9 Best Tools for PII Redaction in LLM Calls (2026) 

A support agent pulls a customer’s last three tickets so the model can draft a reply. Ticket two holds a card number the customer typed while angry. Your team scrubbed the prompt. Nobody scrubbed the tickets. 

The best tools for PII redaction in LLM calls detect personal data in every payload crossing the model boundary, including retrieved context and tool arguments, replace it with safe tokens, and restore real values only for authorized users. Redaction is one control inside broader AI agent governance, and we compare nine options below. 

Get the short answer 

• Lyzr Opencontroller: one redaction policy enforced on every agent, model and tool call, inside your network. 
• Presidio: the open-source pick when your team wants to own every rule. 
• OpenAI Privacy Filter: a small local model for messy free text. 
• Limina (formerly Private AI): 50+ entity types in 52 languages, shipped as a container. 
• Skyflow: a vault that keeps real values out of every system, LLMs included. 
• Protecto: masking that keeps answers accurate, with role-aware access control. 
• Amazon Bedrock Guardrails, Google Model Armor, Azure AI Language: managed detection if your data already lives in that cloud. 

Where PII actually slips into an LLM call 

Mostly through the side doors. Harmonic Security analyzed 1 million prompts and 20,000 files sent to 300 GenAI tools and AI-enabled SaaS apps in Q2 2025: 4.37% of prompts held sensitive data, against nearly 22% of files. In Q3 2025, 26% of file uploads did. Pasted records and documents carry far more risk than typed text. 

Customers pay first. In IBM’s 2025 Cost of a Data Breach report, shadow-AI breaches exposed customer PII 65% of the time, against 53% overall. 

Applications follow the same pattern. Our “five doors” diagram maps where PII enters one call: user input, retrieved context, tool calls, model output and the logs that keep it all. Most teams guard door one. The other four stay open. 

How we scored every tool 

Six questions, same for every tool. Scores reflect public documentation as of October 2026. 

Best Tools for PII Redaction in LLM Calls 

1. Lyzr Opencontroller: Redaction as policy, not plumbing 

Our view: if redaction depends on every team remembering to call a library, it will have gaps. We have seen one company mask emails in one agent and send them in clear text from the next. 

Lyzr Opencontroller moves the decision into the request path, between your agents and everything they call. One rule covers a LangGraph agent on EKS and an agent on Bedrock AgentCore. Guardrails check inputs, outputs and tool calls for PII, secrets and prompt injection: a policy number headed to a hosted model gets redacted, and each decision is logged against the agent’s identity, version and owner. 

• Your network: runs in your VPC, on-prem or air-gapped, so control-plane data, credentials and telemetry never need to reach Lyzr. 
• Release gates: PII leakage can be a pass/fail check that blocks promotion to production. 
• Bring your detector: Lyzr’s Responsible AI policies can combine native checks with AWS Bedrock Guardrails. 

Pick it if many agents across teams or clouds touch regulated data and you need one policy with audit evidence.  

Skip it if you only need a de-identification API for batch data pipelines. Limina or Presidio fit better. 

Get the CIO playbook to AI agent governance that covers who owns each agent, what it may touch, and how to prove it to an auditor.  

2. Presidio: Own every rule yourself 

Presidio started at Microsoft and in 2026 is moving to independent governance under the Data Privacy Stack organization, still MIT licensed. Its Analyzer combines regex, checksums, deny lists and NER; its Anonymizer replaces, redacts, hashes or encrypts. You can add recognizers for your own identifiers, such as internal customer IDs. 

• Best for: self-hosted detection with custom entities you can inspect. 
• Watch out for: recall rests on your tuning; the project itself warns it will miss things. 
• Raw data goes to: your infrastructure. 

3. OpenAI Privacy Filter: Context over patterns 

Released April 22, 2026 under Apache 2.0, this 1.5B-parameter open-weight model reads up to 128,000 tokens and tags eight categories, from private names to account numbers and secrets. It scores 96% F1 on the PII-Masking-300k benchmark and can tell a public company from a private person. 

• Best for: tickets, transcripts and notes where regex gives up. 
• Watch out for: a fixed taxonomy and English-first accuracy. It detects; the vault and policy are yours to build. 
• Raw data goes to: wherever you run it, including on-device. 

