How do you handle PII and sensitive data when calling LLM APIs?

// Redact PII before an LLM call, keep the mapping local, rehydrate the reply.
// Regex + checksum detectors, a known-names list standing in for NER, typed placeholders,
// keyed HMAC tokens for logs. The model is a stub; nothing leaves this process.
const crypto = require("crypto");

const TICKET = "Hi, this is Maria Lopez. My card 4111 1111 1111 1111 was charged twice for order " +
  "1234 5678 9012 3456. Email me at maria.lopez@example.com or call +49 151 2345 6789. " +
  "My neighbour Tom Becker took the parcel in. Login came from 203.0.113.42.";
const KNOWN_NAMES = ["Maria Lopez"];          // from the CRM record of this customer
const TRUTH = ["Maria Lopez", "4111 1111 1111 1111", "maria.lopez@example.com", "+49 151 2345 6789", "Tom Becker", "203.0.113.42"];
const LOG_KEY = "demo-key-rotate-me";         // in production: from a secrets manager

function luhn(digits) {
  let sum = 0;
  for (let i = 0; i < digits.length; i++) {
    let d = Number(digits[digits.length - 1 - i]);
    if (i % 2 === 1) { d *= 2; if (d > 9) d -= 9; }
    sum += d;
  }
  return sum % 10 === 0;
}

const DETECTORS = [                          // order matters: most specific first
  ["EMAIL", /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, v => true],
  ["CARD", /\b(?:\d[ -]?){12,18}\d\b/g, v => luhn(v.replace(/\D/g, ""))],
  ["IP", /\b\d{1,3}(?:\.\d{1,3}){3}\b/g, v => v.split(".").every(p => Number(p) <= 255)],
  ["PHONE", /\+\d{1,3}(?:[ -]?\d{2,4}){2,4}/g, v => true],
];

function redact(text) {
  const vault = new Map(), counts = {}, byValue = new Map();
  const place = (type, value) => {
    if (byValue.has(value)) return byValue.get(value);   // same value -> same placeholder
    counts[type] = (counts[type] || 0) + 1;
    const ph = `<${type}_${counts[type]}>`;
    vault.set(ph, { type, value }); byValue.set(value, ph);
    return ph;
  };
  for (const [type, re, valid] of DETECTORS) text = text.replace(re, m => (valid(m) ? place(type, m) : m));
  for (const name of KNOWN_NAMES) text = text.split(name).join(place("PERSON", name));
  return { text, vault };
}

function rehydrate(reply, vault) {
  const unknown = [];
  const out = reply.replace(/<([A-Z]+)_(\d+)>/g, ph => {
    const v = vault.get(ph);
    if (!v) { unknown.push(ph); return "[removed]"; }
    if (v.type === "CARD") return "card ending " + v.value.replace(/\D/g, "").slice(-4);  // never echo a full card
    return v.value;
  });
  return { out, unknown };
}

const logToken = v => "tok_" + crypto.createHmac("sha256", LOG_KEY).update(v.toLowerCase()).digest("hex").slice(0, 10);

function fakeModel(prompt) {                 // stands in for the provider call
  return "Hello <PERSON_1>, sorry about the double charge on <CARD_1>. We will refund it and confirm " +
    "by email to <EMAIL_1>. We will not call <PHONE_2>.";
}

const { text, vault } = redact(TICKET);
console.log("sent to provider:\n  " + text);
console.log("vault (stays local): " + [...vault.keys()].join(" "));
console.log("order number kept: " + text.includes("1234 5678 9012 3456") + " (16 digits but fails the Luhn check)");
const missed = TRUTH.filter(t => text.includes(t));
console.log("PII that still left the boundary: " + (missed.length ? missed.join(", ") : "none"));

const reply = fakeModel(text);
const { out, unknown } = rehydrate(reply, vault);
console.log("\nmodel reply (placeholders only):\n  " + reply);
console.log("rehydrated for the customer:\n  " + out);
console.log("unknown placeholders from the model: " + (unknown.join(", ") || "none"));

console.log("\nlog tokens (keyed HMAC, linkable but not reversible without the key):");
for (const v of ["maria.lopez@example.com", "Maria.Lopez@example.com", "tom@example.com"])
  console.log(`  ${v.padEnd(24)} -> ${logToken(v)}`);