Skip to main content

​
PII Redaction

Most gateways can only inspect an AI response after it finishes (buffering) or log what they saw (monitoring). KnoxCall redacts inside the live stream: as SSE frames flow from the provider to your app, sensitive spans are rewritten before they leave the gateway.

​
How it works

​
The detector stack

Each candidate text span is screened by a layered detector stack, fastest first:
  1. Aho-Corasick multi-pattern scan for known literals and keywords.
  2. Regex + checksum validators for structured identifiers — credit cards (Luhn), IBAN, US SSN, email, E.164 phone numbers, JWTs, and known provider API-key shapes.
  3. Presidio (optional) — a named-entity recognizer sidecar for names, locations, and other NER-based entities.
Higher-precision tiers win overlap ties, so a span matched by a checksum validator is not double-counted by a looser NER match.

​
Streaming hold-back

Streaming redaction uses a sliding hold-back buffer: the gateway holds back the last N characters of the stream (default 96) so a sensitive token that straddles two SSE frames is still caught before any part of it is emitted. The buffer is SSE-frame-aware for both Anthropic and OpenAI event shapes, so redaction never corrupts the event framing.

​
Reversible tokenization

When a policy uses reversible tokenization, each detected span is replaced with a stable placeholder token, and the original value is stored in a per-conversation encrypted token map (ai_gateway_pii_token_map). On the response path, the gateway can detokenize — restoring the original values for the end user while keeping them out of the provider’s logs and out of any cache. Scope the map across turns with the X-KC-Conversation-Id request header, so a value tokenized on turn 1 restores consistently on turn 5.
Because reversible tokenization keeps a per-conversation map, it interacts with caching: semantic caching is disabled while reversible tokenization is active for a conversation, to avoid leaking one conversation’s values into another.

​
Presidio (optional)

For NER-based entities, add a Presidio sidecar as a tenant Integration:
  1. Deploy the Presidio sidecar (see docker/presidio-sidecar/).
  2. In Settings → Integrations → Presidio, set the sidecar URL, timeout, and score threshold.
The gateway resolves the sidecar per tenant from your Integration config (never an environment variable), and merges Presidio matches into the sync detector stack on the buffered outbound request path. A slow or unavailable sidecar is skipped by a circuit breaker — redaction fails safe, never open.

​
PII events

Every redaction (and every skipped detection in monitor mode) is written to the ai_gateway_pii_events ledger with the entity type, detector, direction (request/response), and action. Compliance-pack alert rules can count these — e.g. “alert when an SSN appears in a response” — and they feed evidence exports.

​
Configure a policy

PII policies and recognizers are managed on the PII tab of the gateway detail page. A policy selects which entity types to detect, whether to redact or tokenize, and whether responses are detokenized. Attach a policy to an agent to activate it.