{"id":178,"date":"2026-09-21T08:00:39","date_gmt":"2026-09-21T08:00:39","guid":{"rendered":"https:\/\/www.dobryakov.net\/blog\/178\/"},"modified":"2026-09-21T08:00:39","modified_gmt":"2026-09-21T08:00:39","slug":"ai-governance-privacy-zdr","status":"publish","type":"post","link":"https:\/\/www.dobryakov.net\/blog\/178\/","title":{"rendered":"How to Keep Customer PII Out of LLM Provider Logs"},"content":{"rendered":"<p>An employee pastes a customer&#x27;s bank statement into an AI assistant to draft a reply. The statement contains a name, passport number, IBAN, address, and transaction amounts. The assistant calls a cloud model. From this point, the customer&#x27;s PII has physically left the perimeter and sits in the provider&#x27;s infrastructure \u2014 at minimum in active processing, and by default in abuse-monitoring logs for 30 days. The customer never consented to this transfer.<\/p>\n<p>This is the single most common way companies violate GDPR through AI. Not through malice, but because nothing stood in the request path to strip the data before the model call.<\/p>\n<p><!--more--><\/p>\n<h2>The Data Plane: Architecture<\/h2>\n<p>This architecture is for a data-plane engineer operating under GDPR and banking secrecy. Your job is to guarantee that the model never sees real PII, and that the company can prove it.<\/p>\n<p>The cost of a leak is not an abstract fine. It is a combination of GDPR sanctions, banking-secrecy violations, and loss of regulatory trust. The data plane is the control layer that prevents the company&#x27;s confidential data and users&#x27; PII from leaking into provider logs or feeding into public model training.<\/p>\n<p>Three promises define the plane:<\/p>\n<ol>\n<li>PII and banking secrets never leave the perimeter in plaintext.<\/li>\n<li>The provider does not store prompts and does not train on them (Zero Data Retention).<\/li>\n<li>A customer&#x27;s right to erasure (GDPR Art. 17) is not broken by data having leaked into a third party&#x27;s training corpus and becoming irretrievable.<\/li>\n<\/ol>\n<h2>The Threat Model<\/h2>\n<p>Sending PII to an LLM provider without a legal basis or non-retention guarantees violates GDPR Art. 5 (data minimization, storage limitation), Art. 25 (privacy by design), and Art. 32 (security of processing). Cross-border transfer adds Chapter V requirements.<\/p>\n<p>Provider logs are the immediate trap. Storing prompts for abuse monitoring is an export of PII to a third party, regardless of whether anyone reads them. If PII enters a training corpus, the right to erasure becomes legally unenforceable \u2014 a dead end. The EU AI Act (Art. 10, data governance for high-risk systems) overlaps with these GDPR requirements.<\/p>\n<h2>Architectural Pattern: In-Flight Anonymization Gateway + ZDR<\/h2>\n<p>Put a layer in front of the LLM call that de-identifies data on the way in and restores it on the way out, plus a contractual Zero Data Retention agreement as a second line of defense. The model works with placeholders; real values live inside the perimeter for a fraction of a second.<\/p>\n<pre><code>              \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Anonymization Gateway \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n &quot;Ivanov I.I.,\u2502  detect (NER+regex) \u2192 mask \u2192 &lt;PERSON_1&gt;    \u2502\n  IBAN RS35\u2026&quot; \u2502        \u2502                                    \u2502  masked prompt\n \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25ba\u2502        \u25bc                                    \u2502\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25ba LLM (ZDR)\n              \u2502  mapping \u2192 Redis (TTL = request lifetime)    \u2502\u25c4\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n              \u2502        \u25b2                                    \u2502  masked answer\n &quot;Dear        \u2502  unmask \u25c4\u2500\u2500 mapping                         \u2502\n  Ivanov I.I.&quot;\u2502                                             \u2502\n \u25c4\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518<\/code><\/pre>\n<h2>Engineering Stack<\/h2>\n<ul>\n<li><strong>PII\/NER detection<\/strong>: Microsoft Presidio (open, MIT; current release 2.2.362, March 2026; 50+ entity types; swappable NLP backends \u2014 spaCy \/ ONNX \/ Stanza \/ HuggingFace). Private AI and AWS Comprehend PII as alternatives. Regex for structured entities (IBAN, national ID, passport, card).