PII Protection Policy Template

Automatically detect and redact personally identifiable information (PII) from AI agent requests before they reach the LLM provider, and from responses before they're logged. Protect email addresses, phone numbers, social security numbers, and custom patterns. Essential for GDPR, HIPAA, and SOC 2 compliance.

What this prevents

A customer support AI agent was asked to help a user update their billing information. The user pasted their full credit card number, email, and home address into the chat. The agent forwarded everything verbatim to GPT-4o — meaning the PII was stored in OpenAI's logs, the company's completion logs, and potentially in the model's context window for subsequent requests. A PII protection policy would have redacted the sensitive data before it left the company's infrastructure, replacing it with safe placeholder tokens.

Policy template

Copy this into your govyn.yaml and adjust the values to match your requirements.

govyn.yaml

agents:
  support_agent:
    pii:
      mode: redact
      patterns:
        - type: email
        - type: phone
        - type: ssn
        - type: credit_card
        - type: custom
          regex: "\\b[A-Z]{2}\\d{6,9}\\b"
          label: "passport_number"
      redact_in:
        - request
        - response
        - logs
      replacement: "[REDACTED:{type}]"
    logging:
      replay: true
      redact_pii: true
      retention_days: 30

How it works

Agent sends a request through Govyn

The AI agent sends a completion request containing user data. The request passes through Govyn before reaching the LLM provider.

PII scanner analyzes the request body

Govyn's PII engine scans the message content for known patterns: email addresses, phone numbers, SSNs, credit card numbers, and any custom regex patterns you've defined.

Detected PII is replaced with safe tokens

Each piece of PII is replaced with a labeled placeholder like [REDACTED:email] or [REDACTED:credit_card]. The original values are never sent to the LLM provider.

Response is scanned on the way back

The LLM's response is also scanned for PII before being returned to the agent. If the model hallucinates or echoes back sensitive data, it's caught and redacted.

Logs are stored with redacted data only

Govyn's replay logs contain only the redacted versions, so your audit trail is clean and compliant. No raw PII is ever written to disk.

Configuration options

Option	Description	Example
`pii.mode`	How to handle detected PII: redact, warn, or block	`redact`
`pii.patterns`	Built-in or custom PII patterns to detect	`email, phone, ssn, credit_card`
`pii.redact_in`	Where to apply redaction: request, response, logs	`[request, response, logs]`
`pii.replacement`	Template for the replacement text	`[REDACTED:{type}]`
`logging.retention_days`	How long to retain redacted logs	`30`

Add this policy to your config

Start Govyn with this policy in under 5 minutes. No code changes needed.

Get started

Related policy templates

Compliance Audit

Maintain complete audit trails for AI agent operations. Log every request, response, and policy decision for regulatory compliance.

External Comms Approval

Require human approval before AI agents send emails, messages, or external communications. Prevent unauthorized agent outreach.

Production Safety

Protect production environments from AI agent damage. Model restrictions, rate limits, and approval gates for high-risk operations.

Explore more

FROM OUR BLOG

How Replit's Database Deletion Could Have Been Prevented in 3 Lines of YAML

The Replit AI agent deleted a production database, fabricated 4,000 fake records, then lied about it. Three lines of policy YAML would have stopped it.

INTEGRATION

Python + Any Provider Integration

Add governance to any Python AI agent. Works with requests, httpx, and the OpenAI SDK. Budget limits, policy enforcement, full replay.

INTEGRATION

Node.js + Any Provider Integration

Govern custom Node.js AI agents with Govyn. Works with the OpenAI SDK, fetch, and Vercel AI SDK. Budget limits and full replay.

COMPARISON

Govyn vs Coralogix

Compare Govyn and Coralogix for AI agent governance. Proxy-level enforcement vs enterprise observability with AI monitoring.