Skip to main content
The Data Loss Prevention detector finds sensitive data — PII and secrets — in prompts and model output, and can mask it in flight. Create and configure it in the console under Detectors; attach it from a policy to choose what happens when it matches. It is the only mutable detector: the only one that supports the Transform action (mask matched values before the payload continues). JSON bodies are masked structurally (string values only — keys are never touched); plain-text bodies are masked directly. Matches that are secrets (API keys, access tokens, JWTs, Stripe keys) are reported as secret findings; other entities as PII.

​
Configure in the console

  1. Open Detectors → create a detector and pick Data Loss Prevention.
  2. Under Data Categories, choose what to detect (or use Enable all).
  3. Optionally add Custom rules for keywords or regex patterns that are not in the built-in catalog.
  4. Save the detector, then add it to a policy rule (Input and/or Output) with an action.
You must configure at least one of: Enable all, one or more data categories, or one or more custom rules.

​
Actions (on the policy)

The detector only finds and (when Transform is selected) masks. The action is set on the policy rule that references it:

​
Data Categories

The form groups 43 built-in entities into searchable categories. Toggle individual entities on or off, or use the Enable all control to mask every catalog entity at once. Secrets — these four are reported as secret findings (the rest as PII): API key, access token, JWT token, Stripe key. (UUID appears in the Secrets group in the console for convenience; it is not classified as a secret finding.) When Transform runs, predefined entities are replaced with an entity-specific token (for example [MASKED_EMAIL]) unless you rely only on custom rules.

​
Custom rules

Use Custom rules when you need patterns that are not in the built-in catalog — internal account IDs, project codes, product-specific tokens, and so on.
  1. In the detector form, open Custom rules.
  2. Click Add custom rule.
  3. Set Type:
    • Keyword — exact substring match (e.g. confidential).
    • Regex — a regular-expression pattern (e.g. ACME-\d{6}).
  4. Enter the keyword or pattern (required).
  5. Optionally set Mask with (default ***) and Preserve length (replace with * repeated to the original length).
  6. Add more rules as needed; each rule is evaluated in order along with the selected data categories.
Empty patterns are invalid — the console blocks save until every custom rule has a non-empty keyword or regex.

​
When to use

  • Output + Transform — strip PII the model regurgitates before it reaches the user.
  • Input + Transform — keep PII out of third-party model providers.
  • Block on secret categories (API key, access token, JWT, Stripe key) — stop credential leakage.
  • Start with Monitor (and policy Report mode) when enabling broad categories, then switch to Enforce + Block/Transform once the signal looks right.