<\/li>\n<li><strong>Gateway<\/strong>: LiteLLM Proxy (native Presidio integration) or a custom FastAPI layer.<\/li>\n<li><strong>Mapping store<\/strong>: Redis with a short TTL.<\/li>\n<li><strong>ZDR<\/strong>: enterprise contracts (Azure OpenAI, Anthropic \/ OpenAI Enterprise, AWS Bedrock) with Zero Data Retention and prompt logging disabled, spelled out in the DPA.<\/li>\n<\/ul>\n<h2>Implementation<\/h2>\n<h3>Step 1. The Gateway Is the Only Door<\/h3>\n<p>Direct LLM calls from services are forbidden by network policy. Everything routes through the gateway. Any developer who calls the API directly bypasses the entire data plane.<\/p>\n<h3>Step 2. Detection and Reversible Masking<\/h3>\n<p>NER and regex find entities. Each is replaced with a typed placeholder, and the reverse mapping is stored in Redis under the <code>trace_id<\/code> key \u2014 the same ID used in the audit trail:<\/p>\n<pre><code class=\"language-python\">results = analyzer.analyze(text=prompt, language=&quot;en&quot;)   # Presidio NER\nmasked, mapping = reversible_mask(prompt, results)        # &lt;PERSON_1&gt;, &lt;IBAN_1&gt;...\nredis.setex(f&quot;pii:{trace_id}&quot;, TTL_SECONDS, json.dumps(mapping))\n\nresp = llm.call(masked, extra_headers={&quot;x-zdr&quot;: &quot;true&quot;})\nanswer = unmask(resp, json.loads(redis.get(f&quot;pii:{trace_id}&quot;)))<\/code><\/pre>\n<h3>Step 3. Fail-Closed<\/h3>\n<p>If the detector is unavailable or confidence is below threshold, the request is blocked. Privacy is a property that fails silently, so the default is to refuse, not to pass through.<\/p>\n<h3>Step 4. Require ZDR<\/h3>\n<p>Masking is never complete. ZDR is mandatory regardless: even if something leaked through, the provider contractually does not store it and does not train on it. Use both.<\/p>\n<h2>Where It Breaks<\/h2>\n<ul>\n<li><strong>Recall &lt; 100%.<\/strong> NER misses unstructured and rare names, transliterations, typos, and non-standard formats. Masking reduces risk; it does not eliminate it \u2014 hence the mandatory ZDR backstop.<\/li>\n<li><strong>Quasi-identifiers.<\/strong> &quot;The customer from village N, born 1974, the only sole proprietor there&quot; is not PII field by field, but is re-identifiable in aggregate. Entity masking does not catch this. That is a k-anonymity problem requiring a different tool.<\/li>\n<li><strong>Pseudonymization \u2260 anonymization.<\/strong> Reversible masking with a preserved mapping is, under GDPR, pseudonymization (Art. 4(5)), not anonymization. The data remains PII, and every requirement \u2014 encryption, access control, TTL \u2014 applies to the mapping store. Do not sell pseudonymization as &quot;the data is gone.&quot;<\/li>\n<li><strong>Leakage through structure.<\/strong> Even a de-identified text carries trade secrets \u2014 amounts, deal terms. This is a second argument for ZDR.<\/li>\n<li><strong>Latency.<\/strong> Running NER on every request, especially on long documents, adds noticeable overhead. Detection caching and batching help, but there is a cost.<\/li>\n<li><strong>Deanonymizing hallucinated placeholders.<\/strong> The model can invent a placeholder that is not in the mapping. Unmask must survive that gracefully \u2014 leave it as-is and flag it in the audit trail.<\/li>\n<\/ul>\n<h2>Standards Mapping<\/h2>\n<ul>\n<li><strong>GDPR<\/strong>: Art. 5, 25, 32, Chapter V (transfers); pseudonymization \u2014 Art. 4(5).<\/li>\n<li><strong>EU AI Act<\/strong>: Art. 10 (data governance for high-risk).<\/li>\n<li><strong>ISO\/IEC 42001<\/strong>: data governance controls for AI systems.<\/li>\n<li><strong>OWASP LLM<\/strong>: LLM02 (Sensitive Information Disclosure).<\/li>\n<li><strong>NIST AI RMF<\/strong>: Map\/Manage \u2014 data privacy.<\/li>\n<\/ul>\n<h2>Lab and Artifact<\/h2>\n<p>Deploy LiteLLM + Presidio in front of the target environment. Build a golden dataset of synthetic customer PII with varied formats, transliterations, and quasi-identifiers. Measure the detector&#x27;s precision and recall by type, and latency. Enable fail-closed. Sign and document ZDR in the DPA.<\/p>\n<p><strong>Artifact<\/strong>: gateway config, a recall report on the golden dataset, and a map of the mapping store with its encryption mode and TTL.<\/p>\n<h2>Maturity Checklist<\/h2>\n<ul>\n<li><strong>L1<\/strong>: ZDR contract signed, provider prompt logging disabled.<\/li>\n<li><strong>L2<\/strong>: gateway with NER masking on all call paths, mapping store with TTL and encryption, fail-closed.