LLM PII Redaction and Guardrails: Tools Compared in 2026

Every prompt an agent sends can carry a customer's email, an API key pasted from a stack trace or an account number. For LLM PII redaction, Portkey, Requesty, Bifrost and LiteLLM offer gateway options that mask or block detected data before a model call. AWS Bedrock Guardrails and other services add different safety checks. We make Requesty, one of the products compared here.

LLM PII redaction and guardrail tools compared

Start with where the check runs. A gateway routes model traffic; a standalone API or framework needs application code or a gateway integration to call it and enforce its verdict. The comparison reflects documentation checked October 2026.

For a separately wired AWS ApplyGuardrail call, forward the original text when the outputs array is empty, use returned masked content for masking, and handle a block response according to policy.

For country-specific identifiers, Presidio lists recognizers for Spanish NIF and NIE and Italian fiscal codes. AWS Bedrock lists UK NHS numbers and US Social Security numbers.

Decide whether values should come back

A support assistant may need to return a customer's email to an authorized agent. Another workflow must keep that email away from its downstream consumer. The choice of transformation affects both tasks.

Cost and availability differ as well. Requesty guardrails use additive per-enabled-scanner and action charges per million input tokens on standard plans; Enterprise includes guardrails. Pay-as-you-go Requesty adds a 5% fee on top of credit top-ups, with no seat fees or minimums. AWS Bedrock charges $0.10 per 1,000 text units for sensitive-information filters; a text unit contains up to 1,000 characters, and regex filtering is free.

Bifrost lists guardrails under Enterprise, separate from its open-source core. Portkey's regex redaction is a BASIC check; its general plan documentation lists PARTNER and PRO checks on Production. Presidio's MIT toolkit leaves infrastructure and operations to your team.

What happens before and after an LLM call?

A detector identifies a span of text. An action decides what happens next: Report records a finding, Block stops a request, and Mask or redaction replaces a detected value. Report leaves the original content available downstream.

Consider this conceptual support request, using invented values:

Application sends:   Reply to alex@example.com about the ticket.
Provider receives:   Reply to user42@example.net about the ticket.
Provider responds:   Send the update to user42@example.net.
Caller receives:     Send the update to alex@example.com.

The substitute and mapping illustrate reversible masking; they are not a Requesty output format. An independently observed provider-bound request establishes what crossed that boundary. An LLM echo alone cannot: response restoration could put the original back after the provider call.

Restoring an input value is a separate operation from scanning the response for a new email address or credential. Decide which downstream users and tools should receive restored data, and put an independent output check after restoration if they should not.

Reversible substitution is pseudonymization: the mapping and surrounding context can still identify someone. Presidio warns that automated detection cannot guarantee discovery of all sensitive information. Treat the mapping as sensitive data, with tenant isolation, limited access, a defined lifetime and a deletion policy.

The order affects what each processor sees. If your policy prohibits sending raw PII outside your network, run a self-hosted filter first, then prevent later components from adding unchecked data or bypassing it. Philterd's integration guidance explains why gateway-added prompts and fallback paths belong in this review.

Choose a control for the policy

PII and secrets

Pick Requesty when you want to mask detected PII or credentials on traffic sent through a hosted gateway. Pick Presidio when raw data must be processed inside an environment you operate, or when you need custom recognizers. Presidio combines techniques including named-entity recognition, patterns, rules and checksums.

For an in-network proxy in front of supported model APIs, Philter AI Proxy calls a separately deployed Philter service. Output scanning is opt-in and multipart uploads are rejected. Its API field reference also identifies JSON paths that pass through unchanged; configured outbound scanning cannot inspect streams. Inspect a rejected or unsupported path with a suitable control before routing it elsewhere.

Presidio was originally a Microsoft project and has moved to the community-governed Data Privacy Stack. The transition notice identifies the current container registry and says the legacy Microsoft container images are no longer updated.

Sometimes the model needs the original value to do its job. Replacing an account number before asking the model to validate it changes the task. Run utility tests as well as privacy tests, and keep exact validation in trusted application code where appropriate.

Prompt injection and content safety

Prompt injection is an instruction that attempts to redirect the model, including instructions hidden in retrieved documents or tool results. OWASP's prompt injection guidance covers direct and indirect attacks.

