Skip to main content
AI models are run by other companies. Anything you send to one leaves your company’s control. ModelHub screens every message, and every attached document, before it goes out. Each piece of personal or secret data it finds is replaced with a placeholder. The model sees [EMAIL_4821]. You see the real address on your screen. The model provider never receives it. Screening is always on. There is no switch to disable it.

​
What it looks for

The complete list, with how each is detected, is in How privacy screening works.

​
What it deliberately leaves alone

ModelHub is used by engineers, so screening avoids blanking out things you need the model to see:
  • private and loopback IP addresses such as 10.0.0.42 or 127.0.0.1,
  • version numbers such as 16.0.4,
  • usernames and social handles,
  • product, technology and well-known company names,
  • numbers that look like a card or SSN but fail the checksum or the allocation rules (for example an order number).

​
What you see

While typing. A fast pattern scan runs on your draft. When it finds something, the N masked badge appears in the composer. Hover it to see each finding’s type and severity under Found in this draft. This scan does not use the AI layer, so names it finds only from context are picked up at send time. After sending. Your message bubble shows each masked value as a dashed teal chip, for example [PERSON_NAME_0042]. Hover a chip:
  • “Hidden from the model: the original value” for ordinary findings,
  • “Removed before the model saw it” for critical findings, which are never shown again, even to you.
In the answer. The model refers to your data by its placeholder. ModelHub swaps the real values back in on your screen as the answer streams. Critical values stay as placeholders. In the report card. Details → Privacy lists how many items were masked at each severity.

​
Severity, and the one time it asks you

Every finding has a severity: When something critical is found, the message is held once:
  1. A red strip above the composer reads “A critical identifier was found — it will be replaced before the model sees it.” (or “…found in an attached file…”).
  2. The Send button changes to Send masked.
  3. Clicking Send masked sends the message. The model still receives only the masked version.
The pause exists so that pasting a production key is a deliberate act, not an accident. If you did not mean to include it, edit your draft before sending. If the server finds a critical item that the live check had not confirmed, the answer area shows “A credential or government identifier was found in this message. It will be replaced with a placeholder before the model sees it — send again to continue.” Send the message again and it goes out masked.
If the pattern scanner itself fails, ModelHub treats the message as held rather than reporting “nothing found”.

​
Placeholders

A placeholder is the data type plus four digits, in square brackets: [EMAIL_4821], [PHONE_0193], [SSN_7731], [ADDRESS_2210], [DOB_0457]. The digits are derived from the value, so the same value gets the same placeholder throughout a conversation. The model can tell one person from two without knowing who either is. The model is told that placeholders stand for real details removed for privacy, to reuse them verbatim, and never to guess what they stand for.

​
What is stored and who sees it

  • You see counts by severity and type on your AI Usage page, never the values.
  • Organization owners, admins and super admins see an itemised log on the organization-wide usage dashboard, including the stored values. See AI Usage.
  • If end-to-end encryption is on, the message text and stored values for new turns are encrypted to you and your organization’s super admins.

​
Known limits

  • Names and addresses are not guaranteed. Some are found by an AI reading for meaning, which is a judgement, not a rule. It will miss some.
  • The AI layer can fail open. If it is slow (it gives up after 6 seconds) or unavailable, the pattern layers still run and the message still sends. Names that only the AI would have spotted may go unmasked in that case.
  • Unknown formats are not detected. A structured identifier with no pattern on the list is not caught.
  • Confidential business content is not detected. Unreleased numbers, strategy or deal names are not personal identifiers, and nothing here catches them. Treat ModelHub as reducing the risk of leaking identities and credentials, not as a general confidentiality filter.
  • Only the first 8,000 characters of a message (including documents) are read by the AI layer. The pattern layers read everything.