Back to slim.io

Detection · Transforming sensitive data

How slim.io transforms
sensitive data

Three parts of slim.io change sensitive values, each with its own actions: AI gateway rules, the tokens API and warehouse masking. Apart from the AI gateway redacting secrets, nothing is transformed until you configure it.

Overview

Every action at a glance

These are the action names you use in rules and API calls. The right choice depends on who sees the output and whether the original ever needs to come back.

Action Where Output example Reversible
allow coach AI gateway; coach is the default for PII 078-05-1120 unchanged Not transformed
redact AI gateway; the default for secrets *********** No
mask AI gateway [SSN] No
tokenize_fpe AI gateway 904-37-5120 In model replies, when response detokenization is enabled
tokenize_deterministic AI gateway slim_AgEBAQdz9mQ4xKv7… No
block AI gateway Request refused (HTTP 422) Not sent
deterministic randomized format_preserving Tokens API slim_AgEBAQdz9mQ4xKv7… Only with opt-in cleartext storage
redact_full mask_last_4 nullify tokenize_deterministic tokenize_randomized Warehouse masking A masked column for the roles you choose Stored data is not changed

Actions

Each action in detail

AI gateway rules match on a finding’s category, type, risk or confidence, and the first matching rule decides the action, so one policy can mask email addresses, tokenize phone numbers and block passport numbers.

Redact and mask redact mask

Two AI gateway actions that remove a value from a request before it reaches the model. Redact overwrites every character of the detected span with an asterisk. Mask replaces the span with a type label: [SSN], [SIN], [PHONE] and [EMAIL] for those types, [PASSPORT] for US passports, and the detector’s own name, such as [CREDIT_CARD_VISA], for everything else. Secrets are redacted by default; anything else is redacted or masked only when a rule says so.

Input078-05-1120
↓
redact***********
Input078-05-1120
↓
mask[SSN]
Use when The model does not need the value itself: prompts, retrieved context and tool calls where knowing the type is enough.
Reversible No. The inline path keeps nothing it could restore from.
Format-preserve tokenize_fpe format_preserving

Replaces the detected value with a different value in the same format, using NIST FF1 format-preserving encryption under a per-tenant key. The digits are encrypted in place, so separators stay where they were: an SSN keeps its NNN-NN-NNNN layout and its last three digits. On the slim.io AI gateway (tokenize_fpe), format-preserved values that come back in a model response can be restored to the original when response detokenization is enabled for the tenant and requested on the call. Outside that, recovering the original requires the opt-in cleartext storage described under Vault tokens, or a governed warehouse reveal where that feature has been enabled.

Input078-05-1120
↓
Output904-37-5120
Use when Downstream systems validate or display data in a specific format (test environments, format-sensitive pipelines, forms that check an SSN or phone layout) and cannot accept masked or tokenized values.
Entity types US Social Security numbers, Canadian SINs, phone numbers and US passport numbers; the tokens API also format-preserves monetary amounts. These are the only types that can be format-preserved; SSNs also need an explicit acknowledgment, because the encrypted part is a small domain. On the AI gateway, tokenize_fpe on any other type falls back to a deterministic token.
Deterministic tokens tokenize_deterministic deterministic

Replaces the value with a slim_ token that is the same every time the same value appears, so records can still be joined and counted. On the AI gateway (tokenize_deterministic) the token is one-way: nothing is stored, and the token cannot be turned back into the original. In the tokens API (deterministic mode), tokens are tenant-wide by default and can be scoped to a connector, a resource or a field.

Inputjane@acme.co
↓
Tokenslim_AgEBAQdz9mQ4xKv7…
Use when You need to track duplicates or correlate the same person across records without exposing the value.
Reversible Gateway tokens: no. Tokens API tokens: only with opt-in cleartext storage.
Vault tokens tokens API

The tokens API issues integrity-protected slim_ tokens in deterministic, randomized or format_preserving mode. Unless your tokenization policy sets a rule for a type, its sensitivity class picks the mode: SSNs, SINs, passport and health card numbers are tokenized in randomized mode, email addresses, phone numbers and dates in deterministic mode, and types outside every class, such as card numbers, are left as they are. For field tokens, slim.io’s vault keeps a record of the token, not the original value, so by default a field token cannot be turned back into the original. Recovery is opt-in: the tenant enables cleartext storage, which keeps an encrypted copy protected by a Google Cloud KMS key, and each value must be tokenized with cleartext storage requested.

Input078-05-1120
↓
Tokenslim_AgEBAQdz9mQ4xKv7…
↓
Detoken078-05-1120 (opt-in cleartext storage only)
Use when Downstream systems must work with pseudonymous data. If authorized workflows (billing, clinical, identity resolution) also need the original value back, enable cleartext storage before those values are tokenized.
Recovery Opt-in only. The detokenization API returns the original only for values tokenized with cleartext storage enabled, to a caller that holds both elevated and cleartext detokenization permissions and a grant for those tokens. Otherwise the caller receives a type placeholder such as [detokenized:us_ssn] or a permission refusal, never the original.
Resources Tokenizing a whole resource works differently: its detokenize-resource endpoint returns the original content to a caller with the elevated detokenization permission.
Block, allow and coach block allow coach

Block refuses the whole request with HTTP 422 before anything is sent to the model. Allow and coach both send the request on unchanged; coach is what a PII finding gets when no rule matches it.

InputPassport No. 963545637
↓
blockrefused (HTTP 422)
Use when Some data must never reach a model at all, such as passport numbers in an agent’s tool call.
Default PII findings are coached and secrets are redacted until you add rules.
Warehouse masking redact_full mask_last_4 nullify

Masking policies for warehouse columns, applied through generated database views so the stored data is not changed. Each masked column uses redact_full, mask_last_4, nullify, tokenize_deterministic or tokenize_randomized, and the roles you choose see the masked form.

Use when Analysts and applications query a warehouse directly and should see only part of a value, or none of it.
Reversible Nothing to reverse: the underlying table keeps the original, and access to it is what the policy controls.

Decision guide

Choosing an action

Work through these questions in order. The first “yes” is a reasonable starting point.

Must the request not reach the model at all?
Yes →
Use block
Should the model’s reply bring the original value back?
Yes →
Use tokenize_fpe with response detokenization
Does the model only need to know what type of value was there?
Yes →
Use mask or redact
Do you need to match the same value across records?
Yes →
Use a deterministic token
Must an authorized service recover the original later?
Yes →
Use a vault token with cleartext storage enabled
Do warehouse users only need the last four characters?
Yes →
Use mask_last_4

By entity type

Suggested strategies by entity type

These are suggestions, not defaults. Out of the box, the AI gateway flags findings and redacts secrets, the baseline data-loss policy alerts and logs, and nothing else is transformed until you configure it.

Entity Suggested Why
SSN tokenize_fpe · randomized A same-format value keeps prompts readable; a vault token needs cleartext storage if the original must come back
SIN tokenize_fpe · randomized As for SSNs
Credit Card mask · mask_last_4 Prompts rarely need the number; warehouse users can match on the last four digits
Email mask · deterministic The label tells the model an address was there; a deterministic token lets you join records
Phone tokenize_fpe · deterministic Keeps the number’s layout for systems that check it
MRN mask The tokens API does not tokenize MRNs unless your tokenization policy names the type
Person Name mask Language models seldom need real names in prompt context
IP Address redact Rarely needs recovery