Every prompt your application sends to a hosted model is a potential data-leak event. Support tickets carry phone numbers, uploaded PDFs carry account numbers, and chat logs carry home addresses that nobody meant to share. LLM PII redaction is the layer that strips those identifiers before the text crosses a network boundary — and in 2026 the tooling finally has real options rather than one default.
This guide compares the three approaches teams actually ship: Microsoft Presidio, OpenAI’s new open-weight Privacy Filter, and Amazon Comprehend’s managed PII API. You will get the trade-offs, the decision rules, and an implementation checklist you can run this week.
Why LLM PII Redaction Became a 2026 Priority
Three pressures converged. First, retrieval pipelines now ingest raw enterprise data at volume, so sensitive fields end up in vector stores that were never scoped as systems of record. Second, agentic workflows chain calls across multiple providers, multiplying the number of places a name or card number can land in a log. Third, regulators stopped treating prompt payloads as ephemeral — under most 2026 data-protection readings, a prompt containing personal data is processing, with all the obligations that implies.
The practical answer is a redaction step that sits between your application and the model. It detects entities, replaces them with placeholders or hashes, and — when you need the output to make sense to a human — reverses the substitution on the way back.
Microsoft Presidio: The Configurable Open-Source Standard
Presidio is the incumbent. It is an MIT-licensed Python framework that combines named-entity recognition, regex pattern matching, checksum validation, and context words into a single detection pipeline, then hands results to a separate anonymizer engine. After eight years of development it moved to community governance under the Data Privacy Stack, with releases continuing through 2026.
Where Presidio Wins
- Custom recognizers. Internal employee IDs, policy numbers, proprietary SKUs — you write a recognizer class and register it. No vendor roadmap required.
- Operator flexibility. Redact, mask with asterisks, hash, encrypt reversibly, or substitute realistic fake values. Each entity type can use a different operator.
- Beyond plain text. Image redaction via OCR and structured-data handling for CSV and DataFrame inputs ship in the same project.
- No data egress. Everything runs in your process, which matters when the whole point is keeping data in-boundary.
Where Presidio Costs You
- It is a framework, not a product. Accuracy depends entirely on the NLP model you plug in and the tuning you do.
- The maintainers deliberately publish no headline accuracy numbers, so you must build your own evaluation set.
- Default spaCy pipelines miss context-heavy cases, and you own the deployment, scaling, and model-update lifecycle.
OpenAI Privacy Filter: The New On-Device Contender
Released on 22 April 2026 under Apache 2.0, OpenAI’s Privacy Filter is a purpose-built model rather than a rules framework. It carries 1.5B total parameters with roughly 50M active per token, supports a 128,000-token context window, and classifies sensitive spans into eight categories: names, addresses, emails, phone numbers, URLs, dates, account numbers, and secrets.
The design goal is explicit — run de-identification on the device that holds the data, so unfiltered text never needs a round trip to a server. That inverts the usual cloud-DLP model, where you ship raw sensitive data to a third party in order to find out that it was sensitive.
Where Privacy Filter Wins
- Context comprehension. A transformer reading 128K tokens handles ambiguous references that regex-plus-NER pipelines routinely miss.
- Small enough to be local. The sparse activation profile means it runs on modest hardware, including many laptops and edge boxes.
- Permissive licence. Apache 2.0 with open weights — no per-character billing, no usage telemetry.
- Long documents in one pass. No chunking gymnastics for contracts or transcripts.
Where Privacy Filter Costs You
- Eight fixed categories. Domain-specific identifiers are not first-class the way a Presidio custom recognizer is.
- GPU inference adds latency and cost versus a regex sweep — real numbers depend on your batch size and hardware.
- It is new — production hardening and community recipes are still accumulating.
- Outputs are probabilistic; you cannot prove a card-number pattern was caught the way a checksum validator can.
Amazon Comprehend PII: The Managed API Route
Amazon Comprehend offers PII detection and redaction as a managed endpoint, billed at roughly $0.0001 per 100 characters for the first 10M units with volume tiers below that. It supports synchronous calls for short text and asynchronous jobs for bulk corpora, and it integrates natively with S3, Macie, and CloudWatch.
Where Comprehend Wins
- Zero model operations. No GPUs to provision, no weights to update, no drift to monitor.
- IAM, VPC endpoints, CloudTrail audit logs, and a signed data-processing addendum arrive by default.
- Bulk-job mode is genuinely good for one-off corpus cleaning before fine-tuning.
