Best PII Redaction Tools for LLM Prompts and Responses 2026
The short answer
Use a self-hosted detector when prompts must not leave your network, a gateway when you want one policy for every model provider, and a cloud API when your data already lives in that cloud. The best PII redaction tools for LLM prompts and responses, as of October 28, 2026:
| Tool | Type | Prompts / responses | Price | Best for |
|---|---|---|---|---|
| Microsoft Presidio | Open source (MIT), self-hosted | Anything you pass it | Free | Data that must stay in your VPC; custom recognisers |
| Cloudflare AI Gateway DLP | Managed gateway | Both; flag or block | Free on all plans (2 predefined profiles without Zero Trust) | One policy across OpenAI, Anthropic, Google and Workers AI |
| AWS Comprehend | Cloud API | Anything you pass it | Detect PII $0.0001 per 100-character unit; Contains PII $0.000002; 50K units/month free for 12 months | AWS workloads, high volume |
| Google Sensitive Data Protection | Cloud API | Anything you pass it | Content inspection 1 GiB/month free, then $3/GiB; de-identification $2/GiB after 1 GiB | Reversible de-identification, Google Cloud data |
| Azure Language PII | Cloud API (also containers) | Text, conversations, native documents | Per 1,000 text records; free tier on F0 | Microsoft estates, call transcripts |
| NVIDIA NeMo Guardrails | Open-source guardrail framework | Input, retrieval and output rails | Free (v0.24.1, September 16, 2026) | Masking inside an agent pipeline |
Prices are from vendor pricing pages and releases on October 28, 2026.
How the options differ
Presidio (Microsoft, about 11,600 GitHub stars) has two parts: an analyzer that finds entities with patterns, checksums and NLP models, and an anonymizer that replaces, masks, hashes or encrypts them. It also has an image redactor and a structured-data module. It runs as a Python library or a Docker service, so prompts never leave your infrastructure. Recall depends on the NLP model you load; tune and test it on your own data.
Cloudflare AI Gateway DLP sits in front of every model call. It scans the prompt and the response, then passes, flags (adds findings to a cf-aig-dlp header and logs) or blocks. Scanning is free; without a Zero Trust subscription you get two predefined profiles — Financial Information and Social / Insurance / National Identifier Numbers — and custom profiles need Zero Trust DLP. Policies apply per gateway, and scanning a streamed response buffers it, adding latency.
AWS Comprehend offers Detect PII (locations, for redaction) and Contains PII (a yes/no check, priced 50× lower). Requests are billed in 100-character units with a 300-character minimum, so batch short prompts. AWS’s own example: redacting 10,000 comments of 550 characters costs $6.
Google Sensitive Data Protection (formerly Cloud DLP) is the strongest for reversible workflows: content.deidentify and content.reidentify let you swap personal data for tokens before the LLM call and restore it in the answer.
Azure Language PII covers three input shapes — plain text, conversation transcripts and native documents — and runs in containers for disconnected or on-premises use.
NeMo Guardrails is not a detector by itself; its input, retrieval and output rails can mask sensitive data at each stage of an agent or RAG pipeline, calling a detector such as Presidio.
A pattern that works
- Detect and pseudonymise before the call. Replace each entity with a stable placeholder (
<EMAIL_1>) and keep the mapping in your own store. - Scan retrieved chunks too. RAG pulls personal data from documents the user never typed.
- Scan the response and block or re-mask before display.
- Restore placeholders only for the user entitled to see the originals.
- Log findings, not values. Store entity types and counts in your observability tool, never the raw data.
Picks by situation
- Health, finance or EU personal data that must stay in-house: Presidio in your VPC, wrapped by NeMo Guardrails or your own middleware.
- Many model providers, small team: Cloudflare AI Gateway DLP in Block mode on responses.
- All data on AWS: Comprehend Contains PII as a cheap first pass, Detect PII only on flagged text.
- Need to restore values in the answer: Google Sensitive Data Protection de-identify / re-identify.
- Call-centre transcripts: Azure Language conversation PII.
For the edge-network version of this decision see Akamai vs Cloudflare AI inference: PII protection; for keys and credentials rather than personal data, see best secrets managers for AI agents.
Last verified: October 28, 2026.