PII is personally identifiable information: names, addresses, emails, phone numbers, account numbers and anything else that points to a real person. Three habits keep it safe in an LLM app.
1. Send only what you need#
If the task is "summarize this support ticket", strip everything the summary does not need before it goes into the prompt. Account numbers, phone numbers and addresses rarely help a summary.
Less PII in the prompt means less exposure if something goes wrong: an injection, a leak, or a logging mistake.
2. Redact or pseudonymize#
Replace personal details with placeholders before sending, and restore them afterwards.
| Step | Text |
|---|---|
| Original | "John Smith at 123 Main St complained about delivery." |
| Sent to the model | "Customer A at Address 1 complained about delivery." |
| Model reply | "Customer A's delivery was late. Offer a refund." |
| Shown to your agent | "John Smith's delivery was late. Offer a refund." |
The task gets done, and the real data never left your system. Your code keeps the mapping from placeholder to real value.
- Redact when the model never needs the value: remove it.
- Pseudonymize when the reply must refer to it: swap it for a placeholder and swap back.
3. Don't log raw PII#
Logs are long-lived, often poorly secured, and read by many people. If you log every prompt and response word for word, you are building a PII database inside your logging system.
| Log this | Not this |
|---|---|
| Token counts | Raw prompt text |
| Latency | Raw model responses |
| Model version | User names, emails, addresses |
| Prompt version | Pasted documents |
These fields are enough to debug cost, speed and regressions without storing personal data.
Short line#
Protect PII by sending the model only what the task needs, redacting or pseudonymizing personal details before the prompt and restoring them after, and logging token counts, latency, model version and prompt version instead of raw prompts and responses.
Key takeaways#
- Strip everything the task does not need before it reaches the prompt.
- Less PII in the prompt means less exposure when something goes wrong.
- Pseudonymize: replace names with placeholders, restore them after. Real data stays in your system.
- Redact values the model never needs.
- Don't log raw prompts and responses. Log token counts, latency, model version and prompt version.