Pick AWS Bedrock Guardrails for its prompt-attack and content filters, or Check Point AI Guardrails for a separately wired project-policy verdict. Azure AI Content Safety provides Prompt Shields and moderation, while Azure AI Language PII is a separate service for PII. Bifrost and LiteLLM let you connect selected external guardrails to gateway traffic.

A classifier is only one layer. Limit tool permissions, isolate credentials, validate tool arguments and require approval for privileged actions. A prompt-injection verdict does not replace authorization on the action the agent wants to take.

Topic rules and output validation

A topic rule answers a policy question, such as whether an assistant should discuss a restricted subject. Pick AWS Bedrock for denied topics, or NeMo to configure dialog and other rails. For a structured response, validate the output against a schema and reject or retry an invalid result. Portkey documents a JSON Schema check; Guardrails AI composes validators in application workflows. For differences in request formats, see our guide to structured outputs across LLM providers.

A schema-valid answer can still be incorrect or unsafe. For Guardrails AI, install the validator packages your policy requires and run them locally or on your own endpoint. The project's validator migration guidance describes the move to public packages.

Where protections fail

Streaming can deliver content before a verdict

A response scanner must inspect content before release if it is supposed to block disclosure. Buffering changes the user experience, but a verdict after delivery cannot retract an earlier chunk.

Portkey's streaming documentation says its output checks run on the assembled response after the stream completes and are informational. For an input barrier, configure synchronous checks and an enforcement action: asynchronous checks log their result without controlling the request.

For InvokeModelWithResponseStream, AWS Bedrock synchronous mode buffers and scans one or more chunks before release. Its asynchronous mode can release chunks before the check finishes and does not support sensitive-information masking.

In streaming Chat Completions, Text Completions and Responses, Bifrost holds the complete stream when a matched enforcement rule can block; runtime redaction uses buffered segments instead. Monitor-mode rules do not pause the stream. Gray Swan Cygnal is an exception: text-only streams skip Cygnal. For tool-call streams, text sent before a tool call is detected remains visible; later chunks are held for evaluation. Other configured output profiles apply separately.

Restoration needs a streaming test too. A LiteLLM user report described Presidio placeholders not being restored on streamed Anthropic Messages calls in versions 1.103.2 and 1.105.0. Test the deployed version with placeholders split across stream chunks and compare the result with a non-streaming call.

Logs, retrieval and tools have their own boundaries

A prompt can reach application logs, retrieval stores and a scanner before it reaches the model. Masking at the model gateway does not erase those copies. AWS warns that Bedrock invocation logs can contain original input and guardrail traces can include raw matches. Review access, retention and payload logging on every component.

Retrieved text and tool traffic need explicit coverage. AWS says its sensitive-information filter excludes tool inputs, results and definitions. Its Converse documentation says the listed guardrail filters also skip tool results, definitions and generated tool-call arguments. Apply separate tool checks before execution. Bifrost supports separate MCP rules for tool arguments and results, subject to the chosen provider's capabilities. Check each field and connector; a service receiving only the final user message cannot inspect material it never sees.

Images and audio need a plan of their own. AWS describes its PII filter as text-based; Cloudflare's DLP documentation says it does not decode binary content. If sensitive data appears in an image, add an appropriate image inspection or OCR step before the relevant boundary.

Decide what happens when a scanner fails

A fail-open policy allows traffic to continue when a scanner cannot return a verdict. A fail-closed policy stops it. Neither label says what happens when a detector returns a false negative, so test both outages and missed detections.

Bifrost's guardrail documentation says provider errors fail open and the next profile runs. Some unsafe redaction cases fail closed instead. Force a timeout in the specific profile and phase you plan to use; if raw data must never reach the next boundary on scanner failure, enforce that requirement in the surrounding architecture.

