> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # PII Redaction > Remove personal data from tool inputs and responses, and from request and response bodies before Advanced Logs stores them. **PII Redaction** finds personally identifiable information (PII), such as email addresses and phone numbers, in the data passing through StackOne and replaces each value with a tag such as ``. It runs in two places, each turned on separately. A **Redact PII** rule in [Policies](/secure/policies) cleans what the agent sends to a tool and what the tool returns. The **Redact personal information (PII)** setting in [Advanced Logs](/secure/observability#advanced-logs) cleans request and response bodies before they are stored. ```mermaid theme={null} graph TD Call["AI agent calls a tool"] --> RuleIn["Redact PII rule redacts or blocks the input"] RuleIn --> Action["StackOne runs the action"] Action --> Provider["Provider responds"] Provider --> Defender["Defender scans the response"] Defender --> RuleOut["Redact PII rule redacts or blocks the response"] RuleOut --> Receive["AI agent receives the response"] Action -.->|request and response bodies| LogScan["Advanced Logs PII redaction"] LogScan --> Log["Stored advanced log"] style Call fill:#f3f4f6,stroke:#d1d5db,stroke-width:2px,color:#374151 style Receive fill:#f3f4f6,stroke:#d1d5db,stroke-width:2px,color:#374151 style Provider fill:#f3f4f6,stroke:#d1d5db,stroke-width:2px,color:#374151 style Action fill:#dbeafe,stroke:#3b82f6,stroke-width:2px,color:#1e40af style Defender fill:#dbeafe,stroke:#3b82f6,stroke-width:2px,color:#1e40af style RuleIn fill:#16a34a,stroke:#15803d,stroke-width:2px,color:#fff style RuleOut fill:#16a34a,stroke:#15803d,stroke-width:2px,color:#fff style LogScan fill:#16a34a,stroke:#15803d,stroke-width:2px,color:#fff style Log fill:#f3f4f6,stroke:#d1d5db,stroke-width:2px,color:#374151 ``` ## Choose where to redact The two surfaces are independent, so a project can use either or both. | | **Redact PII** rule in Policies | **Redact personal information (PII)** in Advanced Logs | | - | - | - | | **Protects** | The inputs your agent sends to a tool and the responses the tool returns. | The request and response bodies Advanced Logs stores. | | **Classes** | The ones you select: **Email address**, **Phone number**, **Social security number**, **Credit card number**. | Every kind of personal data the scan detects, including names, phone numbers, email addresses, postal addresses, government ID numbers, and payment card numbers. | | **Kept intact** | Everything outside the selected classes, including record UUIDs, order numbers, and API keys. | Log metadata such as the path, status code, connector, and Linked Account. | | **Scope** | The whole project, or specific Linked Accounts. | The whole project. | | **Calls covered** | Calls made by the users or groups the policy covers, through an [AI platform](/connect/overview). | Every call that writes an advanced log of an action. | | **On a match** | **Redact** replaces the value. **Block** refuses the call, whether the match is in the inputs or the response. | The value is replaced. | | **Rollout** | **Monitored** records what the rule would do, then **Enforced** acts. | On or off. | | **Configured in** | **Project Settings > Policies** | **Project Settings > Advanced Logs** | ### Redact PII and semantic rules **Redact PII** and the **Semantic rule** capability both use a model to work out what the data in a call contains, then apply your policy to it, on a tool's inputs and its response. A semantic rule answers a plain-language question you write. **Redact PII** looks for four fixed classes of PII with StackOne's own model, and finds them inside any field, including free text such as a ticket description. See [Capabilities](/secure/policies#capabilities) for both. ## How detection works StackOne scans every string value in the body, in two passes: 1. **Patterns** match well-formed values such as email addresses. 2. **StackOne's PII model**, a token classifier StackOne trained for this task, reads the text for personal data the patterns miss, such as a phone number inside a ticket comment. The model is about 24MB and runs inside StackOne's runtime, in the process that runs the action. Your data is not sent to a third-party detection service, and detection adds milliseconds rather than a network call. Only the matched span is replaced, so a ticket description keeps its text and loses the email address inside it. On a tool input, redaction runs before the call reaches the provider. On a response, it runs after [Defender](/secure/defender) has scanned the response, and before the agent receives it. ## Redact PII in tool calls A **Redact PII** rule is a [policy](/secure/policies) capability. Denying it for a class redacts that class from tool inputs and responses, or blocks any call where it appears. Every class you don't select passes through unchanged, so a customer number or record UUID next to a redacted email address stays as it was. 1. Select the project and open **Project Settings > Policies**. 2. Click **Create policy** and give the policy a descriptive name. 3. Set **Enforcement** to **Monitored**. 1. Under **Who it applies to**, select **Everyone**, **Users**, or **Groups**, then pick the users or groups. 2. Under **What it does**, select **Deny**. Under **Capabilities**, add **Redact PII**. Denying **Redact PII** checks calls for the chosen classes of PII. StackOne's own PII model scans the tool's inputs before it runs and the response before the agent sees it, including free-text fields such as ticket bodies and notes. Record UUIDs, order numbers, and API keys stay intact. The [PII Redaction benchmark](https://www.stackone.com/platform/pii-redaction/#benchmarks) compares the model with Microsoft Presidio on connector data. Choose which targets it applies under **Applies to**: * **Everything** covers every connector and account in the project. * **An account** covers specific [Linked Accounts](/gateway/concepts/linked-accounts). Search accounts by name or owner. Under **Which PII to redact**, select one or more classes. There is no pattern to enter. Then choose what a detection does: * **Redact** replaces each detected span in the inputs and in the response, and