Chapter 1. Zero Data Retention & Privacy: eliminating leaks and PII/GDPR exposure

The customer's business goal

For Kovcheg, the cost of a leak isn't an abstract fine — it's a combination: GDPR sanctions + banking-secrecy violation + loss of regulatory trust. The plane's job: the model never sees real PII, and the company can prove it. Three promises to the business:

1. PII and banking secrets never leave the perimeter in plaintext.
2. The provider does not store prompts and does not train on them (Zero Data Retention).
3. A customer's right to erasure (GDPR Art. 17) isn't broken by data having leaked into someone else's training and becoming irretrievable.

Driver: threat or regulator

• GDPR: sending PII to an LLM provider without a legal basis or non-retention guarantees violates Art. 5 (data minimization, storage limitation), Art. 25 (privacy by design), Art. 32 (security of processing). Cross-border transfer adds Chapter V.
• Provider logs: storing prompts for abuse monitoring is already an export of PII to a third party, even if "no one reads it."
• Training on data: PII entering a training corpus makes the right to erasure unenforceable — a legal dead end.
• EU AI Act: data governance for high-risk (Art. 10) overlaps with GDPR.

Architectural pattern

In-Flight Anonymization Gateway + ZDR — a layer in front of the LLM call that de-identifies data on the way in and restores it on the way out, plus a contractual Zero Data Retention agreement as a second line of defense. The model works with placeholders; real values live inside the perimeter for a fraction of a second.

              ┌────────── Anonymization Gateway ──────────┐
 "Ivanov I.I.,│  detect (NER+regex) → mask → <PERSON_1>    │
  IBAN RS35…" │        │                                    │  masked prompt
 ────────────►│        ▼                                    │──────────────► LLM (ZDR)
              │  mapping → Redis (TTL = request lifetime)    │◄──────────────
              │        ▲                                    │  masked answer
 "Dear        │  unmask ◄── mapping                         │
  Ivanov I.I."│                                             │
 ◄────────────└─────────────────────────────────────────────┘

Engineering stack & providers

• PII/NER detection: Microsoft Presidio (open, MIT; current release 2.2.362, March 2026; 50+ entity types; swappable NLP backends — spaCy / ONNX / Stanza / HuggingFace); Private AI, AWS Comprehend PII as alternatives; regex for structured entities (IBAN, national ID, passport, card).
• Gateway: LiteLLM Proxy (has native Presidio integration) or a custom FastAPI layer.
• Mapping store: Redis with a short TTL.
• ZDR: enterprise contracts (Azure OpenAI, Anthropic / OpenAI Enterprise, AWS Bedrock) with Zero Data Retention and prompt logging disabled, spelled out in the DPA.

Engineering implementation

### Step 1. Gateway as the only door to the model

Direct LLM calls from services are forbidden by network policy — everything routes through the gateway. Otherwise any developer who calls the API directly bypasses the whole plane.

### Step 2. Detection and reversible masking

NER + regex find entities; each is replaced with a typed placeholder, and the reverse mapping is stored in Redis under the trace_id key (the same id used in the audit trail — ch. 4):

results = analyzer.analyze(text=prompt, language="en")   # Presidio NER
masked, mapping = reversible_mask(prompt, results)        # <PERSON_1>, <IBAN_1>...
redis.setex(f"pii:{trace_id}", TTL_SECONDS, json.dumps(mapping))

resp = llm.call(masked, extra_headers={"x-zdr": "true"})
answer = unmask(resp, json.loads(redis.get(f"pii:{trace_id}")))

### Step 3. Fail-closed

If the detector is unavailable or confidence is below threshold, the request is blocked, not passed through as-is. Privacy is a property that fails silently; so the default is to refuse, not to pass through.

### Step 4. ZDR as the second line of defense

Masking is never complete (see below), so ZDR is mandatory regardless: even if something leaked through, the provider contractually does not store it and does not train on it. Two lines of defense, not one.

Where it breaks

• Recall < 100%. NER misses unstructured and rare names, transliterations, typos, non-standard formats. Masking reduces risk, it doesn't eliminate it — hence the mandatory ZDR backstop.
• Quasi-identifiers. "The customer from village N, born 1974, the only sole proprietor there" isn't PII field by field, but is re-identifiable in aggregate. Entity masking doesn't catch this — that's a k-anonymity problem, a different tool.
• Pseudonymization ≠ anonymization. A key legal nuance: reversible masking with a preserved mapping is, under GDPR, pseudonymization, not anonymization. The data remains PII, and every requirement (encryption, access control, TTL) applies to the mapping store. Don't sell pseudonymization as "the data is gone."
• Leakage through structure. Even a de-identified text carries trade secrets (amounts, deal terms) — a second argument for ZDR.
• Latency. Running NER on every request, especially on long documents, adds noticeable overhead; detection caching and batching help, but there's a cost.
• Deanonymizing hallucinated placeholders. The model can "invent" a placeholder that isn't in the mapping — unmask must survive that gracefully (leave it as-is + flag it in the audit).

Standards and mapping

• GDPR: Art. 5, 25, 32, Chapter V (transfers); pseudonymization — Art. 4(5).
• EU AI Act: Art. 10 (data governance for high-risk).
• ISO/IEC 42001: data governance controls for AI systems.
• OWASP LLM: LLM02 (Sensitive Information Disclosure).
• NIST AI RMF: Map/Manage — data privacy.

Lab and artifact

Deploy LiteLLM + Presidio in front of Kovcheg; build a golden dataset of synthetic customer PII (varied formats, transliterations, quasi-identifiers); measure the detector's precision/recall by type, and latency; enable fail-closed; sign/document ZDR in the DPA. Artifact: gateway config + a recall report on the golden dataset + a map of the mapping store with its encryption mode and TTL (evidence for ch. 6).

Maturity checklist

• L1: ZDR contract signed, provider prompt logging disabled.
• L2: gateway with NER masking on all call paths, mapping store with TTL and encryption, fail-closed.
• L3: recall metrics in CI, quasi-identifier coverage, regression on the golden dataset on every model swap, honest "pseudonymization" classification in the processing register.

Sources

• [Microsoft Presidio — PII detection guide 2026](https://explainx.ai/blog/microsoft-presidio-pii-detection-anonymization-guide-2026)
• [Presidio PII masking with LiteLLM](https://docs.litellm.ai/docs/tutorials/presidio_pii_masking)
• [PII Shield: reversible privacy proxy (Microsoft)](https://techcommunity.microsoft.com/blog/azuredevcommunityblog/introducing-pii-shield-a-privacy-proxy-for-every-llm-call/4514726)
• [PII detection & masking in production (2026)](https://devopsboys.com/blog/llm-pii-detection-masking-production-2026)

How it actually works — engineering breakdowns

Standalone howto from practice, showing this control plane on real code and a working artifact.

• Egress Redaction Gate: PII and Secrets Don't Cross the Org BoundaryEgress filter: PII and secrets don't leave the perimeter — the same data plane.

Read next

• Next: Access control — RAG returns only what the user is allowed to see
• All course chapters →
• Connect the expert as an MCP →