What the checklist covers:
33
Evaluation criteria for detecting, redacting, and auditing PII in LLM traffic
5
Control areas, from detection coverage to audit and compliance
12
Must-have controls, flagged so you know what to fix first
4
Redaction strategies compared: masking, tokenization, hashing, and full removal
Inside the checklist
Download the checklist to get:
A working framework your security, privacy, and platform teams can use to evaluate PII guardrails, or to tighten the ones you already run.
Download the Checklist✓
The full 33-point PII redaction framework
Every criterion grouped by control area, with the question to ask and a must-have, should-have, or nice-to-have priority.
✓
A three-step rollout plan
Catalog the PII categories that matter, choose a redaction strategy per category and workflow, then audit and tune quarterly.
✓
Redaction strategy criteria
When to block, mask, tokenize, hash, partially mask, or send for human review, so redaction never breaks legitimate workflows.
✓
Audit and compliance requirements
Redaction event logs, re-identification controls, false-positive sampling, and reporting for SOC 2, HIPAA, and GDPR.
Why it matters
PII Leaks Through LLM Prompts Faster Than Most Teams Expect
Names, emails, account numbers, addresses, IP addresses, and free-text identifiers all flow through the same channel as everything else in an LLM request. A support agent pastes a customer email into a prompt. A RAG pipeline retrieves a document with a patient's record number. A model echoes an account number back in its answer, and the whole exchange is written to an observability log.
Every one of those is a copy of personal data in a place it shouldn't be: an external model provider, a trace store, a SIEM, or a downstream analytics pipeline. Each copy adds exposure under GDPR, HIPAA, and PCI, and makes right-to-erasure requests harder to honor.
Redact on the way out and on the way back. The checklist covers both directions, plus the logs in between.
Teams usually start with a regex or two in application code. That catches some emails and card numbers, but misses names and addresses in free text, PII inside JSON payloads and RAG chunks, secrets pasted into prompts, and anything coming back in the response. It also breaks when a workflow legitimately needs the data, and it rarely leaves an audit trail.
What good PII redaction looks like
Detection covers regulated identifiers, names and addresses, contact details, PHI, PCI data, and secrets, in free text as well as structured payloads, documents, and retrieval chunks. Each category gets the right strategy for the workflow: a typed tag like [NAME], a reversible token for systems that need to re-identify, a one-way hash for analytics, or full removal from logs and traces.
Redaction runs inline at the gateway, before requests reach the provider and before responses reach apps, with the same policies applied to agent tool calls and MCP traffic. It fails closed, adds little latency, and logs every event with what was detected, which policy fired, and what action was taken, so teams can sample false positives and tune detectors over time.
Treat redaction as one guardrail layer
PII redaction works best paired with routing, least privilege, and retention controls. The PII Redaction Checklist turns that standard into 33 criteria you can use to evaluate a gateway or guardrail provider, or audit the controls you already run.
Preview
The five control areas in the PII redaction checklist
A sample of the criteria in each area. The full checklist includes all 33, with priorities and evaluation questions.
Area 1 · 10 checks
Detection coverage
SSNs, card numbers, bank accounts, passports, and license numbers are detected out of the box
PII in unstructured free text is caught, not just JSON fields
+8 more checks
Area 2 · 5 checks
Redaction strategies
Entities are replaced inline with typed tags like [NAME] or [EMAIL]
Entities are removed entirely from logs and traces, not just masked in transit
+3 more checks
Area 3 · 6 checks
Inline enforcement and performance
PII is redacted before requests leave the gateway
Requests are blocked, not passed through, when the engine errors
+4 more checks
Area 4 · 6 checks
Custom entities and guardrail ecosystem
Custom regex covers employee IDs, account numbers, and project codes
Detection confidence drives block, redact, or flag-and-audit
+4 more checks
Area 5 · 6 checks
Audit, reversibility, and compliance
Redaction events log what was detected, which policy fired, and the action taken
Every re-identification of a token is access-controlled and logged
+4 more checks
How to use · 3 steps
Rolling it out
Catalog entities: regulated identifiers, business-sensitive fields, free-text leak risks
Choose masking, tokenization, hashing, or removal per category and workflow
Sample redaction events, score false positives and negatives, and tune quarterly
4.7
★★★★★
Gartner Peer Insights
Rated 4.7 on Gartner Peer Insights
Teams run TrueFoundry's AI Gateway with inline PII guardrails, custom entity definitions, policy-driven masking per route, benchmarked guardrail provider integrations, and redaction events captured in request logs.
96%
of reviewers likely to recommend
4.9
ease of deployment and admin
3–4 ms
added gateway latency
