How to Mask PII Before Sending Prompts to OpenAI

The fastest way to leak customer data is to forward a raw user prompt straight to OpenAI. This guide shows the pattern we recommend at Privaro: detect entities, replace them with reversible tokens, call the model, then re-hydrate the response.

Why not just regex it?

Regex catches email addresses and credit cards. It misses names, addresses, medical conditions, internal identifiers and anything context-dependent. Real PII detection needs a hybrid of regex, dictionaries and an NER model. Building that in-house is a 3-month project; the PII detection API gets you there in a day.

The reversible tokenization pattern

Four steps:

• Detect — scan the prompt, return spans with entity type and confidence.
• Tokenize — replace each span with a stable placeholder like [EMAIL_1]. Store the mapping encrypted in a vault, keyed to the request ID.
• Send — forward the sanitized prompt to OpenAI. The model reasons about placeholders exactly like real values.
• Rehydrate — on the response, swap placeholders back to originals before returning to the user.

Minimal example

const protect = await fetch("https://api.privaro.ai/v1/protect", {
  method: "POST",
  headers: { "Authorization": `Bearer ${API_KEY}` },
  body: JSON.stringify({ text: userPrompt, policy: "strict" }),
});
const { safe_text, request_id } = await protect.json();

const completion = await openai.chat.completions.create({
  model: "gpt-4o",
  messages: [{ role: "user", content: safe_text }],
});

const rehydrate = await fetch("https://api.privaro.ai/v1/rehydrate", {
  method: "POST",
  headers: { "Authorization": `Bearer ${API_KEY}` },
  body: JSON.stringify({ text: completion.choices[0].message.content, request_id }),
});
const { text } = await rehydrate.json();
return text;

When to use irreversible masking instead

Tokenization is right when you need to display the original values back to the end user. For analytics prompts, log summarization or training data preparation you want irreversible masking — the mapping is discarded and the data cannot be re-identified.

What about latency?

A well-designed proxy adds 40–80 ms per call. In practice that is invisible next to the 500–2000 ms of the LLM call itself, and it is the price of not leaking a customer's national ID into someone else's training set.