PII Redaction at Inference Time: A Practical Guide for Financial Services

Financial institutions cannot send client names, account numbers, or SSNs to third-party model providers - even under enterprise agreements. The standard workaround is 'don't use AI for anything with PII.' That doesn't scale when 80% of legal and ops workflows contain sensitive data.

In-Memory, Pre-Inference Redaction

Eridian's PII redaction runs in-memory at the gateway, before any data leaves your controlled environment for model inference. We detect 12 entity types: names, SSNs, account numbers, credit card numbers, email addresses, phone numbers, IP addresses, dates of birth, passport numbers, bank routing numbers, SWIFT codes, and custom regex patterns you define per project.

{
  "pii_config": {
    "entities": ["name", "ssn", "account_number", "email"],
    "strategy": "hash",
    "custom_patterns": ["\\bACC-[0-9]{8}\\b"]
  }
}

Accuracy Benchmarks

On our internal financial services eval set (10,000 annotated prompts from anonymized production traffic), we achieve 99.2% precision and 97.8% recall across all 12 entity types. False positives - redacting non-PII - are configurable: strict mode for legal workflows, relaxed mode for internal dev tools.

The PII redaction layer was the deciding factor for our top-10 asset manager customer. Legal could finally use AI without sending client data to a third-party cloud.

Regulated workloads cannot treat PII redaction as a post-hoc batch job. By the time data reaches a model provider, the compliance decision already failed. Eridian redacts in-memory at the gateway before any outbound provider call.

Twelve default entity types cover the majority of financial services prompts: names, government identifiers, account numbers, payment card numbers, email addresses, phone numbers, IP addresses, dates of birth, passport numbers, bank routing numbers, SWIFT codes, and custom regex patterns per project.

Hash strategy replaces detected spans with deterministic tokens so models can reason about structure without seeing raw values. Reversible mapping stays inside your tenant boundary for workflows that require deanonymization in downstream systems you control.

Strict mode increases precision at the cost of recall on ambiguous tokens such as product codenames that resemble account numbers. Legal workflows enable strict mode; internal developer assistants often use default mode with custom allowlists for repository paths.

Redaction counts appear in eridian.pii_redacted and eridian.pii_entities on every inference response, plus audit log exports for SIEM correlation.

False positive review queues let compliance officers label borderline spans. Labels feed per-tenant calibration without exposing raw text to Eridian training pipelines unless you explicitly opt in.

Cross-border residency interacts with PII policy: EU-West tenants can require redaction before any US-East model route. Routing policies honor residency constraints before cost optimization.

Incident response playbooks should include a PII leak assessment path keyed off eridian.request_id. If redaction counts drop unexpectedly, that is an alert condition.

Combined with structured output, redaction runs on user content before schema validation retries begin, preventing accidental leakage in corrective prompts sent back to the model.

Custom regex patterns support instrument-specific identifiers such as internal loan IDs matching ACC-######## formats.

Deanonymization requires separate scope pii:deanonymize not enabled on general inference keys.

Audit exports include counts only by default; full span text requires break-glass role with MFA step-up.

Multilingual prompts run language detection before NER to select appropriate entity models.

Combined with ZDR upstream agreements, redaction satisfies data minimization even when providers offer enterprise privacy addenda.

PII redaction is not a substitute for data minimization in prompt design, but it is the enforcement layer when minimization fails in practice.

Regulated workloads cannot treat PII redaction as a post-hoc batch job. By the time data reaches a model provider, the compliance decision already failed. Eridian redacts in-memory at the gateway before any outbound provider call.

Twelve default entity types cover the majority of financial services prompts: names, government identifiers, account numbers, payment card numbers, email addresses, phone numbers, IP addresses, dates of birth, passport numbers, bank routing numbers, SWIFT codes, and custom regex patterns per project.

Hash strategy replaces detected spans with deterministic tokens so models can reason about structure without seeing raw values. Reversible mapping stays inside your tenant boundary for workflows that require deanonymization in downstream systems you control.

Strict mode increases precision at the cost of recall on ambiguous tokens such as product codenames that resemble account numbers. Legal workflows enable strict mode; internal developer assistants often use default mode with custom allowlists for repository paths.

Redaction counts appear in eridian.pii_redacted and eridian.pii_entities on every inference response, plus audit log exports for SIEM correlation.

False positive review queues let compliance officers label borderline spans. Labels feed per-tenant calibration without exposing raw text to Eridian training pipelines unless you explicitly opt in.

Cross-border residency interacts with PII policy: EU-West tenants can require redaction before any US-East model route. Routing policies honor residency constraints before cost optimization.

