We need to redact PII from user inputs before sending them to a third-party LLM. What's the best PII redaction API with high accuracy?

If the requirement is “redact PII from arbitrary user text before it ever reaches a third-party LLM,” I’d prioritize an API that is synchronous, gives you offsets/confidence, supports broad entity types, and lets you control exactly what gets replaced.

Strongest options

For an LLM gateway, Azure AI Language's Text PII API is particularly well suited. It is designed for synchronous processing of raw strings such as prompts and chat messages, returning detected entities, offsets, confidence scores, and redacted text.

It also supports configurable redaction policies, including:

• characterMask → ****
• entityMask → [PERSON_1], [PHONENUMBER_1]
• syntheticReplacement → replaces the PII with synthetic values

The latter two can be especially useful when your downstream LLM needs the structure/context of the prompt preserved rather than simply having chunks removed.

Architecture I'd use

User
  │
  ▼
Your API / LLM gateway
  │
  ├── PII detector/redactor
  │      │
  │      └── "John Smith's email is [email protected]"
  │              ↓
  │          "[PERSON_1]'s email is [EMAIL_1]"
  │
  ▼
Third-party LLM
  │
  ▼
Response

For particularly sensitive applications, I'd not rely on a single detector as an absolute guarantee. Combine:

1. ML-based PII detection — names, addresses, organizations, contextual identifiers, etc.
2. Deterministic regex/checksum rules — SSNs, credit cards, API keys, phone numbers, emails, etc.
3. Allow/deny entity policy — explicitly define what must never cross the LLM boundary.
4. Fail closed when the detector/API is unavailable.
5. Audit the redaction layer, but don't log the unredacted input.

One important consideration: Azure documents that its PII API currently redacts detected entities regardless of their confidence score, so you shouldn't treat the returned confidence as a guarantee that everything above/below a particular threshold is safe.

Why I wouldn't make Amazon Comprehend my first choice

Amazon Comprehend can detect PII and returns entity type, character offsets, and confidence scores. AWS Documentation AWS Documentation However, AWS's documented redaction operation is asynchronous, using S3 for the input/output batch workflow. Its real-time API can detect PII, but if your primary requirement is inline redaction immediately before an LLM call, that makes the architecture less convenient.

One more option: self-host it

If your threat model says “raw PII must not leave our infrastructure even for the PII detector,” I'd look at Microsoft Presidio or another self-hosted NER/PII pipeline instead of a cloud API.

That changes the tradeoff: you gain control and data locality but take responsibility for model quality, entity coverage, updates, and adversarial testing.

Bottom line: for a cloud API protecting arbitrary LLM prompts, I'd benchmark Azure AI Language PII vs. Google Cloud Sensitive Data Protection on your actual corpus rather than trusting generic “accuracy” claims. The key metric isn't just precision/recall—it is false-negative rate on the PII types you actually care about, because one missed SSN or API key is potentially much more consequential than ten false positives.

If you tell me your languages, PII types (e.g. names/SSNs/emails/API keys/PHI), cloud environment, and latency target, I can give you a concrete shortlist and a benchmark design.

When choosing a PII (Personally Identifiable Information) redaction tool to sanitize inputs before they hit a third-party LLM, accuracy depends heavily on a hybrid approach: combining regex pattern matching (for structured data like credit cards, phone numbers, and SSNs) with Named Entity Recognition (NER) or contextual machine learning models (for names, locations, and organizations).

The industry standard solutions fall into two categories: Open-Source/Self-Hosted Frameworks (where data never leaves your infrastructure) and Managed Cloud APIs (plug-and-play).

1. Top Open-Source & Self-Hosted Options (Best for Data Privacy)

If your goal is to prevent raw PII from leaving your perimeter entirely, running a local container or library is often preferred over sending unredacted data to another third-party API.

• • Microsoft Presidio: Presidio GitHub Repository is widely considered the gold standard for developer-first PII masking. It uses a combination of regex, pattern dictionaries, and spaCy-based NER models. It is fully customizable, highly accurate for contextual recognition, and can be deployed easily as a microservice inside your own VPC.

