Where screening sits in a message’s journey
The message and all attached documents are masked as one piece of text, so one value gets one placeholder wherever it appears, and a critical value inside a document holds the message exactly as one typed in the composer would. Earlier turns of the conversation are sent to the model in their masked form, and re-screened by the pattern layers on every send as a safety net. The real values masked on turn one are never sent on turn two.The four layers
No single technique works on its own. Structured identifiers follow rules a program can verify; names and addresses do not.Layer 1: a vetted subset of an open-source library
The first layer uses@openredaction/core (MIT licensed), restricted to 54 named patterns that are structurally verifiable. Its own name, address and date detection is switched off. When tested with its defaults, it flagged “My card is” and “Ship to” as people’s names, read “Mountain View CA” as a person, consumed part of an IP address as a date, and let a live-format API key through.
The 54 patterns:
Layer 2: CorePillar’s own patterns
These cover formats the library misses or gets wrong. They match against the original text with Unicode-aware character classes (dashes pasted from Word and Slack, non-breaking and zero-width spaces, full-width digits), so offsets never drift.Layer 3: deterministic name detection
Names are found without any AI call by combining:- Name lists of given names and surnames spanning English, Spanish and Portuguese, South Asian, East and Southeast Asian, Arabic, Persian, Turkish, African and European naming, matched with accents stripped so “José”, “JOSE” and “jose” all match.
- Shape rules for runs of capitalised words, initials (“J. Smith”), particles (“María de la Cruz”, “al-Rashid”) and lower-case names next to a listed surname.
- Cues that say a name follows: “my name is”, “Dear”, “Sincerely,”, “cc:”, “To:”, “From:”, “Attendees:”, honorifics such as “Dr.”, “Mrs”, “Sr.”, “Shri”, relationship words (“my manager”, “my wife”), verbs (“ask”, “email”, “met with”), and sign-off lines such as ”— Priya”.
- Common-word filtering so that products, languages, months and ordinary verbs (“Apple”, “Ruby”, “May”, “Will you merge it”, “Mark the ticket”, “Ask Claude”) are not masked.
Layer 4: a small model reading for meaning
Some identifiers only meaning can reveal. A small model reads the message and returns the exact substrings it believes are identifiers.
The composer’s live scan while you type uses layers 1 to 3 only, so it is fast and free. Layer 4 runs once, at send time.
Combining findings
All findings from all layers are unioned before the text is rewritten. Where two findings overlap, they merge into one span covering both, which takes the most severe type of the two. (Keeping only one of two overlapping findings would leak whatever tail the dropped one covered.) Each finding records how it was found:pattern, validated-pattern (a checksum or rule confirmed it, such as Luhn for cards, mod-97 for IBANs, SSN allocation rules) or model.
Text that is already a placeholder is never re-detected, so re-screening masked history is harmless.
Severity
What critical means
A critical finding does two things:- The message is held once. The person sees what was found and confirms with Send masked. The model receives the masked version either way. The pause makes pasting a production key a deliberate act.
- The value never comes back to the screen. Non-critical values are restored on the sender’s screen and shown on hover. Critical values stay as placeholders in the sender’s own bubble, in the answer and in every later turn.
Placeholders
Each placeholder is[ + type stem + _ + four digits + ], for example [EMAIL_4821], [PERSON_NAME_0042], [ANTHROPIC_KEY_2228]. Stems are the type name, except ANTHROPIC_KEY, DOB, IP and ADDRESS.
The four digits are a hash of the type and the normalised value, so the same value gets the same placeholder on every turn and the model can tell two people apart. If two different values hash to the same number in one message, the second moves to the next free number.
The model is instructed that placeholders stand for real details removed for privacy, to treat each as a consistent identifier, to reuse it verbatim, and never to guess what it stands for.
Restoring values on screen
The server holds no conversation state. After each answer, the browser receives the map of placeholders to values for that turn, minus critical values, keeps it for the conversation, and sends it back with the next message. As the answer streams, placeholders are swapped for the real values. A placeholder split across two chunks ([PERSON_ then NAME_0042]) is held back until it is complete. The map is capped at 400 entries; past that the oldest placeholders stop resolving and show as placeholders. The map is never sent to a model and never stored.
What is stored
Chat turns are stored in the organization’s audit log, one record per turn.
How critical values are reduced:
Writing live credentials into the log in the clear would make the record of a leak a second copy of it, read by more people than the original chat.
Who sees what:
- The employee’s own AI Usage page shows counts by type and severity, never values.
- The organization-wide view on the AI Usage page (Owners, Admins and super admins, on either hub) shows an itemised log with the stored values. See AI Usage.
- When end-to-end encryption is on, the message, answer, title and stored values of each new turn are encrypted to the author and the organization’s super admins. The log then shows ”🔒 Encrypted” for those values. If encryption fails at write time, only the metrics are stored and the text is dropped.
Accuracy: what has been measured
Read this section literally. What is tested. A regression suite runs the pattern layers (1 to 3) and document extraction against hand-written cases. At the time of writing it contains:
All of them pass. The suite also checks that a 50,000-character CSV is fully masked quickly, that a pathological 32,000-character input does not hang the scan, and that unreadable files are rejected.
The “must not be touched” cases matter as much as the detections. Over-masking is what makes people stop using the tool.
What this is not. These are cases CorePillar wrote. They prove the detectors still do what they were built to do. They are not a benchmark and do not establish a recall rate on real-world data. The detectors have not been run against an independent labelled PII corpus, so no accuracy percentage should be quoted for them. Layer 4 (the model) is not covered by the suite.
Known limits:
- Names and addresses have no guaranteed recall. Lists, cues and a small model all miss some.
- Structured identifiers are high-confidence but not exhaustive. A format with no pattern is not detected.
- Free-form confidential text is not detected. Unreleased financials, strategy or deal names are not personal identifiers. This is not a general confidentiality filter.
- Layer 4 can fail open. If it times out or the platform key is unavailable, the message is sent with pattern-layer masking only.
- Layer 4 reads the first 8,000 characters of the combined message and documents. Pattern layers read everything.