Personal data (PII)

Flags personal data appearing in prompts. Default: report.

What it detects

• Email addresses
• International phone numbers, where a country prefix is present
• IBANs, validated by checksum rather than merely shaped like one
• Payment card numbers, validated with the Luhn check

The checksum validation on the last two matters: it means a random 16-digit number in a test fixture does not become a card-number incident.

Why you would care

Two reasons, usually. Under GDPR, sending customer personal data to an AI provider is a processing activity you need to have thought about. And separately, most engineering teams simply do not intend to paste production data into a chat window — this is how you find out that it happens.

Tuning

Start at report. Look at where the findings cluster: if they come from one team debugging with real data, that is a conversation, not a policy setting. If they are spread evenly, consider warn so developers get feedback in the moment.

Block is aggressive for this detector — an email address in a prompt is often completely legitimate — so most organizations stop at warn.