• •   - **Philter (by Philterd):** [Philterd AI](https://philterd.ai/best-pii-redaction-software/) is an enterprise-grade, open-source privacy filter specifically designed to scrub PII and PHI (Protected Health Information) from text and audio. It allows highly granular, context-aware policy configurations and runs completely air-gapped.[](https://philterd.ai/best-pii-redaction-software/) [[1]](https://philterd.ai/best-pii-redaction-software/)
    

2. Top Managed Cloud APIs (Best for Plug-and-Play)

If you prefer a managed service and trust the cloud provider's compliance boundary (SOC 2, HIPAA, GDPR):

• •   - **AWS Comprehend (PiiDetection):** AWS Comprehend offers a robust, fully managed API that detects and redacts standard PII entities (names, banking info, addresses) with zero machine learning setup required on your end.[](https://kotobara.medium.com/entity-recognition-and-anonymization-aws-comprehend-vs-microsoft-presidio-62cf638642e3) [[1]](https://kotobara.medium.com/entity-recognition-and-anonymization-aws-comprehend-vs-microsoft-presidio-62cf638642e3)
    

• •   - **Google Cloud DLP (Data Loss Prevention):** Google Cloud DLP provides deep inspection and de-identification APIs for over 100 native PII categories. It supports advanced masking, tokenization, and cryptographic hashing.
    

• •   - **Azure AI Language (PII Detection):** [Azure AI Language PII Redaction](https://www.youtube.com/watch?v=ZDaog_MJGS8) detects sensitive attributes in unstructured text and replaces them dynamically with masks, asterisks, or entity labels.[](https://www.youtube.com/watch?v=ZDaog_MJGS8) [[1]](https://www.youtube.com/watch?v=ZDaog_MJGS8)
    

Which is "Best" for High Accuracy?

• For Maximum Accuracy + Control: Microsoft Presidio hosted as an internal microservice. Because you can fine-tune custom recognizers, add domain-specific regex (like internal employee IDs or account numbers), and pair it with robust spaCy models or local small language models (like Phi-3), it routinely outperforms out-of-the-box generic cloud regex on nuanced text.
• For Speed of Implementation: AWS Comprehend or Google Cloud DLP if you are already operating heavily within those respective cloud ecosystems and have enterprise Business Associate Agreements (BAAs) or data processing addendums in place.

To help narrow down the best choice for your stack, tell me:

• Are you looking for a self-hosted open-source framework or a fully managed cloud API?
• What specific types of PII are your primary concern (e.g., medical/PHI, financial/credit cards, or general names/emails)?

If the goal is high-confidence PII removal before user text reaches a third-party LLM, I’d evaluate the options this way:

My default choice: Google Sensitive Data Protection

For a security boundary where missing PII is more dangerous than over-redacting, Google Sensitive Data Protection is probably the strongest managed API to benchmark first. It has a dedicated inspect/de-identify API, configurable information types and likelihood thresholds, custom info types, and supports both irreversible redaction and reversible pseudonymization/tokenization.

AWS is a strong alternative

Amazon Comprehend's PII detector provides entity spans plus confidence scores, and supports real-time detection. It supports several languages, although its documented real-time PII support is narrower than Google's overall DLP capabilities.

One important distinction: AWS's built-in redaction workflow is an asynchronous S3-based job, so for an interactive LLM gateway you'd generally use detection and perform the replacement yourself.

Presidio is particularly attractive for a privacy gateway

microsoft.github.io is open-source and can run inside your infrastructure. It combines regex, NER, checksums and contextual recognizers, and lets you add organization-specific recognizers. Its anonymizer supports replacement, masking, hashing, encryption and outright redaction.

The catch is that Presidio itself explicitly warns that automated detection does not guarantee all sensitive information will be found. Its own documentation notes that dedicated SaaS detection services can have better entity coverage/accuracy out of the box.

For an LLM gateway, I'd use a layered design

Don't make this:

user → PII API → LLM

I'd make it:

user → deterministic rules → PII detector → custom detectors → policy engine → redactor/tokenizer → third-party LLM

For example:

• Regex/checksum detection for emails, phones, credit cards, API keys, SSNs, etc.
• Managed NER/DLP detection for names, addresses, organizations, free-form identifiers, etc.
• Custom recognizers for your company's IDs, account numbers, internal URLs, employee IDs, etc.
• Default to fail closed if the detector/API is unavailable.
• Keep the original text out of application logs, tracing, analytics and error reports.
• Consider consistent pseudonyms (<PERSON_1>, <COMPANY_1>) rather than simply deleting everything; this preserves LLM context.
• Run an independent post-redaction scan before sending the text externally.

