> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowx.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Personal Information Guard
> Detect and redact personal data (PII) on AI workflow nodes before it reaches the model, and restore it in the response.
## Overview
Personal Information Guard (PII Guard) is a configuration block available on every AI workflow node. When turned on, it detects personal data and replaces it with placeholders before the payload reaches the model, then handles the redacted content throughout the node run. Detection and redaction run in the **data-privacy** AI Platform service; the workflow node calls it synchronously and **fails closed** — if the service errors, the node stops and no redacted artifact is produced.
PII Guard applies to Custom Agent, Intent Classification, Extract Data from File, and all AI Text, Document, Image, and Data Operations nodes.
PII Guard is the AI-node-level privacy control. It is distinct from process-level [data anonymization](/5.9/setup-guides/flowx-engine-setup-guide/configuring-access-roles-for-processes) (`FLOWX_DATA_ANONYMIZATION`), which redacts process data by role.
***
## Configuration
The guard is configured per node in the Designer. Turning it on exposes the detection options below.
| Field | Description |
| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Enabled** | Turn the guard on for the node. **Default:** OFF. |
| **Detection Algorithm Sensitivity** | One of **Strict**, **Balanced** (default), **Relaxed**, or **Custom**. Maps to a server-side detection threshold. **Custom** exposes a sensitivity slider (`0.00`–`1.00`). |
| **Detection Target** | Choose which payloads are scanned: **Node Input**, **Node Output**, or both. At least one must be selected. |
| **Personal Info Types** | Opens the **Customize Entities** modal — the picker for which entity types are detected. All are enabled by default. The catalog is served from `GET /integration/api/workflows/personal-information-guard/entities`. |
**Universal (8)**
`EMAIL`, `PHONE`, `CREDIT_CARD`, `IBAN`, `MAC_ADDRESS`, `CRYPTO_WALLET`, `PERSON`, `ADDRESS`
**Regional — EN (6)**
`SSN`, `US_PASSPORT`, `US_BANK_ACCOUNT`, `US_ITIN`, `UK_NHS`, `EU_VAT_ID`
**Regional — RO (10)**
`CNP`, `CUI`, `RO_IBAN`, `RO_PHONE`, `RO_PASSPORT`, `RO_ID_CARD`, `LICENSE_PLATE`, `HEALTH_CARD`, `POSTAL_CODE`, `LANDLINE`
***
## How it works
* **Input scan** runs before the AI request is built, so placeholder substitution and user-message extraction both see redacted data. The system prompt is scanned alongside inputs, because operation-prompt templates may carry PII from earlier nodes.
* **Source-file scan** runs for document and image AI nodes. The data-privacy service uploads the redacted artifact back to the same storage as the source, so the file path used for the request is swapped without changing the data source binding.
* **Output scan** runs after the model completes, on a bounded-elastic scheduler so the data-privacy call does not pin the event loop.
* **Restoration (deanonymization)** — when an input scan ran, the guard keeps the placeholder-to-value mapping for the duration of the node run and automatically restores the original values in the model's response, so downstream nodes and the end user see real data rather than placeholders. When an output scan is also on, PII the model newly introduced is redacted first, so only model-introduced values stay masked. Restoration also holds across chat-driven workflows that carry conversation memory.
* **Irreversible redaction for async file flows** — asynchronous document-parser flows keep permanent placeholders. Their mapping is never persisted, so values redacted in those flows are not restored.
* **System-prompt appender** — for Custom Agent nodes with an input scan, the runner appends a non-editable segment teaching the model to treat indexed placeholders like `` or `` as opaque tokens and copy them back verbatim. It runs after the prompt scan so its literal tags are not mistaken for PII.
* **Fail-closed** — any error from the data-privacy service stops execution, including a failed restoration (the node halts rather than let placeholder data reach downstream nodes). The error surfaces on the node run log; redacted artifacts are not produced on failure.
***
## Run-log and detections
Each enabled scan adds a `personalInformationGuard` block on the node response:
| Field | Description |
| -------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| `scanStatus` | `COMPLETED`, `SKIPPED`, or `FAILED`. |
| `totalDetections` | Total number of entities detected across `detections`. |
| `detections` | List of per-entity detection items (see below). Empty when nothing was detected. |
| `errorMessage` | Populated when `scanStatus = FAILED`. |
| `sourceType` | `TEXT`, `DOCUMENT`, or `IMAGE`. Identifies what the scan ran against. Null for text-only scans. |
| `originalStoragePath`, `redactedStoragePath` | Set for `DOCUMENT` and `IMAGE` scans; both point at the data source bound to the node. |
Each item in `detections` carries:
| Field | Description |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `entityKey` | Entity type detected (for example `EMAIL`, `PHONE`, `IBAN`). |
| `confidence` | Detector confidence score, `0.00`–`1.00`. |
| `originalValue` | The exact substring matched in the source. |
| `replacement` | The placeholder string that replaced `originalValue` before the model call. Input-scan placeholders are indexed, for example `` or ``. |
| `direction` | `INPUT` or `OUTPUT` — which scan direction produced this detection. |
| `sourceType` | `TEXT`, `DOCUMENT`, or `IMAGE` — which payload was scanned. |
| `timestamp` | When the detection was made. |
| `regions` | Bounding boxes (`x`, `y`, `width`, `height`) for `DOCUMENT` and `IMAGE` detections. Null for `TEXT`. |
Document and image scans surface the same per-entity detail as text scans, so the run console shows the matched values, replacements, and confidences regardless of which AI node type produced them.
***
## Setup
The data-privacy service connection is configured with `FLOWX_DATAPRIVACY_BASEURL` and `FLOWX_DATAPRIVACY_TIMEOUTSECONDS` — see the [Integration Designer setup guide](/5.9/setup-guides/integration-designer-setup#service-communication).
***
## Related resources
Per-node configuration, including the PII Guard toggle
PII Guard on document and image extraction nodes
PII Guard on intent classification nodes
AI workflow nodes and their configuration
## Related topics
- [Integration Designer](/5.9/docs/platform-deep-dive/integrations/integration-designer.md)
- [Extract Data from File](/5.9/ai-platform/agent-builder/extract-data-from-file.md)
- [Intent Classification](/5.9/ai-platform/agent-builder/intent-classification.md)
- [Agent typologies](/5.9/ai-platform/patterns/agent-typologies.md)
- [FlowX.AI 5.8.0 Release Notes](/release-notes/v5.x/v5.8.0-may-2026/v5.8.0-may-2026.md)