PII masking
How to keep personal data away from the model: the X-PII-Masking header, what is masked and the limits.
Masking replaces personal data in a request with tokens before it goes to the model, and puts the original values back into the response. The model sees a token instead of a name, and you get an answer with the real name. The option is paid and is enabled for an organization separately.
How to turn it on
The X-PII-Masking header decides the fate of each request:
| Value | What happens |
|---|---|
on | the request is masked |
off | no masking and no error, even if the option is not enabled |
| not sent | the organization setting applies, and without the option enabled there is no masking |
true, false, 1 and 0 are also accepted. If you send on and the option is not enabled, you get 403 pii_masking_not_enabled: the request does not reach the model without masking while you think you are protected.
curl https://api.morphogen.ru/v1/chat/completions \
-H "Authorization: Bearer $MORPHOGEN_API_KEY" \
-H "X-PII-Masking: on" \
-H "Content-Type: application/json" \
-d '{
"model": "gpt-6-luna",
"max_tokens": 100,
"messages": [{"role": "user", "content": "Составь приветствие для Ивана Иванова, телефон +7 912 345-67-89"}]
}'The response carries the X-PII-Masking: applied header if masking was applied, and off if not. Check it in your code if protection is mandatory.
What is masked
Only the message text, in Russian and partly in Latin script. The service finds:
- full names, phone numbers, emails;
- passports, SNILS, individuals' tax IDs (INN), driver's licenses, foreigners' documents;
- bank card numbers, accounts of individuals and sole proprietors;
- addresses, dates of birth;
- secrets: API keys, passwords, tokens.
Organization details (settlement account, BIK, KPP, OGRN, a legal entity's INN) are not personal data and are not masked by default.
Masking reduces the amount of personal data in a request to the model but does not remove it completely. The search uses rules, dictionaries and a name recognition model. Rare forms, typos and single names without context can slip through. When in doubt, the service prefers an extra mask, so contract dates and service email addresses are sometimes masked.
What is not masked
- Images, audio, tool definitions, and the arguments and results of tool calls go to the model as is. Only the text content of messages is supported.
- There is no masking on
/v1/embeddings,/v1/audio/transcriptions,/v1/images/generationsand on/v1/chat/completionswith an image model. An explicitX-PII-Masking: ongives 400pii_masking_unsupported_endpoint. - On
/v1/videosthe header is ignored: the request goes through and the prompt reaches the provider unmasked. Do not send personal data in a video prompt. - Tool call arguments in the response are not unmasked.
Streaming and failure handling
In streaming mode the values return to their places as tokens arrive. If the masking service is unavailable, the request gets 503 and does not go to the model: unmasked text is never sent. Such a request is not charged.
Errors
| Code | Cause |
|---|---|
400 invalid_pii_masking_header | the header value is not in the list |
400 pii_masking_unsupported_endpoint | on on an endpoint without masking |
403 pii_masking_not_enabled | the option is not enabled for the organization |
503 service_unavailable | the masking service is unavailable |