product / sanitization
Sanitization
Redaction is the blunt instrument. Most of the time you want the model to keep reasoning about a value it is not allowed to see — which means replacing it, consistently, with something you can reverse.
Four transforms
Set per detector, per policy. A single request can redact card numbers, pseudonymise names, and mask phone numbers in the same pass.
| Transform | What the vendor sees | Reversible | Use when |
|---|---|---|---|
| Redaction | [REDACTED] | No | The value has no business leaving and no downstream use. Card numbers, secrets. |
| Tokenisation | [EMAIL_7f2a] | Yes, via vault | The model must track the entity across a conversation, and you need the real value back. |
| Format-preserving mask | (206) 555-0000 | No | Downstream systems validate the shape of a field and reject a token. |
| Synthetic substitution | Dana Whitfield | Yes, via vault | The payload must read as natural prose — evaluation sets, prompt examples, vendor demos. |
Consistent tokens, reversible in one place
The same input value always produces the same token within a policy scope, so a model can tell that the sender and the account holder are one person without learning who that person is. Joins survive. Aggregations survive.
The mapping lives in a vault you control — hosted in your region, or in your own infrastructure on the self-hosted plan. Rehydration happens on the return leg, so tokens in the model’s reply become real values again before your application sees them.
Scope is explicit: tokens can be stable per request, per session, per tenant, or globally. Wider scope means more analytical utility and a larger correlation surface, so the choice is yours to make and yours to justify.
# Out — what the provider receives { "from": "[EMAIL_7f2a]", "name": "[PERSON_c194]", "card": "[REDACTED]", "phone": "(206) 555-0000" } # Back — what your application receives { "summary": "Maria Alvarez was double-charged; refund issued to maria.alvarez@…" } # Model wrote [PERSON_c194]. Divelai wrote the name.
Limits worth stating
Reversibility is a trade. A vault that can restore values is a vault that can be compelled or breached, which is why it is isolated, separately encrypted, and — if you would rather not have the risk at all — optional. Redaction and masking need no vault.
Tokens change the text the model reads. Most tasks are unaffected; some, such as reasoning about the format of a real address, degrade. Test your prompts against sanitized payloads before you roll out, and use synthetic substitution where naturalness matters.
Free-form output can echo a sensitive value the detector missed on the way in. Divelai runs detection on the response leg too, but the guarantee is only as good as the inbound pass.