Our PII Detection API detects, classifies, and locates personal data in any text — returning structured entities with entity types, character offsets, and confidence scores. Need redaction too? Flip on mask_mode and get a masked copy in the same response. Built for GDPR, HIPAA, CCPA, and PCI DSS workflows.
By Alpha Quantum — the team behind the 120M-domain Web Filtering Database.
From names and emails to IBANs, national IDs, medical record numbers, crypto wallets and session tokens — one call covers them all.
Non-English PII is where pattern tools fail. Names, addresses and IDs are caught in German, Polish, Chinese, Arabic and 60+ more.
Catches what regex can’t: obfuscated emails (“john dot smith at…”), spelled-out phone numbers, org-vs-person ambiguity.
Compliance forbids sending data out? Deploy the detection engine inside your own network — nothing ever leaves your infrastructure.
Full PHI coverage — MRNs, health plan IDs, treatment details — for healthcare, insurance and legal workflows under HIPAA.
Entities with offsets and confidence plus a masked copy in the same JSON response — replace, mask, redact or hash.
These rows are from our adversarial test set — the cases where regex-based and legacy NER tools silently fail. Paste any of them into the live demo and watch them get caught.
| input text | detected as | why it’s hard |
|---|---|---|
| write to john dot smith at acme dot com | obfuscated — no @ sign for regex to find | |
| +1 (2 1 2) 5 5 5 - 0 1 8 2 | PHONE | spaced out to evade filters |
| Herr Müller, Goethestraße 14, 80336 München | PERSON + ADDRESS | non-English name and address format |
| MRN 88-4417-C, prior admission under Dr. Osei | MEDICAL_RECORD + PERSON | free-text clinical note, no fixed format |
| A Morgan Stanley adviser phoned Morgan Freeman | PERSON (not the bank) | same word — organization vs. person |
| born on the fourth of July, nineteen eighty-two | DATE_OF_BIRTH | fully spelled out, zero digits |
Every entity is returned with character offsets and a confidence score, so you can highlight, mask, or route each hit programmatically. That level of nuance is the product.
One POST request returns the entity list and the anonymized text together — no second round-trip, no separate redaction service.
Upload documents in the client portal, run batch detection jobs, and download results — the same engine behind the API.
Submitted text is processed in memory and never used for training. A fully self-hosted deployment is available for regulated environments.
Over 300 organisations globally rely on our AI-powered PII detection services to find and classify sensitive data — among them
One detection API for PII, PHI, payment card data, and credentials — in free text, documents, chat transcripts, logs, and OCR output.
From PERSON_NAME, EMAIL_ADDRESS, and SSN to MEDICAL_RECORD_NUMBER, CREDIT_CARD_NUMBER, IBAN_CODE, and AWS_CREDENTIALS — every match is labeled with a precise entity type you can route, report on, or block.
Browse all entity typesEvery detected entity comes with exact character start/end offsets and a calibrated confidence score. Tune the threshold parameter to trade precision for recall, and highlight, tag, or transform matches in place.
See the response schemaDetection first, redaction on demand. Set mask_mode to replace for [TYPE] placeholders, redact to remove matches, or hash for consistent pseudonyms — and receive a masked copy alongside the detections.
What is PII detection?A single request to our API runs the full pipeline: detect candidate entities, classify them into 150+ types, locate them with character-level offsets, and score each match with a confidence value — with optional masking as the final step.
You stay in control: scope detection with the entities and exclude_entities lists, set a confidence threshold, and add natural-language exclusions with custom_instruction — for example, "do not flag employee names of our own staff".
Get Started in MinutesOur API is powered by transformer-based Named Entity Recognition (NER) models that understand context — so you get far fewer false positives and missed entities than pattern-matching tools.
The AI can tell "Dr. Smith" (a person) apart from "a blacksmith" (a profession), and "Paris, France" (a location) from "Paris Hilton" (a person). It catches unformatted identifiers regex can't, like an SSN written as "social is 478 92 6541". See our comparison of NER vs regex vs rules for the details.
NER vs Regex ComparedCatch personal data the instant it appears. Our stateless, low-latency architecture is built to sit inline: screen prompts before they reach an LLM, scrub model outputs before they reach users, and filter chat messages as they stream.
Ideal for: LLM guardrails, real-time chatbot filtering, live support conversations, and streaming data pipelines that must stay PII-free.
PII Guardrails for LLMsSend text to POST /api/moderate.php with api_type: "pii_detection" and get back every entity with its type, exact position, and confidence score — plus an optional masked version. Full reference in the API documentation.
curl -X POST https://piidetectionapi.com/api/moderate.php \
-H "Content-Type: application/json" \
-d '{
"api_key": "YOUR_API_KEY",
"api_type": "pii_detection",
"text": "Contact John Doe at [email protected] or 555-123-4567.",
"entities": ["PERSON_NAME", "EMAIL_ADDRESS", "PHONE_NUMBER"],
"mask_mode": "replace",
"threshold": 0.5
}'
import requests
resp = requests.post(
"https://piidetectionapi.com/api/moderate.php",
json={
"api_key": "YOUR_API_KEY",
"api_type": "pii_detection",
"text": "Contact John Doe at [email protected] or 555-123-4567.",
"entities": ["PERSON_NAME", "EMAIL_ADDRESS", "PHONE_NUMBER"],
"mask_mode": "replace",
},
timeout=30,
)
data = resp.json()
for e in data["detected_entities"]:
print(e["type"], e["text"], e["start"], e["end"], e["confidence"])
const resp = await fetch("https://piidetectionapi.com/api/moderate.php", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
api_key: "YOUR_API_KEY",
api_type: "pii_detection",
text: "Contact John Doe at [email protected] or 555-123-4567.",
entities: ["PERSON_NAME", "EMAIL_ADDRESS", "PHONE_NUMBER"],
mask_mode: "replace",
}),
});
const data = await resp.json();
data.detected_entities.forEach((e) =>
console.log(e.type, e.text, e.start, e.end, e.confidence)
);
{
"detected_entities": [
{"type": "PERSON_NAME", "text": "John Doe", "start": 8, "end": 16, "confidence": 0.95},
{"type": "EMAIL_ADDRESS", "text": "[email protected]", "start": 20, "end": 36, "confidence": 0.98},
{"type": "PHONE_NUMBER", "text": "555-123-4567", "start": 40, "end": 52, "confidence": 0.97}
],
"anonymized_text": "Contact [NAME] at [EMAIL] or [PHONE].",
"entities_detected": 3,
"processing_time_ms": 187,
"mask_mode_used": "replace",
"status": 200
}
From healthcare to finance, teams use our API to discover sensitive data, enforce privacy policies, and prove compliance.