Where Comprehend Costs You
- The data still leaves. You send raw PII to AWS to have it detected — acceptable inside an existing AWS boundary, awkward otherwise.
- Language coverage for PII is narrow compared with Comprehend’s other features.
- Per-character billing punishes high-throughput chat workloads.
- Not designed for low-latency inline proxying on every request.
Side-by-Side: Presidio vs Privacy Filter vs Comprehend
| Dimension | Presidio | Privacy Filter | Comprehend |
|---|---|---|---|
| Type | Framework (NER + regex) | Open-weight model | Managed API |
| Licence | MIT | Apache 2.0 | Commercial |
| Runs locally | Yes | Yes | No |
| Custom entity types | Excellent | Limited (8 categories) | Limited |
| Context handling | Model-dependent | Strong (128K tokens) | Moderate |
| Reversible masking | Built-in operators | Roll your own | Limited |
| Marginal cost | Compute only | Compute only | Per character |
| Ops burden | High | Medium | Low |
How to Choose: Three Decision Paths
Choose Presidio if you have domain-specific identifiers, need reversible pseudonymisation so downstream output stays useful, or must redact images and structured files alongside text. Budget engineering time for a labelled evaluation set — without one you are guessing.
Choose OpenAI Privacy Filter if your hard requirement is that unfiltered data never leaves the device, your documents are long and messy, and the eight standard categories cover your risk surface. It is the strongest default for consumer-facing and on-premise deployments.
Choose Amazon Comprehend if you already operate inside AWS, your compliance story depends on a managed service with a signed DPA, and your volume is batch rather than per-keystroke.
The best production setups in 2026 are hybrids. Run deterministic regex and checksum validators first — they catch card numbers and national IDs with certainty and near-zero latency — then pass the remainder to a model for the contextual cases. Presidio can host both halves, with Privacy Filter registered as a custom recognizer.
Implementation Checklist
- Map the boundary. List every point where text leaves your control: model APIs, logging, error reporting, analytics, vector stores.
- Build an evaluation set. 200–500 labelled examples from your real traffic beats any vendor benchmark.
- Layer the detectors. Deterministic validators for structured identifiers, model inference for free text.
- Decide reversibility up front. Format-preserving encryption if you need the original back; irreversible hashing if you do not.
- Redact your logs too. Most leaks in 2026 post-mortems are log leaks, not prompt leaks.
- Measure recall, not accuracy. A missed identifier is a breach; a false positive is a mildly worse answer.
- Re-test quarterly. Traffic shifts, and so does what your detectors see.
Redaction is one control among several. Pair it with input validation from our guide to defending LLM apps against prompt injection, policy enforcement covered in LLM guardrails, and centralised egress control via an AI gateway. Validate the whole stack with red-teaming tools before you ship.
Frequently Asked Questions
Is LLM PII redaction legally required?
No regulation names the technique specifically, but data-minimisation duties under GDPR and comparable regimes mean sending more personal data to a processor than a task requires is difficult to defend. Redaction is the standard way to demonstrate minimisation for prompt payloads. This is general information, not legal advice — confirm your obligations with counsel.
Can I just prompt a large model to remove PII?
You can, and it will work most of the time, which is the problem. It also defeats the purpose: to prompt the model you must first send it the unredacted text. Redaction belongs in a component that runs before any external call.
What latency should I budget?
Regex and checksum layers are effectively free — sub-millisecond on typical prompts. Transformer-based detection adds meaningfully more, varying with hardware, batch size, and document length. Benchmark on your own traffic; published figures rarely transfer.
Does redaction hurt answer quality?
Aggressive redaction can. Replacing every name with the same token destroys the model’s ability to track who did what. Use consistent per-entity placeholders — <PERSON_1>, <PERSON_2> — and reverse the mapping on the response. Coreference survives, privacy holds.
The Bottom Line
The 2026 answer to LLM PII redaction is no longer a single tool. Presidio remains the most configurable option and the best host for a layered pipeline. OpenAI’s Privacy Filter is the most capable contextual detector that runs entirely on your own hardware. Amazon Comprehend is the pragmatic pick for AWS-native teams who value zero operations over data locality. Most serious deployments end up combining deterministic validators with one model-based detector, then measuring recall relentlessly.
Pick one path, build a labelled evaluation set from your own traffic this week, and measure before you commit. Then work outward — guardrails, gateway policy, and red-teaming turn a single redaction filter into an actual security posture.