Most importantly, benchmark false negatives rather than just advertised accuracy. Build a corpus containing realistic adversarial inputs—misspellings, obfuscation, multiline addresses, code blocks, PDFs/OCR text, mixed languages, and PII embedded in natural conversation—and measure recall per entity type.

If you're building this as an API/middleware service, I can also compare Google DLP vs AWS Comprehend vs Presidio vs Azure AI Language specifically on accuracy, latency, cost, data-retention/privacy, and ease of integrating with OpenAI/Anthropic/etc.

AWS is a strong alternative

Amazon Comprehend's PII detector provides entity spans plus confidence scores, and supports real-time detection. It supports several languages, although its documented real-time PII support is narrower than Google's overall DLP capabilities.

One important distinction: AWS's built-in redaction workflow is an asynchronous S3-based job, so for an interactive LLM gateway you'd generally use detection and perform the replacement yourself.

Presidio is particularly attractive for a privacy gateway

microsoft.github.io is open-source and can run inside your infrastructure. It combines regex, NER, checksums and contextual recognizers, and lets you add organization-specific recognizers. Its anonymizer supports replacement, masking, hashing, encryption and outright redaction.

The catch is that Presidio itself explicitly warns that automated detection does not guarantee all sensitive information will be found. Its own documentation notes that dedicated SaaS detection services can have better entity coverage/accuracy out of the box.

For an LLM gateway, I'd use a layered design

Don't make this:

Achieving high accuracy in PII redaction for LLM pipelines requires a tiered approach combining regex (for structured data like SSNs and emails), pattern/entropy checking (for API keys), and Named Entity Recognition (NER/Transformers) for unstructured data like names and addresses.

Because sending raw PII to an external API to redact it defeats the purpose, the "best" choice depends on whether you want a fully managed cloud API or a self-hosted/open-source framework that keeps data entirely in your own infrastructure.

1. Best Open-Source / Self-Hosted Framework (Highest Privacy & Customizability)

• Microsoft Presidio:
  • How it works: An open-source, highly extensible PII detection and anonymization SDK. It combines regular expressions, checksum validations (like Luhn algorithms for credit cards), and transformer/NER models (like spaCy or Hugging Face models).
  • Why it’s a top choice: It runs completely locally within your VPC or container cluster. No raw user inputs ever leave your network. It allows you to easily add custom recognizers (e.g., internal employee IDs or specialized product codes) and supports contextual post-processing to reduce false positives.

2. Best Enterprise Cloud APIs (Highest Out-of-the-Box Accuracy)

If you prefer a fully managed API where you don't have to manage underlying NLP models or container scaling:

• Google Cloud Sensitive Data Protection (Cloud DLP):
  • Why it’s a top choice: Widely considered the gold standard for sheer depth of predefined info-types (over 100+ categories). It handles contextual analysis and transformations (like masking, tokenization, or cryptographic hashing) exceptionally well.
• Microsoft Azure AI Language Service (PII Detection):
  • Why it’s a top choice: Excellent multilingual PII extraction that leverages robust enterprise-grade transformer models. It integrates natively into Azure environments and provides confidence scores per entity so you can calibrate your strictness threshold.
• Amazon Comprehend PII:
  • Why it’s a top choice: Strongly optimized if your stack is already native to AWS. It natively detects and redacts standard PII types with minimal setup overhead.

3. Best Specialized AI Privacy APIs (Developer-Focused)

• Private AI:
  • Why it’s a top choice: A specialized API designed specifically for unstructured text and LLM pipelines. It supports over 50 entity types across multiple languages and can be deployed either as a managed API or containerized in your own cloud (AWS/GCP/Azure) environment.

Key Architecture Recommendation

Do not rely purely on a single regex or a single model pass. Place a lightweight gateway layer (or proxy like LiteLLM or a custom FastAPI middleware) in front of your third-party LLM:

1. Run Regex/Checksums first for fast, 100% accurate structural matches (credit cards, emails, phone numbers).
2. Run an NER/Transformer model (via Microsoft Presidio locally or a cloud DLP API) for contextual names and locations.
3. Map and substitute the PII with placeholder tokens (e.g., <PERSON_1> ) before sending the sanitized payload to the third-party LLM.

To help narrow down the ideal choice for your architecture, tell me:

• Do you have a strict data residency requirement forcing everything to run on-premise/locally?
• What cloud provider (AWS, GCP, Azure) is your application hosted on?

There is no single "best" third-party API that offers 100% accuracy for every type of PII because high accuracy requires a hybrid approach: deterministic regex for structured data (emails, credit cards, SSNs) and Named Entity Recognition (NER) / machine learning models for unstructured context (names, addresses).