Detect PHI across clinical notes, discharge summaries, and transcripts — covering all 18 HIPAA identifiers before data is shared or analyzed.
Healthcare PHI detectionDiscover cardholder data, account numbers, and IBANs in documents and support channels to keep PCI DSS scope under control.
PII detection for bankingScreen prompts, completions, and retrieved documents for personal data before it reaches models, vector stores, or end users.
PII protection in RAGScan log streams for emails, tokens, credentials, and IP addresses so sensitive data never lands in your observability stack.
Log file PII scanningFlag PII in tickets, chats, and call transcripts in real time — before it spreads into CRMs, analytics tools, and training data.
Call center PII detectionLocate personal data across matter files and productions with exact offsets, so review teams can redact precisely and defensibly.
PII detection for legalAutomated PII detection is the first step of every privacy program: you can't protect, delete, or report on personal data you haven't found.
Regulations like GDPR, HIPAA, CCPA/CPRA, and PCI DSS all start from the same question: where does personal data live? Our API answers it automatically — classifying every match by entity type so you can map findings to GDPR personal data categories, HIPAA's 18 PHI identifiers, or PCI's cardholder data definitions.
Every response is a ready-made audit record: what was detected, where it was located, and how confident the model was. Use it to power data subject access requests, breach-scope assessments, data mapping, and evidence for regulators — without armies of manual reviewers.
GDPR PII Detection GuideIntegrate in minutes: one JSON request to /api/moderate.php, one structured response. No models to host, no rules to maintain.
POST up to 50,000 characters per request with your API key and api_type "pii_detection". Optionally scope the scan with entities, exclude_entities, and threshold.
Transformer NER models scan the content in 60+ languages, identifying 150+ types of PII, PHI, PCI data, and secrets with contextual awareness that minimizes false positives.
Receive every detection as {type, text, start, end, confidence} — ready to highlight in a UI, feed to a DLP policy, block a request, or log for audit.
Set mask_mode to replace, redact, or hash and the same response includes a masked copy of your text — detection and remediation in a single round trip.
From universal PII like names and emails to industry-specific identifiers like medical record numbers, IBANs, and cloud credentials — every category of sensitive data is covered.
Personal identifiers: PERSON_NAME, EMAIL_ADDRESS, PHONE_NUMBER, ADDRESS, DATE_OF_BIRTH, SSN, NATIONAL_ID, PASSPORT_NUMBER, DRIVERS_LICENSE_NUMBER, IP_ADDRESS, DEVICE_ID, and GPS_COORDINATES. See our guides on detecting Social Security numbers and detecting email addresses.
Financial & PCI data: CREDIT_CARD_NUMBER, CVV_NUMBER, FINANCIAL_ACCOUNT_NUMBER, IBAN_CODE, SWIFT_BIC, ROUTING_NUMBER, and TAX_ID — the identifiers covered in credit card detection.
Health & credentials: MEDICAL_RECORD_NUMBER, HEALTH_INSURANCE_ID, DIAGNOSIS, PRESCRIPTION, plus secrets like API_KEY, PASSWORD, AWS_CREDENTIALS, SSH_KEY, and DATABASE_CONNECTION_STRING.
View All Entity TypesBuilt by developers, for developers. A single RESTful endpoint, predictable JSON in and out, clear error codes, and copy-paste examples in Python, JavaScript, PHP, Java, and Go. Most teams ship their first integration in under an hour with the getting started guide.
Flexible deployment: use our cloud API for instant scalability, or deploy on-premise when data can't leave your infrastructure. Synchronous calls for real-time guardrails, batch processing for large corpora.
Enterprise features: API key management, usage analytics, per-entity configuration, custom instructions, GDPR-native controls, and dedicated support with custom SLAs on enterprise plans — see pricing.
API DocumentationPractical, engineering-focused guides on detecting specific identifiers, meeting regulations, and wiring PII detection into your stack.
The complete guide: definitions, detection techniques, entity taxonomies, accuracy metrics, and how detection fits into privacy engineering.
Read the guideWhy Social Security numbers slip past regex, how contextual AI catches formatted and unformatted SSNs, and how to validate results.
Detect SSNsMap the 18 HIPAA identifiers to entity types and build Safe Harbor de-identification workflows on top of detection output.
HIPAA guideAdd a PII detection layer around your LLM apps: screen prompts, filter completions, and keep personal data out of context windows.
Guardrails guideUse detection results as the decision engine for data loss prevention: classify, alert, quarantine, or mask before data leaves your perimeter.
DLP guideDetect emails in free text, obfuscated forms, and multilingual content — with offsets and confidence scores ready for masking.
Detect emailsPaste text into the live demo and watch entities light up with types, offsets, and confidence scores — or create a free API key and integrate today. No credit card required.