Incident response playbooks should include a PII leak assessment path keyed off eridian.request_id. If redaction counts drop unexpectedly, that is an alert condition.

Combined with structured output, redaction runs on user content before schema validation retries begin, preventing accidental leakage in corrective prompts sent back to the model.

Custom regex patterns support instrument-specific identifiers such as internal loan IDs matching ACC-######## formats.

Deanonymization requires separate scope pii:deanonymize not enabled on general inference keys.

Audit exports include counts only by default; full span text requires break-glass role with MFA step-up.

Multilingual prompts run language detection before NER to select appropriate entity models.

Combined with ZDR upstream agreements, redaction satisfies data minimization even when providers offer enterprise privacy addenda.

PII redaction is not a substitute for data minimization in prompt design, but it is the enforcement layer when minimization fails in practice.

Review custom regex patterns quarterly; stale patterns add latency without improving precision.

Train legal reviewers to interpret pii_entities lists returned in API responses during workflow QA.

Align redaction strictness with model provider DPAs and internal data classification standards.

Test multilingual contracts with language-specific eval sets before enabling automation in production.

Document break-glass procedures for deanonymization with dual-control approval requirements.

Include redaction counts in executive dashboards only as aggregate trends, not raw span content.

Validate redaction on attachment-derived text when RAG ingests PDFs with OCR noise.

Pair redaction with retention policies so cached redacted payloads expire consistently.

Run tabletop exercises for suspected false negative events with compliance and security jointly.

Update incident templates to capture eridian.request_id and pii_redacted fields by default.

Schedule redaction model upgrades with compliance sign-off and regression eval gates.

Map each entity type to internal data classification labels in customer data catalogs.

Review deanonymization scopes during quarterly key audits with least-privilege emphasis.

Test OCR-heavy RAG inputs for false positives on alphanumeric account-like strings.

Publish transparency reports on redaction precision/recall ranges per tenant tier.

Align break-glass access reviews with SOC 2 evidence collection calendars.

Validate redaction on tool-call payloads in agentic workflows, not only user messages.

Document exceptions where redaction is intentionally bypassed with CISO written approval.

Integrate redaction metrics into privacy impact assessments for new workflow launches.

Legal operations compare redaction logs with matter management IDs stored in metadata for traceability.

Developers avoid placing raw PII in system prompts when user prompts already contain sensitive fields.

Risk committees review false negative reports within five business days with documented remediation.

Data governance councils approve custom entity types with named business owners and review cadence.

Training materials show before/after redaction examples using synthetic data only.

Privacy engineers map redaction entities to GDPR article references for DPIA templates.

Redaction latency budgets are tracked separately from model latency in SLO dashboards.

Vendor due diligence questionnaires cite redaction precision metrics with evaluation methodology.

Quarterly drills test break-glass deanonymization with audit sampling by internal audit team.

Redaction configuration changes require peer review from second compliance engineer.

Customers receive alerts when new entity types are enabled project-wide.

Support documents common false positive patterns for phone numbers in JSON payloads.

Redaction spans exclude model system instructions configured by Eridian, not customer content.

Cross-functional workshops align legal, security, and ML on strict vs default mode selection criteria.

Regulators receive redaction process narratives without source code access during examinations.

Redaction service cells deploy regionally to keep data in residency boundaries end to end.

Incident retros include pii_redacted counts when severity involves customer content exposure risk.

New entity types ship with default off until compliance publishes enablement guidance.

Redaction QA samples ten thousand production requests monthly with stratified workflow sampling.

Legal tech partners receive redaction configuration exports as part of joint solution reviews without transferring customer payloads.

Strict mode rollouts include two-week parallel run comparing redaction counts against human review baselines before enforcement toggles.

Joint customer workshops review redaction strictness when expanding from pilot projects to enterprise-wide rollout across multiple business units.

Redaction performance scales horizontally; capacity planning includes peak concurrent pages during month-end document batches.

Compliance maintains mapping spreadsheets linking entity types to regulatory citations used in customer-facing DPIA templates updated quarterly.

Redaction bypass approvals expire automatically after ninety days unless renewed with fresh business justification and CISO countersignature.

OCR ingestion pipelines run redaction after text extraction but before chunk embedding to keep vectors free of sensitive literals.

Customers test redaction with adversarial prompts containing synthetic PII during acceptance testing before go-live sign-off meetings.

Redaction metrics appear in SOC 2 evidence packs with sampling methodology described for external auditors reviewing control design.

Support playbooks distinguish redaction false positives from model hallucinations using eridian.pii_entities versus response content analysis steps.