StackOne
Xero
Salesforce
Google Drive
Notion
Asana
via Claude Code
SAP S/4HANA
200 OKClean
- User / Agent
- Taylor Brooks
via Copilot - Account
- Supplier Admins
Policies evaluated2
Restrict supplier changesNo match
1 other policyNo match
Supplier returned
PII redaction for AI agents. State-of-the-art PII detection,
built for agents
Built on our own PII model, trained on agent tool calls. Redact personal data the way your policies say, and trust your agents with more.
Try it on your own text- Zendesk, zendesk_list_ticket_comments, response: "My card 4111 1111 1111 1111 was charged twice for order ORD-77412. Call me on (415) 555-0172." The card number and phone are redacted; ORD-77412 stays.
- Workday, workday_get_worker, response: "Worker 21017, payroll. National ID 219-09-9999, hired 2019-06-03." Blocked: SSN in the response. The agent gets a refusal.
- ServiceNow, servicenow_get_incident, response: "VPN down since 09:14 for INC0012877. Caller asks for a callback on +1 646 555 0123." The phone is redacted; INC0012877 stays.
- Slack, slack_send_message, input: "Refund approved for ORD-61530. Customer is priya.n@example.org." The email is redacted; ORD-61530 stays.
- Gmail, gmail_send_message, input: "Charge the card on file, 6011 1111 1111 1117, for invoice INV-3184." Blocked: card number. Gmail never gets the email.
PII accuracy on agent tool calls
Connector PII: 247 field values from connector API responses, the data agents read through StackOne. 129 of them hold no personal data. Each detector runs at its best documented setting.| Detector | Finds PIISpan F1: how much of the personal data each detector finds, and how precisely. Higher is better. | Flags clean fieldsShare of 129 fields with no personal data that got redacted. |
|---|---|---|
 | 97.9% | 3.1% |
| GLiNER multi PII v1 | 89.6% | 6.2% |
| OpenAI Privacy Filter | 70.6% | 60.5% |
| Presidio | 68.1% | 48.8% |
Leads every commercially usable detector on all four benchmarks Span F1 on Connector PII (247), OpenPII (1,000), Nemotron-PII (1,000), Privy (1,000) examples, each detector at its best documented setting.
Companies already connected through StackOne
SOC 2 Type II- Detection runs inside StackOne. No third-party service sees your data.
- Every redaction logged
PII redaction demo. Redaction that keeps
the agent working.
Pick a real tool call to see StackOne's recorded output next to Presidio's. Edit the payload or paste your own, then run it.
Redact
freshservice_get_ticketResponse - All 2 record references intact
- No personal data missed
{ "id": "4471 (kept)", "subject": "Laptop won't boot", "description": "Call me on <REDACTED_PHONE_NUMBER> (personal data removed) after <REDACTED_TIME> (also removed, was 5pm), or email <REDACTED_EMAIL> (personal data removed).", "asset_tag": "AST-004421 (kept)"}
Select or right-click text here to flag what we got wrong.
- 1 of 2 record references broken
- No personal data missed
{ "id": "4471 (kept)", "subject": "Laptop won't boot", "description": "Call me on <DATE_TIME> (personal data removed) after <DATE_TIME> (also removed, was 5pm), or email <EMAIL_ADDRESS> (personal data removed).", "asset_tag": "AST- (kept)<US_DRIVER_LICENSE> (removed by mistake, was 004421)"}
- <REDACTED_EMAIL>Personal data removed
- 555-0134Personal data left in
- AST-004421Kept for the next call
- <US_DRIVER_LICENSE>Record reference removed
- <LOCATION>Also removed
Sends your text and this selection to StackOne.
How PII Redaction works. One support request,
start to finish.
A field rule can mask a field called ssn, but a phone number typed into a ticket comment has no field of its own. PII Redaction scans every string in the call and replaces only the classes you chose.
An employee asks their AI assistant to summarise Zendesk ticket 51207 and post it in #billing. The assistant calls zendesk_list_ticket_comments, and Redact PII replaces the card number, phone number and email address in the response with tags that name each class, such as <POLICY_REDACTED:EMAIL>. The comment reference, timestamp and order number stay intact. The employee then pastes the customer's reply, which contains a card number, and asks for it as an internal note. With the Redact action, zendesk_update_ticket reaches Zendesk with the card number replaced by <POLICY_REDACTED:CREDIT_CARD>. With the Block action, the call is refused before it reaches Zendesk. The assistant posts the summary with slack_send_message and replies without any of the personal data. The activity panel logs each decision.
Set up PII Redaction. One rule for tool calls, one switch for logs.
Add it in Project Settings > Policies, for a project or one linked account.
Redact swaps each match for a tag that names its class, like <POLICY_REDACTED:EMAIL>. Block refuses the call, on the input or the response.
Turn on Redact personal information (PII) in Project Settings > Advanced Logs. Personal data in request and response bodies is replaced before the log is written.
Path, status and linked account stay searchable in Observability & Audit.
Start in Monitor only to see what the rule would redact, then switch to Enforce.
