entity classes detected on day one
redaction latency, p95
raw NPI ever forwarded to a model provider
aligned by design
The DLP Engine scans the full prompt, including tool-call parameters, RAG retrieval results, and document attachments, for the 12 entity classes documented below. Detection runs on commodity CPU and parallelizes with the injection classifier; under 5ms at p95.
Every detected entity is replaced with a token shaped like [ACCT_a7f3]. The same value gets the same token within the session, so the model can reason about "this account" and "this recipient" without ever seeing the underlying value. Tokens are scoped to the session and never reused across sessions.
If the model returns a response that references [ACCT_a7f3], the DLP Engine restores the original value before the response reaches your application. If your application does not need the un-tokenized value, you can opt into receiving the tokens directly. Per-application policy.
The 12 classes below cover the regulated data categories that trigger compliance findings. Bank-specific extensions, internal account number formats, custom customer ID schemes, branch codes, are added through configuration and shipped with your deployment.
Each entity class has documented detection precision and recall measured against a labeled dataset of bank prompts. The metrics ship with the deployment and update with each detector revision. Pattern-based classes are the guarantee; free-text NPI is best-effort content inspection, and we mark which is which.
Reconciliation agents, fraud-investigation agents, and certain customer-service workflows legitimately need a specific NPI value to reach the model. The DLP Engine honors a per-request scope header that scopes redaction down to a documented allowlist. The decision is logged to Time Machine with the requesting agent's identity, the scope, and the human principal.
The default for every agent. NPI never reaches the model. Most banks operate the entire fleet under this default and only deviate for specifically scoped agents.
Specific entity classes can be allowed for specific agent types under documented scope. Scope changes go through your change-management workflow. Every scoped agent action is logged with its scope and human principal.
| Framework | What it expects | BladeRun control |
|---|---|---|
| GLBA / Reg P | Technical safeguards preventing unauthorized disclosure of customer NPI to third parties. | 12-class detection · tokenization |
| PCI-DSS 4.0 | Protection of cardholder data, PAN, CVV, across all processing environments. | PAN format-preserving · CVV removed |
| GDPR · Article 32 | Pseudonymization and encryption of personal data. | Per-session deterministic tokens |
| HIPAA · 164.312 | Technical safeguards preventing unauthorized disclosure of protected health information. | MRN class · scoped extensions |
| FFIEC AI Guidance | Documented controls for data flowing into and out of AI systems. | Time Machine · all redactions logged |
DLP is the final layer of the Gateway enforcement cascade, runs on every outbound prompt before forwarding.
Every redaction is logged with the original entity class, the token, and the agent's identity. Restoration events are logged separately.
Detector improvements ship through Federation rule updates, when one bank improves a detector, every member benefits.
Pattern-based detectors (PAN, SSN, account number) operate at well above 99% precision because the underlying formats are structured. Free-text NPI is the harder class; we publish per-deployment precision and recall against your bank's actual prompt corpus during the pilot. Tuning happens during the maturation phase before enforcement is enabled.
Less than most teams expect. Deterministic per-session tokens preserve the model's ability to reason about entities ("this account," "this recipient") and produce coherent responses. We see no measurable degradation on benchmarks where the model is asked to reason about structure, summarize, classify, or extract. For workflows where the model needs the underlying value, the per-agent scope override pattern applies.
Configuration. Internal account number formats, custom customer ID schemes, branch codes, and similar formats are added by submitting a regex or sample dataset. The detector ships with your deployment. Bank-specific detectors do not contribute to the Federation Network. They remain local.
Attachments are redacted at the point they enter the agent's context, not at inference time. PDFs are extracted to text, redacted, and re-attached as redacted text or as a sanitized PDF depending on the workflow. Office docs are handled the same way. The original attachment never reaches the model.
RAG retrieval results pass through DLP as they enter the context window. The model sees redacted retrieval. Two configurations are supported: redact-then-rerank (the model never sees raw NPI) and rerank-then-redact (rerank quality preserved on the original; redaction applied just before forwarding). The first is the default for regulated workloads.
In your environment. The token-to-value mapping lives in a per-session encrypted store inside the Gateway, scoped to the session lifetime. Long-lived sessions can configure a longer scope window. The mapping is never persisted outside your environment, never transmitted, never accessible to BladeRun staff.
The first week of every Gateway pilot includes DLP in shadow mode. We report what would have been redacted without modifying the prompts. Most teams are surprised by what shows up.