Concept
Handling PII in a GenAI platform: entities, detection, logic, action
Not all AI platforms treat personal data with the same care. This is the four-part model our platforms use to detect and act on personally identifiable information before it reaches a model unsafely.
How it’s structured
Four stages, each answering a different question. Entities defines what counts as potentially PII-relevant in the first place: names, ID numbers, addresses, and sensitive categories like religion or political views. Detection checks whether a given input actually contains one of those entities, whether alone or in a revealing combination, using anything from simple pattern matching to a local LLM for more complex, contextual cases. Logic applies a client’s own rules to what detection found, weighing the entities involved, the model’s confidence, and the specific, permitted purpose of that request. Action is what actually happens as a result: anything from quiet anonymisation to stopping the request outright and alerting an administrator.
Where we use it
This model sits inside every CompanyGPT deployment, tuned to each client’s own policy rather than a single fixed rule set. It’s part of what lets us tell clients with genuinely sensitive data, a bank, a hospital, a public administration, that “AI” and “handles confidential information safely” aren’t in tension: the platform is built to make that distinction automatically, on every request, not left to a user’s judgement in the moment.