PII Redaction

OpenDoor automatically detects and redacts personally identifiable information (PII) from all LLM request and response traffic. This helps your organization stay compliant with GDPR, HIPAA, CCPA, and other data protection frameworks without requiring code changes in downstream applications.

---

How It Works

When PII redaction is enabled on an API key, every message sent through the gateway is scanned before it reaches the LLM provider. Detected PII entities are replaced with a deterministic placeholder (e.g. <PERSON_1>, <PHONE_NUMBER_1>) so the provider never sees the raw value. On the return trip, the gateway reverses the substitution, restoring the original value in the response so your application receives data in the expected shape.

This approach is transparent: token counts reported back to you reflect the redacted payload, and streaming responses are intercepted and re-hydrated in real time.

---

Supported Entity Types

Additional entity types are added regularly. Enterprise customers can request custom entity patterns via support.

---

Enabling PII Redaction

Redaction is configured per API key, giving you fine-grained control over which workloads require protection.

Dashboard

1. Open API Keys in the left sidebar.
2. Select the key you want to configure.
3. Toggle PII Redaction to On.
4. Choose which entity types to detect (or leave All selected).
5. Save the key. The change takes effect immediately for new requests.

API

You can also enable redaction programmatically when creating or updating an API key:

bashCopy
curl -X PATCH https://api.opendoor.ai/v1/keys/sk-xxxxxxxx \
  -H "Authorization: Bearer YOUR_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "piiRedaction": {
      "enabled": true,
      "entities": ["person", "email", "phone_number", "credit_card"]
    }
  }'

---

Audit & Compliance

Every redaction event is logged to the request audit trail. You can view:

• Which entity types were detected in a request
• The number of redactions performed
• Whether any entity could not be reversed (e.g. the provider mutated the placeholder)

Enterprise plan organizations can export these logs via the Analytics → Exports page or the /api/analytics/export endpoint for SIEM ingestion.

---

Limitations

• Context windows: Redacted placeholders occupy tokens just like the original text. Very long PII-heavy payloads may use more tokens than expected.
• Reversibility: If an LLM provider rewrites a placeholder (e.g. translating <PERSON_1> to French), the original value cannot be restored. OpenDoor logs these cases as irreversible.
• Custom formats: Standard regex-based entities may miss domain-specific identifiers. Contact support for custom pattern onboarding.

---

Performance

PII scanning adds <5ms median latency to requests. It runs in-memory within the gateway container and does not call external services, so there is no additional network hop.