lets the call continue. The rest of the input or response is unchanged. * **Block** refuses the call. When the PII is in the inputs, the provider is never called. When it is detected in the response, the agent receives a refusal instead of the data. A response that cannot be scanned (it is streamed, above the scan size limit, or the scan fails) is returned unredacted, and the request log records which classes were not redacted. Review the rule in the panel footer, then click **Create policy**. Under **Monitored**, PII detections are recorded and the call goes through unchanged. Run real calls, then open an action log and select the **Policy** tab to review the record. Once the rule catches what you expect, edit the policy, set **Enforcement** to **Enforced**, and save. The rule acts from the project's next call. For every option on the policy form, see [Create a policy](/secure/policies#create-a-policy). ### What changes in the call With **Redact**, each match is replaced by a tag naming its class, such as ``, in the input the provider receives or the response the agent receives. The agent can tell a value was withheld by policy, and which class it was. With **Block**, the agent receives a [refusal](/secure/policies#what-a-denied-call-returns) as the tool result. If a chosen class is in the inputs, the provider is never called. If it is detected in the response, the agent gets the refusal instead of the data. When a rule removed something, the tool result also carries `policyMetadata`. Its `result` is `partial`, and `redactedClasses` names each class removed and the policy level, not the rule. For example, a response from which an email address was removed: ```json theme={null} { "isError": false, "result": { "data": { "id": "8f2c1a7e-4b6d-4e3a-9c1f-2d7b5e0a3c91", "description": "Refund request. Email ." } }, "policyMetadata": { "result": "partial", "maskedFields": [], "redactedClasses": [ { "class": "email", "level": "project" } ] } } ``` The class values are `email`, `phone_number`, `ssn`, and `credit_card`. ## Redact PII in Advanced Logs Select the project and open **Project Settings > Advanced Logs**. 1. Turn **Status** on, if it is off. The other settings can only be changed while it is on. 2. Turn on **Redact personal information (PII)**. Advanced Logs settings: status, storage, background operations, and PII redaction When **Redact personal information (PII)** is on, StackOne scans each body before the log is written and replaces each personal value it detects with a tag naming its type, such as `` or ``. Credential-like tokens the patterns catch have no type and become ``; named credential fields follow the **Credentials** rule below. Only the redacted copy is stored. * **Detection.** Patterns catch email addresses and credential-like tokens. A model finds names, phone numbers, postal addresses, government ID numbers, payment card numbers, and other personal data. * **Scope.** Request and response bodies only. Log metadata such as the path, status code, connector, and Linked Account stays intact, so logs remain searchable. * **Coverage.** The bodies of action call logs. * **Applies to new logs only.** Logs that are already stored are not changed. * **Credentials.** Fields whose names match a fixed list of credential names, such as `password`, `token`, `api_key`, `client_secret`, and `authorization`, are masked in every stored body whether or not PII redaction is on. The value is replaced with `**redacted**`, followed by its last five characters when it is longer than 10 characters. StackOne may not catch every instance of personal data. Don't treat redaction as the only control for regulated data. For the other Advanced Logs settings, see [Observability](/secure/observability#advanced-logs). ## What is recorded Each surface leaves a different trace: * **Redact PII rule.** Open the action log and select the **Policy** tab. A call the rule changed is recorded with result `partial`, and the rule that acted shows the effect `redacted`. Under **Monitored**, the record shows the PII the rule detected instead. * **Advanced Logs.** The stored body is the redacted copy. Nothing records which values were replaced. ## FAQ No. Both passes run inside StackOne's runtime, in the process that runs the action. No third-party detection service sees your data. On connector data, detection takes about a millisecond per field at the median, measured for detection alone on 4 CPU cores. Longer text, such as a full document, takes longer. Detection runs in the process that runs the action, so there is no extra network call. A **Redact PII** rule removes only the classes you select, and record UUIDs, order numbers, and API keys belong to none of them. The Advanced Logs setting detects them in stored bodies. The **Redact PII** rule covers the four classes listed in [Choose where to redact](#choose-where-to-redact). To keep a field such as a home address away from the agent, deny **Read a field** on it in a [policy](/secure/policies#capabilities). Span-level F1 score compared with Microsoft Presidio, on 247 Connector PII examples and 1,000 examples for each other dataset: | Dataset | StackOne | Presidio | | - | - | - | | OpenPII (synthetic prose) | 89.3% | 67.3% | | Nemotron-PII (business documents) | 95.5% | 69.4% | | Privy (JSON, SQL, and XML payloads) | 98.9% | 51.3% | | Connector PII (connector field values) | 97.9% | 68.1% | On 129 connector field values with no personal data, StackOne's model flagged 3.1% as PII, and Presidio flagged 48.8%. The OpenPII row uses 1,000 English validation rows of [OpenPII 1.5M by Ai4Privacy / Ai Suisse SA (CC BY 4.0)](https://huggingface.co/datasets/ai4privacy/pii-masking-openpii-1.5m). All rows were measured in October 2026. StackOne's model was trained on the training splits of Nemotron-PII and Privy and on connector data, among other sources, and never on OpenPII. Connector PII is StackOne's own dataset. No test example appears in the training data. ## Next steps Combine Redact PII with tool and field rules for the same users. Configure Advanced Logs storage and retention. Scan tool responses for prompt injection. Limit which actions each Connector Profile exposes. Benchmark and examples. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.