Personal data never reaches the provider
Privacy Guard finds sensitive data in the prompt and replaces it with placeholders before the call goes out. The provider works on [EMAIL_7Q2X], your agent gets the answer with the real data. Or it blocks the call.
Free plan forever: 5,000 requests a month, no credit card.
Tell John Smith (john.smith@example.com, +44 7700 900123) that the refund goes to IBAN GB82 WEST 1234 5698 7654 32.
Tell [NAME_4KD2] ([EMAIL_7Q2X], [PHONE_2B8M]) that the refund goes to IBAN [IBAN_9F3A].
Agents read your customers’ data. And send it out.
Tickets, emails, invoices and forms end up in prompts as they are. Every call carries personal data to an outside supplier.
Prompts full of data
Customers’ names, email addresses, phone numbers and IBANs enter the agent’s context along with the rest of the text.
One more supplier
Every model provider is a recipient of the data, to record among your processing activities and to explain to customers.
One slip is enough
Cleaning prompts in every agent’s code is easy to forget, and one new field in a form is enough to let everything through.
How it works
The check happens in GuardrailX, before everything else: routing, loop blocking and comparisons only see placeholders.
-
1
It recognises the data
Emails, phone numbers, IBANs, Italian tax codes, VAT numbers, payment cards, IP addresses, ID documents, names and addresses, plus the entries of the project dictionary.
-
2
It replaces them with placeholders
The same value always gets the same placeholder, in every turn of the conversation: the providers’ prompt caching keeps working.
-
3
The provider works on placeholders
The model gets the text with [EMAIL_7Q2X] instead of the address: it understands there is an email there, but not which one.
-
4
It puts the real data back in the response
Streaming and tool call arguments included. The agent sees no difference.
-
5
Or it blocks the call
In Block mode a call with sensitive data doesn’t go out and costs nothing: the agent gets an error saying which types of data were found, never the values.
What the provider sees
The message with placeholders. The placeholder → value table isn’t stored: it comes from the call itself, because agents send the whole conversation at every turn.
- When something was masked, the response carries the x-guardrailx-privacy header.
- In Block mode: a 422 sensitive_data_detected error with x-should-retry: false.
- With the X‑GuardrailX‑Privacy header (mask or block) you raise the level for a single call, never lower it.
# What reaches the provider
{
"role": "user",
"content": "Write to [NAME_4KD2] ([EMAIL_7Q2X]) that the case is closed."
}
# In Block mode, a call with sensitive data
HTTP/1.1 422 Unprocessable Entity
x-should-retry: false
x-guardrailx-blocco: sensitive_data_detected
{ "error": { "code": "sensitive_data_detected", … } }
What it recognises
With the right checks for each type, so dates, amounts, order numbers and versions aren’t taken for sensitive data.
| Data | How it’s recognised |
|---|---|
| The shape of an email address | |
| Phone number | Italian numbers (mobile, landline, with +39 or 0039) and international numbers with + |
| IBAN | The right length for the country and the mod 97 check, with or without spaces |
| Italian tax code and VAT number | The check character and digit, homocode variants included |
| Payment card | The Luhn check and a known network (Visa, Mastercard, Amex…) |
| Names | JSON fields such as name or last_name and names in text, after a title or a greeting or as a known first name followed by a surname |
Pseudonymisation, plainly
Privacy Guard doesn’t anonymise: GuardrailX can rebuild the data, and the provider still sees the rest of the text. It reduces the risk, it doesn’t remove it.
- Attached images, PDFs, audio and files go through as they are: if the risk is unacceptable, use Block mode and a check in your code for files.
- The model doesn’t see masked data, so it can’t transform it (upper case, translation, a different format).
- If masking fails, the call doesn’t go out: real data never reaches the provider by mistake.
| Mode | What happens |
|---|---|
| Off · the default in every project | Calls go through as they are. |
| Mask · placeholders for the provider | Data becomes placeholders for the provider and comes back real in the response. |
| Block · 422 sensitive_data_detected | A call containing sensitive data doesn’t go out and costs nothing. |
Questions about Privacy Guard
Does the provider see the real data?
No, it sees placeholders instead of the recognised data. It does see the rest of the text: that’s why it’s pseudonymisation, not anonymisation.
Is it enough to comply with the GDPR?
It reduces the personal data that reaches the provider, which helps, but it doesn’t replace your own assessments: legal basis, privacy notice, record of processing. GuardrailX offers a data processing agreement (DPA) for customers who process personal data through the service.
Does the providers’ prompt caching keep working?
Yes. The placeholder is computed from the value with a secret key of the project: the same value always gets the same placeholder, so the beginning of the prompt doesn’t change from one call to the next.
Does it work with streaming and tools?
Yes. With streaming, events are rewritten one by one, even when a placeholder is split across two chunks. In tool call arguments the value is written with the right escaping, so the JSON stays valid.
What about images and PDFs?
Attached images, PDFs, audio and files go through as they are. Anthropic plain-text documents, instead, are masked like the rest of the message. In Block mode every text in the call is checked, embeddings and metadata included, but not images and files.
Can I turn it on only for some calls?
Yes, with the X-GuardrailX-Privacy header: mask masks even if the project has Privacy Guard off, block blocks even if the project only masks. It can only raise the level set in Limits, never lower it.
What if I ask the model to change a piece of data?
It can’t, because it doesn’t see it: «rewrite the email in upper case» comes back with the email as it was. For calls that work on the data itself, turn Privacy Guard off in that project.
Related features
Spend limits at every level
Per project, key, agent and session, daily and monthly. Once the limit is reached, the call stops before it costs anything.
Autopilot
Tries cheaper models on your calls by itself, measures quality and moves traffic a little at a time, rolling back if needed.
A log of every call
Cost, tokens (reasoning tokens too), model, agent, session, retries. Filters, charts and CSV export.
Put a cap on spending before the next loop.
Start on the Free plan: 5,000 requests a month, no card and no end date.