4. Limina (formerly Private AI): Breadth across languages 

Private AI became Limina in 2026. It covers 50+ entity types across PII, PHI and payment data in 52 languages, can substitute realistic synthetic values, and supports a redact, call, re-identify loop around external LLMs. 

• Best for: healthcare and multilingual enterprises that want high recall without training models. 
• Watch out for: enterprise pricing and setup effort. 
• Raw data goes to: a container in your VPC, or Limina’s hosted API. 

5. Skyflow: Keep real values in a vault 

Skyflow stores sensitive data in a privacy vault and gives the LLM tokens. Its AI gateway rehydrates values on the way back, and it now covers MCP traffic and agentic workloads on AWS. 

• Best for: fintech and healthcare teams isolating PII from every system. 
• Watch out for: it handles data privacy, not agent identity or permissions. 
• Raw data goes to: the Skyflow vault. 

6. Protecto: Mask without wrecking the answer 

Protecto masks data while keeping meaning intact, so RAG answers stay useful. Its Vault launched as pay-as-you-go SaaS in December 2025, and context-based access control checks each requester’s role, task and policy at runtime before content is returned. 

• Best for: RAG and agent builders who need role-aware access to sensitive context. 
• Watch out for: accuracy figures are vendor-reported; test on your data. 
• Raw data goes to: Protecto SaaS or your deployment. 

7. Amazon Bedrock Guardrails: Stay inside AWS 

Sensitive information filters block or mask PII and custom regex in inputs and responses. The ApplyGuardrail API works without calling a Bedrock model, so it can front other models too. 

• Best for: AWS teams wanting managed detection fast. 
• Watch out for: masking is one-way and detection is probabilistic. 
• Raw data goes to: AWS. 

8. Google Cloud Model Armor: Screen both directions on GCP 

Model Armor screens prompts and responses with templates, and its Sensitive Data Protection integration redacts or tokenizes findings. An EU multi-region and several EU regions are supported. 

• Best for: Gemini and Vertex AI estates. 
• Watch out for: basic mode covers limited, mostly US infotypes; use advanced templates. 
• Raw data goes to: Google Cloud. 

9. Azure AI Language: PII detection for Azure estates 

Managed PII detection for text, conversations and native documents, such as call-centre transcripts. 

• Best for: teams already approved to process data in Azure. 
• Watch out for: the service receives unredacted input, so check region and retention terms. 
• Raw data goes to: Azure. 

Not on the list: LLM Guard. Protect AI archived the repository on July 9, 2026, about a year after Palo Alto Networks completed its acquisition of the company. It still installs. Nobody is patching it. 

Compare all nine side by side 

✓ built in · ! partial, needs custom code, configuration or a higher tier · ✗ not a focus. Editorial assessment based on public documentation, October 2026. 

One detector, or a control plane? 

Start with one question: where may raw PII travel before redaction? If “nowhere outside our network,” pair Presidio’s rules with Privacy Filter. If an approved cloud already holds the data, use its guardrail. Buying instead? Pick by need: a vault, role-aware access or many languages. The decision tree below maps it. 

That settles one app. With twenty agents on different models, consistency becomes the problem, which is the layer Opencontroller adds above your detector. 

Before you sign, run four tests on your own data: 

1. Tool-call test: hide an email inside a JSON tool argument. Is it caught? 
2. Round-trip test: does PERSON_001 come back for the right user, and stay a token in logs and memory? 
3. Boundary test: trace every hop the raw value makes before redaction. Your DPA should cover each one. 
4. Bad-day test: take the detector offline. Does traffic stop, or sail through unredacted? 

Back to that ticket with the card number. A better regex would not have saved it. A rule covering the ticket, the tool call and the trace at once, with a log proving it fired, would have. 

Pick the detector that fits your data boundary. Then decide who enforces it when another team ships an agent at 6 p.m. on a Friday. Book a demo to see Opencontroller apply your redaction policy across your own agents. 

FAQ

Book A Demo: Click Here
Join our Slack: Click Here
Link to our GitHub: Click Here