PII Deletion

How PII gets tagged

Detection runs continuously through data tagging: pattern matching for structured PII, email addresses, card numbers, government IDs, and named-entity recognition for unstructured PII like names and addresses, applied to every agent interaction as it happens. The result is a PII tag on the field, not just a one-off alert, so it stays findable and deletable long after the run that produced it.

Deleting it: everywhere it touched an agent

Because tagging is what makes PII findable across every run, deletion is one action against the tag rather than a run-by-run cleanup: find every field carrying the PII tag for a given person or record, and remove it, wherever it appears. For the moment PII is first encountered, Prefactor can also act immediately: redact it, block the action outright, or escalate it to a human reviewer, depending on the sensitivity level configured for that data type. A name flowing through a support agent might simply pass through logged and redacted; a health record surfacing in an unrelated workflow might block the action and page the security team.

Compliance evidence

Every tagging event, deletion, redaction, and escalation is logged and exportable, satisfying GDPR, HIPAA, and PCI DSS requirements for evidence of how personal data is handled and removed. Combined with Prefactor's immutable audit trail, PII events become part of the same record used to answer an auditor's questions about how agents handle sensitive data: see the compliance guides at /compliance for the specific frameworks Prefactor maps to, including EU AI Act, SOC 2, ISO 27001, ISO 42001, NIST AI RMF, and OWASP LLM Top 10.