PII redaction

• Support, HR, healthcare, or finance workflows using AI.
• Training or fine-tuning on user data.
• Sharing logs with vendors or analytics tools.

Redaction reduces legal risk and speeds security reviews. PMs choose patterns to redact, acceptable recall/precision balance, and how to preserve utility after redaction. Over-redaction can hurt quality; under-redaction risks compliance.

Run PII detectors on ingress and egress; replace with tokens; store mapping securely if needed. In 2026, maintain per-country rules (GDPR, CCPA) and prove redaction efficacy via sampled audits in your eval harness.

Adding PII redaction before indexing support tickets cut leakage findings to zero in quarterly audits while answer accuracy dropped only 1.2%, an acceptable trade-off for enterprise contracts.

• Assuming provider-level redaction is enough; logs may still contain PII.
• Redacting after indexing, leaving sensitive data stored.
• Not auditing precision/recall, leading to silent failures.