It isn't stored.
- Click Test pattern. The result shows how many matches it found and how long the pattern took.
- Click Save pattern. It stays disabled until a test passes and the pattern has a name.
Each saved pattern has its own on and off switch and a Remove button.
Limits, because every active pattern runs on every model call:
- At most 25 patterns can be on at once. You can keep more saved and switched off.
- A pattern can be at most 200 characters.
- A pattern that can match an empty string is refused.
- A pattern that takes longer than 25 ms on the test text can't be saved. Nested repetition is the usual cause.
See what was caught
The detections feed is in Govern → Audit, on the Personal data tab. The Settings card links there with See what these rules have caught, in Audit.
Under What was caught, each row shows When, Class, Placeholder, Found by and Restored. The real value is never shown there, at any policy setting, to anyone. See Audit for the rest of that tab.
Send telemetry to your own collector
Telemetry export (OpenTelemetry) sits on the same Settings → Governance tab. It pushes your agents' traces and metrics to Datadog, Grafana, Honeycomb or any OTLP collector.
- Enter the OTLP endpoint: the base URL of your OTLP/HTTP collector or vendor intake.
- Enter the Auth header name your backend expects (it starts as
Authorization) and the Auth token. The token is stored as a reference and never shown again. - Choose what to send: Send traces, Send metrics and Send agent behavior (script phases and gate outcomes) start on. Send costs starts off. Include end-user identifiers starts on, and puts the person's email or user ID on every span.
- Click Test. Save is enabled only after the endpoint accepts the test telemetry. Mindset tests again when you save and refuses the save if that test fails.
Message content isn't exported. The only personal identifier in the export is the end-user identifier, controlled by its own switch. Under Is it flowing? you see recent batches and whether each one was delivered.
What can go wrong
- The model connection says PII protection is on, but nothing is replaced. The org policy is Off. The connection switch can't turn protection on by itself.
- A tool fails after you choose Redact permanently. The tool received a placeholder where it needed the real value. Use Redact, with audited access to the real value or Redact in transit only if tools need real values back.
- Personal data in a screenshot or scanned invoice reached the provider. Images skip scrubbing. Keep images with personal data out of agents that send them to a model. See What Mindset does not do.
- Your pattern won't save. It hasn't passed a test, it's too slow, it matches an empty string, or 25 patterns are already on.