How to Prevent PII Leaks in ChatGPT API Calls

What PII Actually Flows Through ChatGPT API Calls?

The ChatGPT API receives whatever your application puts in the messages array. If your system prompt includes user context, if your RAG pipeline retrieves real documents, or if end users type freely into a chat interface — PII will end up in your prompts. Here are real-world examples (anonymized):

{
  "messages": [
    {
      "role": "system",
      "content": "You are a helpful support agent for Acme Insurance."
    },
    {
      "role": "user",
      "content": "Hi, my name is Maria Johnson. My policy number
       is AC-992481. My SSN is 421-83-7192 and my email is
       maria.johnson@email.com. I need to update my address
       to 1847 Oak Avenue, Austin, TX 78701. Also, please
       charge the new premium to my card 4532-8721-0039-4481."
    }
  ]
}

That single prompt contains seven distinct PII entity types: a person name, an SSN, an email address, a street address, a city/state, a ZIP code, and a credit card number. Multiply this by thousands of API calls per day and the exposure is significant.

Modern PII detection needs to cover far more than names and emails. Here are the 28+ entity types that can appear in ChatGPT API prompts:

• Government IDs: Social Security numbers, passport numbers, driver license numbers, national insurance numbers (UK NINO), ITINs
• Financial: Credit card numbers (with Luhn validation), IBAN codes, bank account numbers, crypto wallet addresses
• Contact info: Email addresses, phone numbers, street addresses, ZIP codes
• Personal: Full names, dates of birth, nationalities, religious/political affiliations (NRP)
• Developer secrets: API keys (OpenAI sk-*, GitHub ghp_*), AWS access keys (AKIA*), AWS secret keys, private keys, webhook URLs
• Medical: Medical license numbers, NHS numbers, patient IDs, diagnostic codes
• Network: IP addresses, MAC addresses, URLs containing tokens or session IDs

The 3 Approaches to Preventing PII Leaks

There are three main strategies for keeping PII out of your ChatGPT API calls. Each has distinct trade-offs in coverage, scalability, and implementation effort.

Approach 1: Manual Review

The simplest approach: have humans review prompts before they're sent to the API. This works for small-scale, low-volume use cases — perhaps a team of five using an internal tool. But it doesn't scale. At 1,000+ API calls per day, manual review becomes a bottleneck. And humans miss things — especially structured data like API keys and IBAN codes that don't look like “personal data” at a glance.

Approach 2: Regex & Pattern Matching

Write regular expressions to detect structured PII: credit card numbers, SSNs, email addresses, phone numbers, API keys. This approach is fast (sub-millisecond per pattern) and catches data with predictable formats. The problem is coverage — regex cannot detect unstructured PII like person names (“Maria Johnson”), street addresses (“1847 Oak Avenue”), or medical terms. You end up with a false sense of security: the scan “passes” but sensitive data still flows through.

Approach 3: AI-Powered Gateway-Level DLP

The most comprehensive approach: route all API traffic through an AI Firewall that combines pattern matching, context heuristics, and a purpose-built NLP engine to detect both structured and unstructured PII. The gateway sits between your application and the LLM provider, scanning every prompt in real time. Detected entities are either redacted (replaced with placeholders) or the request is blocked entirely — before anything reaches OpenAI.

How Gateway-Level PII Redaction Works

The architecture is straightforward: your application sends requests to the AI Firewall instead of directly to OpenAI. The firewall scans every prompt through a multi-layer detection pipeline, applies your redaction policy, and forwards the cleaned request to the LLM provider. The provider never sees the raw PII.

The entire scan happens synchronously in the request path — no async queues, no after-the-fact auditing. Every prompt is scanned before it leaves your infrastructure. Here's what a prompt looks like before and after the firewall:

{
  "messages": [{
    "role": "user",
    "content": "Draft a response to Maria Johnson (SSN: 421-83-7192,
     email: maria.johnson@email.com). She lives at 1847 Oak Avenue,
     Austin, TX 78701. Her card on file is 4532-8721-0039-4481."
  }]
}

{
  "messages": [{
    "role": "user",
    "content": "Draft a response to [PERSON_REDACTED] (SSN: [SSN_REDACTED],
     email: [EMAIL_REDACTED]). She lives at [ADDRESS_REDACTED].
     Her card on file is [CREDIT_CARD_REDACTED]."
  }]
}

// Response headers include:
// x-dlp-latency: 32
// x-entities-detected: PERSON,US_SSN,EMAIL_ADDRESS,STREET_ADDRESS,CREDIT_CARD

The best part: the only change in your application code is swapping the base_url. Everything else — your models, your prompts, your response parsing — stays exactly the same.

from openai import OpenAI

# Before: direct to OpenAI
# client = OpenAI(api_key="sk-...")

# After: route through AI Firewall
client = OpenAI(
    base_url="https://api.opensourceaihub.ai/v1",
    api_key="your-hub-api-key"
)

# Everything else stays exactly the same
response = client.chat.completions.create(
    model="gpt-4.1",
    messages=[{"role": "user", "content": prompt}]
)

Implementation: Auto-Redact PII in Under 5 Minutes

OpenSourceAIHub implements the gateway DLP architecture described above as a managed service. Here's how to set it up — from zero to protected in four steps.

from openai import OpenAI

client = OpenAI(
    base_url="https://api.opensourceaihub.ai/v1",
    api_key="your-hub-api-key"   # from Step 1
)

response = client.chat.completions.create(
    model="gpt-4.1",
    messages=[
        {"role": "system", "content": "You are a helpful assistant."},
        {"role": "user", "content": user_message}
    ]
)
print(response.choices[0].message.content)

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api.opensourceaihub.ai/v1",
  apiKey: "your-hub-api-key",   // from Step 1
});

const response = await client.chat.completions.create({
  model: "gpt-4.1",
  messages: [
    { role: "system", content: "You are a helpful assistant." },
    { role: "user", content: userMessage },
  ],
});
console.log(response.choices[0].message.content);

What Gets Detected: 28+ Entity Types by Category

The AI Firewall's detection engine covers six categories of sensitive data. Each entity type uses the most appropriate detection method — pattern matching with checksum validation for structured data, and the purpose-built NLP engine for unstructured entities.

Frequently Asked Questions

Related Articles