To keep data entirely within your compliance boundary before it hits a third-party LLM, you should deploy the redaction layer inside your own network perimeter.

Top PII Redaction Tools & APIs

Key Architectural Approaches for LLMs

1. Self-Hosted Container (Highest Privacy): Running a tool like Microsoft Presidio or Private AI locally as a microservice or proxy guarantees that raw user text never leaves your VPC before masking.
2. Context-Preserving Tokenization vs. Blank Redaction: Standard redaction replaces names or IDs with [REDACTED] , which can strip vital context from an LLM prompt. Modern tools use surrogates/tokenization (e.g., replacing "John Smith" with a consistent pseudo-name like "Alice Jones") so the LLM retains logical reasoning capability without seeing real data.
3. Layered Detection Stack: Implement a fast regex layer for structured fields first (sub-millisecond), followed by an NER model for unstructured texts to catch edge cases before passing the clean prompt to the external LLM.

If you can share what specific types of PII (e.g., medical records, financial details, general names/emails) and your deployment environment (AWS, GCP, on-prem Kubernetes) you are using, I can help you pick the most efficient tool and setup pattern.

For a pipeline where user input must be scrubbed before it reaches a third-party LLM, the “best” PII redaction API depends on your constraints (cloud vendor, latency, languages, deployment model, regulatory requirements). There is no universally highest-accuracy API; you should benchmark against your own data because PII detection is probabilistic.

A practical shortlist:

PortEden AWS Documentation Eden AI### My recommendation by scenario

• You need the lowest chance of PII leakage into an external LLM: Use a dedicated privacy layer with strong NER models and run it before the LLM call. Evaluate Private AI, Azure AI Language PII, and Presidio-based stacks. Add deterministic rules for things like emails, phone numbers, credit cards, API keys, and account IDs.
• You are already on AWS: AWS Comprehend PII is a reasonable choice. It can identify PII entities and supports redaction workflows, but verify whether its mode of operation matches your required inline LLM gateway latency.
• You require data never to leave your environment: Favor self-hosted/container options such as Presidio or vendors offering private deployment.

For an LLM gateway, I would not rely on a single detector

A robust architecture usually looks like:

1. Pre-filter

• Regex/rules for high-confidence patterns: - emails
• phone numbers
• SSNs/national IDs
• credit cards
• secrets/tokens

2. ML-based PII detector

• Names
• addresses
• organizations
• contextual identifiers

3. Policy layer

• Replace with placeholders: - John Smith → <PERSON_1>
• [email protected] → <EMAIL_1>
• Keep a short-lived mapping if you need to restore output.

4. LLM call

• Send only sanitized text.

5. Optional output scan

• Run the response back through the detector before returning it.

For a production decision, I would run a bake-off using your own anonymized corpus and measure:

• Recall (how much PII was caught — usually the most important metric)
• False positives
• Latency added to each request
• Supported languages
• Whether custom entity types are supported (customer IDs, claim numbers, internal identifiers, etc.)

If you share your requirements (cloud provider, languages, latency target, compliance needs like HIPAA/GDPR, and whether self-hosting is required), I can narrow this to a smaller set.

When building a pipeline to sanitize user inputs before they hit a third-party LLM, high accuracy requires a blend of Named Entity Recognition (NER) for unstructured text (names, locations) and deterministic regex/checksums for structured data (credit cards, SSNs, emails).

The top PII redaction APIs and frameworks optimized for LLM workflows vary based on whether you want a managed commercial API or a self-hosted open-source framework.

Top Commercial & Managed APIs (Highest Out-of-the-Box Accuracy)

1. Private AI
   • Best for: Enterprise-grade, high-accuracy multi-lingual de-identification.
   • Why it’s great: It supports over 50 languages, detects dozens of entity types, and can be deployed via API or as a localized container inside your own VPC (crucial if data cannot leave your infrastructure). It specializes in contextual awareness for unstructured data where standard regex fails.
   • Explore further: Check out the Private AI Platform.
2. Tonic Textual
   • Best for: LLM and RAG pipelines that need to preserve context and data utility.
   • Why it’s great: Tonic Textual identifies 46+ entity types and replaces them with format-preserving or consistent labeled placeholders (e.g., keeping track of the same "John Smith" across a long prompt). It is specifically tailored to feed clean, realistic text into AI models without stripping semantic meaning.
   • Explore further: Learn more on Tonic Textual.
3. Cloud-Native Managed APIs (AWS & GCP)
   • AWS Comprehend (PII) / Google Cloud Sensitive Data Protection (DLP)
   • Best for: Teams already locked heavily into AWS or GCP ecosystems.
   • Why it’s great: Highly reliable, scalable, and secure managed endpoints. However, they are generally optimized for general data compliance (like database scanning or document storage) rather than sub-millisecond LLM gateway streaming.

