Privacy modes

A detection pass runs on every request before anything leaves our server. What happens to what it finds is up to you.

The four modes

Mode	The model sees	You get back
`off`	Everything, verbatim	The model's reply, unchanged
`flag`	Everything, verbatim	Unchanged, plus counts of what was found
`redact`	Placeholders. The values are gone	Placeholders — this is irreversible
`tokenise`	Numbered tokens	Your original values, restored

tokenise is the default, and is what most customers want.

What the model sees

Your request:

Draft a chaser to Margaret Ellis, NHS number 943 476 5919,
about the invoice sent to margaret.ellis@example.co.uk.

What we send upstream under tokenise:

Draft a chaser to «PERSON_1», NHS number «NHS_NUMBER_1»,
about the invoice sent to «EMAIL_1».

And under redact:

Draft a chaser to [PERSON], NHS number [NHS_NUMBER],
about the invoice sent to [EMAIL].

The same value always gets the same token within a request, so the model can still reason that two mentions refer to the same person. Different values get different numbers.

Getting your data back

Under tokenise, tokens in the model's reply are replaced with your original values before the response reaches you. This works for streamed responses too — a token split across several chunks is buffered until it can be completed, so you never receive half of one.

The mapping lives in memory for the life of the request and is never written to disk. We do not keep a record of what was detected, only how many of each type.

x-gateway-privacy-mode: tokenise
x-gateway-pii-detected: 3

What is detected

UK-specific identifiers are validated, not merely pattern-matched. NHS numbers must pass the mod-11 check digit, cards must pass Luhn, IBANs must pass mod-97, and National Insurance numbers must satisfy the full prefix rules. A ten-digit number that fails the NHS checksum is left alone.

NHS number, National Insurance number, UTR, passport, driving licence
Postcode, telephone number, email address, IP address
Payment card, IBAN, sort code, bank account number
Date of birth, VAT number, company number

Several of these only match near a supporting keyword — an eight-digit number becomes a bank account only next to a sort code or the words "account number". That is a deliberate trade: we would rather miss an unlabelled figure than corrupt every invoice number in your prompts.

Setting the mode

The account default is set in your dashboard. A single request may tighten it with a header, but never loosen it — so a leaked key cannot be used to turn redaction off.

# May only tighten privacy, never loosen it below the account setting.
curl https://ai.dijitul.uk/v1/messages \
  -H "x-api-key: $GATEWAY_API_KEY" \
  -H "anthropic-privacy-mode: tokenise" \
  -H "content-type: application/json" \
  -d '{"model":"claude-sonnet-4-6","max_tokens":512,"messages":[...]}'

Honest limitations

Reversible tokenisation is pseudonymisation, not anonymisation. The data remains personal data in our hands, because we hold the mapping. It may be anonymous in the model provider's hands, since they never receive the key — that is the genuine benefit, and it is the one worth putting in a DPIA.

Names are only caught when they appear in a recognisable pattern. Free-prose names in unusual formats will be missed.
Redacting values can change the model's answer — it cannot reason about a postcode it cannot see. Use flag first to see what would be caught.
Detection does not run on images. A scanned letter passes through as pixels.
No detector is perfect. This reduces exposure; it does not remove your obligations as a controller.