<\/li>\n<li><strong>L3<\/strong>: recall metrics in CI, quasi-identifier coverage, regression on the golden dataset on every model swap, honest &quot;pseudonymization&quot; classification in the processing register.<\/li>\n<\/ul>\n<h2>Sources<\/h2>\n<ul>\n<li><a href=\"https:\/\/explainx.ai\/blog\/microsoft-presidio-pii-detection-anonymization-guide-2026\">Microsoft Presidio \u2014 PII detection guide 2026<\/a><\/li>\n<li><a href=\"https:\/\/docs.litellm.ai\/docs\/tutorials\/presidio_pii_masking\">Presidio PII masking with LiteLLM<\/a><\/li>\n<li><a href=\"https:\/\/techcommunity.microsoft.com\/blog\/azuredevcommunityblog\/introducing-pii-shield-a-privacy-proxy-for-every-llm-call\/4514726\">PII Shield: reversible privacy proxy (Microsoft)<\/a><\/li>\n<li><a href=\"https:\/\/devopsboys.com\/blog\/llm-pii-detection-masking-production-2026\">PII detection &amp; masking in production (2026)<\/a><\/li>\n<\/ul>\n<p>If your LLM call path has no gateway stripping PII before the packet leaves the perimeter, the provider&#x27;s abuse-monitoring logs are already a GDPR violation sitting on someone else&#x27;s infrastructure.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An in-flight anonymization gateway and Zero Data Retention contract as two lines of defense against GDPR violations through AI.<\/p>\n","protected":false},"author":0,"featured_media":177,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[147,165],"tags":[170,168,169,167,166],"class_list":["post-178","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-governance","category-data-privacy","tag-anonymization-gateway","tag-gdpr","tag-llm-privacy","tag-pii","tag-zero-data-retention"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"Build an in-flight anonymization gateway and enforce Zero Data Retention to keep customer PII inside the perimeter on every LLM call.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.dobryakov.net\/blog\/178\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Grigoriy Dobryakov - IT+AI Blog - Grigoriy Dobryakov&#039;s blog: management, development and testing\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Zero Data Retention and PII Masking for LLM Calls\" \/>\n\t\t<meta property=\"og:description\" content=\"Build an in-flight anonymization gateway and enforce Zero Data Retention to keep customer PII inside the perimeter on every LLM call.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.dobryakov.net\/blog\/178\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-21T08:00:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-21T08:00:39+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Zero Data Retention and PII Masking for LLM Calls\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Build an in-flight anonymization gateway and enforce Zero Data Retention to keep customer PII inside the perimeter on every LLM call.\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/178\\\/#blogposting\",\"name\":\"Zero Data Retention and PII Masking for LLM Calls\",\"headline\":\"How to Keep Customer PII Out of LLM Provider Logs\",\"author\":{\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/author\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/ai-governance-privacy-zdr.jpg\",\"width\":1200,\"height\":630,\"caption\":\"How to Keep Customer PII Out of LLM Provider Logs\"},\"datePublished\":\"2026-09-21T08:00:39+00:00\",\"dateModified\":\"2026-09-21T08:00:39+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/178\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/178\\\/#webpage\"},\"articleSection\":\"AI Governance, Data Privacy, Anonymization Gateway, GDPR, LLM Privacy, PII, Zero Data Retention\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/178\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/category\\\/ai-governance\\\/#listItem\",\"name\":\"AI Governance\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/category\\\/ai-governance\\\/#listItem\",\"position\":2,\"name\":\"AI Governance\",\"item\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/category\\\/ai-governance\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/178\\\/#listItem\",\"name\":\"How to Keep Customer PII Out of LLM Provider Logs\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/178\\\/#listItem\",\"position\":3,\"name\":\"How to Keep Customer PII Out of LLM Provider Logs\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/category\\\/ai-governance\\\/#listItem\",\"name\":\"AI Governance\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/#organization\",\"name\":\"Grigoriy Dobryakov - IT+AI Blog\",\"description\":\"Grigoriy Dobryakov's blog: management, development and testing\",\"url\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/178\\\/#webpage\",\"url\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/178\\\/\",\"name\":\"Zero Data Retention and PII Masking for LLM Calls\",\"description\":\"Build an in-flight anonymization gateway and enforce Zero Data Retention to keep customer PII inside the perimeter on every LLM call.