PII Redaction
Recognising personal information and keeping it out of places it should not be. Quiet, unglamorous, and the difference between a conversation log and a data breach.
Recognising personal information and keeping it out of places it should not be. Quiet, unglamorous, and the difference between a conversation log and a data breach.
What it does
Redaction identifies personal data in text — identity numbers, card numbers, phone numbers, addresses, names — and removes or masks it before that text is stored, logged or analysed.
It matters because conversations naturally contain personal data. Customers volunteer their national ID, read out a card number, mention an address. None of that needs to persist in a transcript for the assistant to have been useful, and all of it becomes a liability the moment it is retained.
Where it shows up in a conversation
Transcripts
Keeping identity and card numbers out of stored conversation records.
Analytics
Ensuring conversation analysis works on text stripped of personal detail.
Quality review
Letting staff review conversations without unnecessary exposure to personal data.
Escalation
Passing context to a human agent without passing more than they need.
Logs
Preventing personal data reaching operational records that have wider access.
Exports
Ensuring data leaving the system for any purpose is already minimised.
Why it is harder in two languages
Arabic redaction faces a harder recognition problem than English. Personal names are the clearest case: Arabic naming conventions produce long compound names, and there is no capitalisation to signal that a word is a name. English redaction leans heavily on capitalisation as a cue; Arabic offers nothing equivalent.
Numbers are the second issue. Identity numbers, phone numbers and card numbers may be written in either numeral system, with varied spacing and separators, sometimes mixed within one message.
Addresses are the third. Saudi addresses are structured differently from Western ones, districts are referred to informally, and transliteration is inconsistent — so a pattern-based approach built for another market will miss a great deal.
What to look for when you evaluate it
| Arabic name recognition | The hardest case, and where English-derived redaction fails most. |
|---|---|
| Numeral coverage | Both numeral systems, with varied formatting and separators. |
| Local formats | Saudi identity numbers, phone formats and address structures specifically. |
| False negative rate | What it misses matters far more than what it over-redacts. |
| Where it runs | Whether redaction happens before storage or after, which is the difference between prevention and cleanup. |
| Reversibility | Whether redaction is permanent, since recoverable masking is not really redaction. |
Where it should not be trusted alone
Redaction should not be treated as sufficient on its own. It reduces exposure; it does not eliminate it, because recognition is imperfect and some personal data is contextual rather than patterned — a sentence can identify somebody without containing a single recognisable identifier.
It is therefore a layer, not a control. Retention limits, access control and encryption do the structural work; redaction reduces what is at stake when something goes wrong.
It also should not be used to justify longer retention. "We redact, so we can keep it" inverts the logic — the safest position remains keeping less for less time, with redaction reducing the residual risk rather than licensing accumulation.
How this fits the whole
No single capability answers a question on its own. A conversation passes through several in sequence — understanding what was asked, finding the relevant material, composing a reply, checking it before it is sent — and the quality of the result is set by the weakest link rather than the strongest.
That has a practical consequence for evaluation. Vendors tend to demonstrate their strongest component, and a system with excellent retrieval and weak language handling will demo beautifully and disappoint in production, because the demo was conducted in the language and phrasing the system handles best.
It also explains why grounding matters more than raw capability. A more capable model that answers from its own training rather than from your material produces confident, fluent, unsupported answers — which is a worse outcome than a less capable one that retrieves correctly and declines when it cannot. Capability without grounding increases the cost of being wrong rather than reducing it.
The pieces are described separately here because that is how they are evaluated and configured. They are not experienced separately: a customer asking a question encounters one system, and judges it as one.
Where this sits in a conversation
- Something arrivesA typed message, a spoken sentence, an uploaded document. The first job is establishing what was actually received — which language, which script, whether it is legible, whether it is one question or several.
- It is interpretedWorking out what is being asked rather than what words were used. The same question arrives phrased twenty different ways, in two languages, often mixed, frequently misspelt, sometimes as a fragment.
- Material is retrievedThe relevant part of your own approved content is found. This is where answer quality is largely decided: a correct answer assembled from the wrong source is still wrong.
- A reply is composedIn the language of the question, in the configured tone, from the retrieved material and nothing else. Where the material is silent, the reply says so rather than filling the gap.
- It is checkedBefore sending, the reply is examined for claims the retrieved material does not support and for personal data that should not be repeated back. This runs on every reply.
- It is deliveredAs streamed text, as speech, or as a structured response — and the conversation is recorded so that what happened can be reviewed later.
Why this is built rather than bought in
Every capability described here could, in principle, be obtained by calling somebody else's service. That is how most assistants in this market are assembled, and it is why so many of them cannot answer the question that decides regulated procurements: where does the data go.
When a component is a call to an external provider, every question that passes through it leaves the organisation. That may be perfectly acceptable for a retailer answering questions about opening hours. It is usually not acceptable for a bank explaining a transaction, a hospital confirming an appointment, or a public body handling a citizen case — and the constraint is architectural, so it cannot be configured away later.
The second consequence is control over behaviour. A capability obtained as a service behaves the way the provider decides, changes when the provider changes it, and cannot be tuned for the specific way your customers speak or write. A capability that runs inside your own estate can be adjusted for dialect, for your terminology, and for the particular failure modes your material produces.
The third is continuity. External services are deprecated, repriced and withdrawn. A deployment whose core capability depends on somebody else's roadmap inherits that roadmap, including the parts nobody announced in advance.
Measuring this component honestly
| Measured in which language? | Nearly every published benchmark in this field was developed against English. An overall figure that averages across languages hides exactly the gap that matters in this market. |
|---|---|
| Measured on what input? | Clean or realistic. Read speech or spontaneous speech. Typed text or phone-typed text with autocorrect. The difference between these is usually larger than the difference between vendors. |
| Measured by whom? | Self-reported figures with an undescribed method are marketing. Ask for the test set and the procedure. |
| What counts as correct? | A surprising number of published figures count a partially correct answer as correct. Ask what the scoring rule was. |
| How does it fail? | A component that degrades gracefully is worth more than one with a higher headline figure that fails silently and confidently. |
| Does it report uncertainty? | A component that surfaces low confidence lets the system confirm rather than guess. One that hides it produces confident errors downstream. |
What to ask about this specifically
Ask for the Arabic figure
Not the overall figure. Nearly every published benchmark in this field was developed against English, and the gap between the two languages is where deployments disappoint.
Ask how it was measured
Against what test set, by whom, on what kind of input. A number without a described method is marketing rather than measurement.
Ask what it does when uncertain
Whether uncertainty is surfaced or hidden. A component that hides low confidence produces confident errors downstream.
Ask about real conditions
Noisy audio, poor scans, dialect, informal phrasing, mixed languages. Laboratory conditions are not predictive of contact-centre reality.
Ask where processing happens
For any component touching personal data, this is a procurement question rather than a technical curiosity in regulated sectors.
Ask what is retained
What data this component keeps, for how long, and whether it is used to improve anything.
Common questions
Identity numbers, card and phone numbers, addresses and names, in both languages and both numeral systems, with Saudi formats specifically rather than generically.
There is no capitalisation to signal a name, compound names are long, and address conventions differ. Redaction built around English cues misses a great deal here.
That is the position that matters. Redacting after storage is cleanup; redacting before is prevention.
No — recoverable masking is not redaction. If it can be reversed, the data is still held.
No, and that reasoning is worth resisting. Redaction reduces residual risk; retention limits do the structural work.
Some identification is contextual rather than patterned. Redaction is a layer that reduces exposure, not a control that eliminates it.