> ## Documentation Index
> Fetch the complete documentation index at: https://docs.knoxcall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PII Redaction

> True mid-stream PII redaction with reversible tokenization: a sliding hold-back FSM rewrites sensitive data inside the live SSE stream, and can restore it on the response.

# PII Redaction

Most gateways can only inspect an AI response *after* it finishes (buffering) or *log* what they saw (monitoring). KnoxCall redacts **inside the live stream**: as SSE frames flow from the provider to your app, sensitive spans are rewritten before they leave the gateway.

## How it works

### The detector stack

Each candidate text span is screened by a layered detector stack, fastest first:

1. **Aho-Corasick** multi-pattern scan for known literals and keywords.
2. **Regex + checksum** validators for structured identifiers — credit cards (Luhn), IBAN, US SSN, email, E.164 phone numbers, JWTs, and known provider API-key shapes.
3. **[Presidio](#presidio-optional)** (optional) — a named-entity recognizer sidecar for names, locations, and other NER-based entities.

Higher-precision tiers win overlap ties, so a span matched by a checksum validator is not double-counted by a looser NER match.

### Streaming hold-back

Streaming redaction uses a **sliding hold-back buffer**: the gateway holds back the last N characters of the stream (default 96) so a sensitive token that straddles two SSE frames is still caught before any part of it is emitted. The buffer is SSE-frame-aware for both Anthropic and OpenAI event shapes, so redaction never corrupts the event framing.

### Reversible tokenization

When a policy uses reversible tokenization, each detected span is replaced with a stable placeholder token, and the original value is stored in a per-conversation **encrypted token map** (`ai_gateway_pii_token_map`). On the response path, the gateway can **detokenize** — restoring the original values for the end user while keeping them out of the provider's logs and out of any [cache](/ai-gateway/observability).

Scope the map across turns with the `X-KC-Conversation-Id` request header, so a value tokenized on turn 1 restores consistently on turn 5.

<Note>
  Because reversible tokenization keeps a per-conversation map, it interacts with caching: semantic caching is disabled while reversible tokenization is active for a conversation, to avoid leaking one conversation's values into another.
</Note>

## Presidio (optional)

For NER-based entities, add a **Presidio** sidecar as a tenant Integration:

1. Deploy the Presidio sidecar (see `docker/presidio-sidecar/`).
2. In **Settings → Integrations → Presidio**, set the sidecar URL, timeout, and score threshold.

The gateway resolves the sidecar per tenant from your Integration config (never an environment variable), and merges Presidio matches into the sync detector stack on the **buffered outbound request path**. A slow or unavailable sidecar is skipped by a circuit breaker — redaction fails safe, never open.

## PII events

Every redaction (and every skipped detection in monitor mode) is written to the `ai_gateway_pii_events` ledger with the entity type, detector, direction (request/response), and action. [Compliance-pack](/ai-gateway/compliance-packs) alert rules can count these — e.g. *"alert when an SSN appears in a response"* — and they feed [evidence exports](/ai-gateway/compliance-packs).

## Configure a policy

PII policies and recognizers are managed on the **PII tab** of the gateway detail page. A policy selects which entity types to detect, whether to redact or tokenize, and whether responses are detokenized. Attach a policy to an agent to activate it.