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/178\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/author\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/author\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/ai-governance-privacy-zdr.jpg\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/178\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"How to Keep Customer PII Out of LLM Provider Logs\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/178\\\/#mainImage\"},\"datePublished\":\"2026-09-21T08:00:39+00:00\",\"dateModified\":\"2026-09-21T08:00:39+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/\",\"name\":\"Grigoriy Dobryakov - IT+AI Blog\",\"description\":\"Grigoriy Dobryakov's blog: management, development and testing\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.dobryakov.net\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Zero Data Retention and PII Masking for LLM Calls","description":"Build an in-flight anonymization gateway and enforce Zero Data Retention to keep customer PII inside the perimeter on every LLM call.","canonical_url":"https:\/\/www.dobryakov.net\/blog\/178\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.dobryakov.net\/blog\/178\/#blogposting","name":"Zero Data Retention and PII Masking for LLM Calls","headline":"How to Keep Customer PII Out of LLM Provider Logs","author":{"@id":"https:\/\/www.dobryakov.net\/blog\/author\/#author"},"publisher":{"@id":"https:\/\/www.dobryakov.net\/blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.dobryakov.net\/blog\/wp-content\/uploads\/2026\/09\/ai-governance-privacy-zdr.jpg","width":1200,"height":630,"caption":"How to Keep Customer PII Out of LLM Provider Logs"},"datePublished":"2026-09-21T08:00:39+00:00","dateModified":"2026-09-21T08:00:39+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.dobryakov.net\/blog\/178\/#webpage"},"isPartOf":{"@id":"https:\/\/www.dobryakov.net\/blog\/178\/#webpage"},"articleSection":"AI Governance, Data Privacy, Anonymization Gateway, GDPR, LLM Privacy, PII, Zero Data Retention"},{"@type":"BreadcrumbList","@id":"https:\/\/www.dobryakov.net\/blog\/178\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.dobryakov.net\/blog#listItem","position":1,"name":"Home","item":"https:\/\/www.dobryakov.net\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/www.dobryakov.net\/blog\/category\/ai-governance\/#listItem","name":"AI Governance"}},{"@type":"ListItem","@id":"https:\/\/www.dobryakov.net\/blog\/category\/ai-governance\/#listItem","position":2,"name":"AI Governance","item":"https:\/\/www.dobryakov.net\/blog\/category\/ai-governance\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.dobryakov.net\/blog\/178\/#listItem","name":"How to Keep Customer PII Out of LLM Provider Logs"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.dobryakov.net\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.dobryakov.net\/blog\/178\/#listItem","position":3,"name":"How to Keep Customer PII Out of LLM Provider Logs","previousItem":{"@type":"ListItem","@id":"https:\/\/www.dobryakov.net\/blog\/category\/ai-governance\/#listItem","name":"AI Governance"}}]},{"@type":"Organization","@id":"https:\/\/www.dobryakov.net\/blog\/#organization","name":"Grigoriy Dobryakov - IT+AI Blog","description":"Grigoriy Dobryakov's blog: management, development and testing","url":"https:\/\/www.dobryakov.net\/blog\/"},{"@type":"WebPage","@id":"https:\/\/www.dobryakov.net\/blog\/178\/#webpage","url":"https:\/\/www.dobryakov.net\/blog\/178\/","name":"Zero Data Retention and PII Masking for LLM Calls","description":"Build an in-flight anonymization gateway and enforce Zero Data Retention to keep customer PII inside the perimeter on every LLM call.