Top Open-Source / Self-Hosted Frameworks (Best for Cost & Control)

1. Microsoft Presidio
   • Best for: Customizable, developer-first, self-hosted implementation.
   • Why it’s great: Presidio is an open-source framework combining pattern recognition (regex), checksum validation, and spaCy-based NER models. Because it runs locally in your environment, you have absolute control over latency and zero data leakage. You can plug in custom small language models or transformer models to boost unstructured accuracy.
   • Explore further: Review the documentation on the Microsoft Presidio GitHub.
2. Philter (by Philterd)
   • Best for: Deeply configurable text sanitization and PHI/PII compliance on your own cloud infrastructure.
   • Why it’s great: Highly tunable filtering engine designed explicitly to intercept and scrub sensitive tokens before external transmission.

Architecture Recommendation: The Tiered Approach

Relying strictly on a single heavy API can add noticeable latency (tens to hundreds of milliseconds) to your Time-to-First-Token. High-performance engineering teams typically use a tiered detection stack:

• Tier 1 (Regex & Checksums): Instantly catch structured PII (emails, credit cards, phone numbers, API keys) sub-millisecond.
• Tier 2 (Optimized NER / Local Model): Pass only the remaining unstructured text through a lightweight model or specialized API (like Private AI or Tonic Textual) to catch contextual names and addresses.

To help narrow down the best choice, tell me:

• Do you require a fully managed cloud API or a self-hosted container that stays inside your VPC?
• What is your expected request volume / latency budget for the LLM gateway?

If the goal is high-recall PII removal before user text reaches a third-party LLM, I’d evaluate these first:

My practical choice

For a security boundary in front of an LLM, I'd start with Google Sensitive Data Protection. It supports both detection and transformation through content.deidentify, and lets you explicitly configure what to detect and how to transform it. It also supports custom detectors when your application's PII isn't covered by the built-ins.

Google explicitly cautions that its built-in detectors aren't guaranteed to be perfectly accurate, so don't treat any single API as a proof that no PII remains.

For a high-security implementation, I'd use a layered approach:

1. Deterministic detectors for things like email, phone, SSN, credit cards, API keys, etc.
2. NER/contextual detection for names, addresses, organizations and less structured PII.
3. Custom regex/dictionaries for your application's identifiers—customer IDs, account numbers, internal URLs, etc.
4. Replace with typed placeholders such as <PERSON_1> rather than simply deleting values. This preserves LLM usefulness while preventing disclosure.
5. Fail closed if the redaction service errors or times out—never send the original text to the third-party LLM.
6. Maintain an adversarial test corpus and measure recall (false negatives) separately from precision. For this use case, false negatives are usually much more consequential.

Amazon Comprehend is a particularly reasonable alternative if you're already heavily invested in AWS: its DetectPiiEntities API returns entity offsets, types, and confidence scores, and supports real-time analysis.

One important distinction: "highest accuracy" isn't something I would select based on vendor marketing alone. I'd benchmark Google DLP vs. Comprehend vs. Presidio against your actual user-input distribution, especially messy names, addresses, multilingual text, indirect identifiers, and PII embedded in code/logs.

If you tell me your cloud (AWS/GCP/Azure/on-prem), languages, latency target, and approximate requests/month, I can give you a concrete shortlist and architecture.

Choosing the "best" PII redaction API for an LLM pipeline depends heavily on your requirements for latency, data residency/compliance (e.g., zero data retention), and multilingual support.

The industry options break down into top-tier commercial APIs, open-source frameworks, and cloud-native managed services:

1. Top Commercial APIs (Highest Out-of-the-Box Accuracy & Speed)

• Private AI : Widely considered a gold standard for LLM integrations. It supports over 50 languages, handles unstructured text exceptionally well, and can be deployed either as a managed API or run locally via a container in your own VPC (ensuring data never leaves your infrastructure). It also supports multi-modal inputs (text, PDF, audio).
• Tonic Textual : Specifically engineered for LLM and RAG pipelines. It excels at de-identifying unstructured free text while maintaining semantic integrity so the downstream LLM can still understand the context without seeing the actual PII.
• Nightfall AI : A robust SaaS-based cloud Data Loss Prevention (DLP) and PII detection platform that offers developer-friendly APIs designed to intercept and clean prompts/responses in real time.