A concrete self-hosted PII configuration

LiteLLM's Presidio integration connects a gateway to an operated PII service. Deploy Presidio Analyzer and Anonymizer first, set PRESIDIO_ANALYZER_API_BASE and PRESIDIO_ANONYMIZER_API_BASE, and add this guardrail fragment to a working LiteLLM configuration:

guardrails:
  - guardrail_name: presidio-pii
    litellm_params:
      guardrail: presidio
      mode: pre_call
      default_on: true
      presidio_language: en
      pii_entities_config:
        EMAIL_ADDRESS: MASK
      output_parse_pii: true

The LiteLLM Presidio documentation defines the entity action and restoration flag. pre_call places this check before the model call; default_on avoids relying on each caller to select it. Configure a separate output check if you need to detect new PII in responses: output_parse_pii restores input replacements and does not perform output detection. LiteLLM's guardrail modes explain why during_call is not a pre-provider privacy barrier.

This example targets email detection in English. Add and test the entity types, languages, endpoint variants and tool paths your policy requires. Presidio is the PII component here; injection detection requires another configured control.

Roll out and test your policy

Start with a labeled set of synthetic examples, including benign lookalikes and the formats your applications send. Never use real secrets as fixtures. Run the set through each endpoint and fallback path, then inspect what the next component receives using an approved observation path.

For example, assume a test set has 100 labeled sensitive spans. The detector finds 90 and misses 10; it also flags 30 benign spans. Recall is 90 / 100 = 90%. Precision is 90 / (90 + 30) = 75%. Report both: recall exposes missed spans, while precision shows how many reported matches are correct. Break results down by entity type, language and content field before choosing a policy.

Retest after a provider, SDK, scanner or routing change. A gateway rule covers the traffic that reaches it; credentials and network controls should also address direct provider calls. Assign the control an owner, test and review trigger using the AI governance framework.

Mask PII and secrets with Requesty

Use Requesty's gateway to replace detected PII and secrets before provider processing and restore matching values in the response. There are four independently configured scanners: PII Fast, PII ML, Secrets Fast and Secrets ML. Each has Disabled, Report and Mask actions, with organization-wide or group-level configuration. Requesty groups are an Enterprise feature.

1. 1
   Open guardrails and choose scanners

   An organization admin opens Guardrails in the Requesty Console. Select the PII or secrets scanners that fit the policy.

2. 2
   Start with Report

   Set the chosen scanners to Report and review findings in Logs and Compliance. Report forwards the original content, so use approved test traffic and handle logs accordingly.

3. 3
   Route a test request

   Create a Requesty API key and point your OpenAI-compatible client at https://router.requesty.ai/v1. Choose a free model or add credits for a paid model such as the one in the quickstart, then send a Chat Completions request with synthetic values.

4. 4
   Enable Mask and check results

   Move the chosen scanners to Mask and repeat the synthetic Chat Completions request. Check its Guardrails tab in Logs, then regenerate Compliance to review the reported Masked outcome. To inspect the provider-bound body independently, ask Requesty support for an approved capture or provider-account trace, including the endpoint and fallback path. Check restoration and task utility too.

5. 5
   Monitor coverage

   Review scan errors and unscanned traffic alongside the scanner charges in Logs.

Requesty does not scan for new sensitive data in model responses. It also does not detect prompt injection or moderate harmful outputs. Add a separately wired safety service or choose another tool for those policies.

Compliance counts traffic and guardrail verdicts by provider attempt, while violations are counted by user request. A fallback can therefore increase the attempt count. Its traffic evidence currently covers Chat Completions.

Mask and payload logging are separate controls. With key payload logging enabled and organization ZDR off, Requesty can store full raw request bodies; review logging settings and access before sending sensitive traffic. When enabled, Requesty zero data retention prevents storage of request and response content for new requests; existing payload logs remain. Provider retention is separate.

Connecting an OpenAI or Anthropic platform in the admin panel does not route its direct traffic through Requesty. Those platform integrations are read-only and do not apply Requesty guardrails to direct calls.

What to do this week

If raw data may reach a hosted gateway, pick Requesty to mask detected PII and secrets before the model provider. If raw data must stay in your network, start with self-hosted Presidio. For prompt injection, add a separately wired service such as AWS Bedrock Guardrails or Check Point AI Guardrails.

This week, choose one workflow and run synthetic examples through its actual request, tool and streaming paths. Measure missed detections and false positives, then verify what crosses the provider boundary. To configure hosted masking, start with Requesty or open the guardrails documentation.