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.dobryakov.net\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.dobryakov.net\/blog\/178\/#breadcrumblist"},"author":{"@id":"https:\/\/www.dobryakov.net\/blog\/author\/#author"},"creator":{"@id":"https:\/\/www.dobryakov.net\/blog\/author\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.dobryakov.net\/blog\/wp-content\/uploads\/2026\/09\/ai-governance-privacy-zdr.jpg","@id":"https:\/\/www.dobryakov.net\/blog\/178\/#mainImage","width":1200,"height":630,"caption":"How to Keep Customer PII Out of LLM Provider Logs"},"primaryImageOfPage":{"@id":"https:\/\/www.dobryakov.net\/blog\/178\/#mainImage"},"datePublished":"2026-09-21T08:00:39+00:00","dateModified":"2026-09-21T08:00:39+00:00"},{"@type":"WebSite","@id":"https:\/\/www.dobryakov.net\/blog\/#website","url":"https:\/\/www.dobryakov.net\/blog\/","name":"Grigoriy Dobryakov - IT+AI Blog","description":"Grigoriy Dobryakov's blog: management, development and testing","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.dobryakov.net\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"Grigoriy Dobryakov - IT+AI Blog - Grigoriy Dobryakov's blog: management, development and testing","og:type":"article","og:title":"Zero Data Retention and PII Masking for LLM Calls","og:description":"Build an in-flight anonymization gateway and enforce Zero Data Retention to keep customer PII inside the perimeter on every LLM call.","og:url":"https:\/\/www.dobryakov.net\/blog\/178\/","article:published_time":"2026-09-21T08:00:39+00:00","article:modified_time":"2026-09-21T08:00:39+00:00","twitter:card":"summary_large_image","twitter:title":"Zero Data Retention and PII Masking for LLM Calls","twitter:description":"Build an in-flight anonymization gateway and enforce Zero Data Retention to keep customer PII inside the perimeter on every LLM call."},"aioseo_meta_data":{"post_id":"178","title":"Zero Data Retention and PII Masking for LLM Calls","description":"Build an in-flight anonymization gateway and enforce Zero Data Retention to keep customer PII inside the perimeter on every LLM call.","keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":"Zero Data Retention and PII Masking for LLM Calls","og_description":"Build an in-flight anonymization gateway and enforce Zero Data Retention to keep customer PII inside the perimeter on every LLM call.","og_object_type":"default","og_image_type":"default","og_image_custom_url":null,"og_image_custom_fields":null,"og_image_url":null,"og_image_width":null,"og_image_height":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_image_url":null,"twitter_title":"Zero Data Retention and PII Masking for LLM Calls","twitter_description":"Build an in-flight anonymization gateway and enforce Zero Data Retention to keep customer PII inside the perimeter on every LLM call.","schema_type":"default","schema_type_options":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"limit_modified_date":false,"ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":null,"created":"2026-09-21 08:00:59","updated":"2026-09-21 08:00:59"},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.dobryakov.net\/blog\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.dobryakov.net\/blog\/category\/ai-governance\/\" title=\"AI Governance\">AI Governance<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tHow to Keep Customer PII Out of LLM Provider Logs\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.dobryakov.net\/blog"},{"label":"AI Governance","link":"https:\/\/www.dobryakov.net\/blog\/category\/ai-governance\/"},{"label":"How to Keep Customer PII Out of LLM Provider Logs","link":"https:\/\/www.dobryakov.net\/blog\/178\/"}],"_links":{"self":[{"href":"https:\/\/www.dobryakov.net\/blog\/wp-json\/wp\/v2\/posts\/178","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dobryakov.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dobryakov.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dobryakov.net\/blog\/wp-json\/wp\/v2\/comments?post=178"}],"version-history":[{"count":0,"href":"https:\/\/www.dobryakov.net\/blog\/wp-json\/wp\/v2\/posts\/178\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dobryakov.net\/blog\/wp-json\/wp\/v2\/media\/177"}],"wp:attachment":[{"href":"https:\/\/www.dobryakov.net\/blog\/wp-json\/wp\/v2\/media?parent=178"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dobryakov.net\/blog\/wp-json\/wp\/v2\/categories?post=178"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dobryakov.net\/blog\/wp-json\/wp\/v2\/tags?post=178"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}