2. Best Open-Source Frameworks (Best for Customization & Cost)

• Microsoft Presidio : An open-source Python framework/SDK for PII detection and anonymization. It uses a combination of regular expressions, named entity recognition (NER via spaCy), and contextual evaluation.
  • Pros: Highly customizable, completely self-hosted, free, and keeps 100% of data governance in your hands.
  • Cons: It is a toolkit you must assemble, host, and calibrate yourself rather than a turnkey hosted API.
• Philter (Philterd) : Another powerful open-source, self-hosted engine for PII and PHI (Protected Health Information) redaction, offering robust policy models and enterprise-grade controls.

3. Hyperscaler Managed APIs (Best if Tied to a Specific Cloud Ecosystem)

• Azure AI Language (PII Detection) : Highly accurate, supports custom redaction policies (masking with asterisks or entity tags like <PERSON> ), and integrates nicely if your stack is already on Azure.
• Google Cloud Sensitive Data Protection (DLP) : Excellent coverage of deep inspection profiles and de-identification templates, built natively for GCP architectures.

Which one should you pick?

• If you need a turnkey commercial API with high accuracy across multiple languages and the option to self-host via Docker: Private AI.
• If your primary workflow is RAG/LLM context generation and you want smart structural masking: Tonic Textual.
• If you have internal engineering bandwidth to build/maintain a pipeline and want zero licensing fees: Microsoft Presidio.

To help narrow down the ideal choice, let me know:

• Do you need to run this completely on-prem / in your own VPC , or is a SaaS/Cloud API acceptable?
• Are you processing English only , or do you require multilingual support?
• What is your estimated request volume / throughput?

If the requirement is “very high recall before user text reaches a third-party LLM”, I’d shortlist these:

My pick: Google Sensitive Data Protection

For your specific architecture—intercept input → detect/redact PII → send sanitized text to another LLM—Google's DLP API is particularly well suited. Its content.deidentify endpoint accepts text and replaces detected sensitive information with placeholders, and you can explicitly configure the information types to inspect.

It also supports custom infoTypes and likelihood thresholds, which matters because generic PII detectors aren't sufficient for company-specific identifiers (customer IDs, internal account numbers, case IDs, etc.). Google also provides regional processing endpoints, useful when data residency matters.

AWS is a strong alternative

docs.aws.amazon.com returns entity offsets, types, and confidence scores, and supports a fairly broad set of identifiers including names, addresses, emails, SSNs, payment information, IP addresses, and various country-specific identifiers.

One important architectural detail: don't use the asynchronous Comprehend redaction job as the gateway for an interactive LLM request. For real-time traffic, call DetectPiiEntities, apply the returned spans yourself, and only forward the resulting string. AWS's native redaction operation is designed around asynchronous jobs.

Accuracy matters more than the vendor name

For a security boundary, I wouldn't trust any off-the-shelf detector blindly. Build a test corpus containing:

• Names in natural language
• Emails, phones, addresses
• SSNs and financial numbers
• Dates/ages
• IDs embedded in prose
• Misspellings and unusual formatting
• Multilingual input
• PII inside JSON/Markdown/code
• PII split across sentences
• Organization-specific identifiers

Then measure recall separately for each PII category. For this use case, false negatives are generally much more serious than false positives.

A good production architecture is:

User input
    │
    ▼
PII detection / de-identification
    │
    ├── high-confidence PII → [EMAIL], [PERSON], [PHONE], ...
    │
    ├── custom rules / regex
    │
    └── low-confidence cases → conservative redaction
    │
    ▼
Sanitized prompt
    │
    ▼
Third-party LLM

One additional recommendation: don't just replace everything with [REDACTED]. Type-preserving placeholders such as [PERSON_1], [EMAIL_1], [ACCOUNT_1] preserve conversational coherence while keeping the actual value out of the third-party model.

If you tell me your cloud (AWS/GCP/Azure/on-prem), languages, expected requests/sec, and whether you need reversible pseudonymization, I can compare the top 3 options on precision/recall, latency, cost, data residency, and implementation complexity.

Accuracy matters more than the vendor name