- Monitor only Records what the rule detects. Calls pass unchanged.
- Review Check those records in the logs.
- Enforce Redacts or blocks, and lists the classes removed.
PII detection benchmark. Finds more personal data.
Breaks fewer tool calls.
Our own PII model against open PII models, each scored the same way on the same examples per dataset. Span F1 measures how well each one finds the personal data in a text. The false-positive rate shows how often it flags a field that holds none.
| Dataset | Detector | Span F1 | Setting |
|---|---|---|---|
| Connector PII, Connector field values, 247 examples | StackOne PII Redaction | 97.9%, 3.1% false positives on 129 fields with no personal data | As it runs in StackOne, no tuning. |
| GLiNER multi PII v1 | 89.6%, 6.2% false positives on 129 fields with no personal data | Threshold 0.5, the library default, with the labels on its model card. | |
| OpenAI Privacy Filter | 70.6%, 60.5% false positives on 129 fields with no personal data | Its default operating point. | |
| Presidio | 68.1%, 48.8% false positives on 129 fields with no personal data | Standard recognisers, default settings. | |
| Privy, JSON, SQL and XML payloads, 1,000 examples | StackOne PII Redaction | 98.9% | As it runs in StackOne, no tuning. |
| NVIDIA GLiNER-PII | 62.9% | Threshold 0.5, from its model card's usage example. | |
| Presidio | 51.3% | Standard recognisers, default settings. | |
| Ettin-68M | 50.3% | Default token-classification settings. | |
| Nemotron-PII, Business documents, 1,000 examples | StackOne PII Redaction | 95.5% | As it runs in StackOne, no tuning. |
| Ettin-68M | 94.4% | Default token-classification settings. | |
| NVIDIA GLiNER-PII | 91.4% | Threshold 0.5, from its model card's usage example. | |
| Isotonic DeBERTa-v3, non-commercial licence (CC BY-NC 4.0) | 74.5% | Default token-classification settings. | |
| OpenPII, Synthetic prose, 1,000 examples | StackOne PII Redaction | 89.3% | As it runs in StackOne, no tuning. |
| Isotonic DeBERTa-v3, non-commercial licence (CC BY-NC 4.0) | 91.5% | Default token-classification settings. | |
| NVIDIA GLiNER-PII | 88.2% | Threshold 0.3, its model card's evaluation setting. | |
| Ettin-68M | 82.6% | Default token-classification settings. |
8.3 pts better than next best
36.0 pts better than next best
1.1 pts better than next best
1.1 pts better than next best for commercial use
Span F1, 247 to 1,000 examples per dataset
Accuracy, size and speed Smaller and faster too: 24 MB, about a millisecond per field. Span F1 on 247 to 1,000 examples per dataset, each detector at its best documented setting. The best in each column is bold, and green where it's StackOne.
| Detector | Connector PIIConnector field values | False positivesLower is better | OpenPIISynthetic prose | Nemotron-PIIBusiness documents | PrivyJSON, SQL and XML payloads | SizeOn disk | SpeedMedian per field |
|---|---|---|---|---|---|---|---|
 Our own model, runs inside StackOne | 97.9% (best) | 3.1% (best) | 89.3% | 95.5% (best) | 98.9% (best) | 24 MB (best) | 1.0 ms (best) |
| NVIDIA GLiNER-PIIOpen model | 58.2% | 72.9% | 88.2% | 91.4% | 62.9% | 1,793 MB | 497 ms |
| Ettin-68MOpen model | 50.2% | 80.6% | 82.6% | 94.4% | 50.3% | 141 MB | 14.6 ms |
| Isotonic DeBERTa-v3Non-commercial licence | 55.0% | 85.3% | 91.5% (best) | 74.5% | 32.5% | 747 MB | 56.0 ms |
| PresidioOpen source | 68.1% | 48.8% | 67.3% | 69.4% | 51.3% | 447 MB | 1.8 ms |
| OpenAI Privacy FilterOpen model | 70.6% | 60.5% | 72.9% | 66.7% | 47.3% | 2,799 MB | 385 ms |
| Piiranha mDeBERTaNon-commercial licence | 64.3% | 13.2% | 80.4% | 54.9% | 39.1% | 1,134 MB | 55.2 ms |
| GLiNER multi PII v1Open model | 89.6% | 6.2% | 63.0% | 57.1% | 50.3% | 1,160 MB | 146 ms |
Size includes tokenizer files (Presidio includes its 445 MB spaCy model). Speed is the median time per Connector PII field, timed on 4 vCPU through the same harness; StackOne runs in Node, the others in Python. Absolute times vary by machine.
PII Redaction alongside the rest of the Secure controls
- 02 / 04
Tool Policies
Redact PII sits next to Semantic rule and the tool, field and value controls.
- 03 / 04
Observability & Audit
Advanced Logs, plus the policy decisions recorded for every call.
Common questions. PII Redaction FAQ
for IT and security teams.
Keep personal data out of agent context.
Redact PII in tool calls and logs, the way your policies say.