Skip to content
AgentIDDocs

Type at least two characters to search titles, headings and content.

↑ ↓ to navigate↵ to open
AgentID Docs

Data protection

Masking with typed placeholders

How AgentID replaces sensitive values with typed placeholders, keeps them consistent, and what your model receives.

When masking is on, every detected value is replaced with a placeholder of the form <TYPE_n>:

  • TYPE is the entity type in capitals, for example PERSON_NAME, EMAIL, IBAN, PASSWORD or SECRET (see the entity types),
  • n counts the distinct values of that type, starting at 1.
Original:
  Jan Novák (jan.novak@example.com, +420 777 123 456) asked Petra Malá
  to pay invoice 2026-118 to CZ65 0800 0000 1920 0014 5399.

Sent to the AI provider:
  <PERSON_NAME_1> (<EMAIL_1>, <PHONE_1>) asked <PERSON_NAME_2>
  to pay invoice 2026-118 to <IBAN_1>.

Consistency

  • The same value gets the same placeholder everywhere in the request, including attachments.
  • Different forms of the same person, such as "Jan Novák", "Novák" and the inflected "Janu Novákovi", map to the same <PERSON_NAME_n>.
  • With restoration enabled, the browser extension and the Claude integrations keep placeholders stable across the whole conversation, so a value from an earlier message keeps its placeholder.

This lets the model reason about the text ("<PERSON_NAME_1> asked <PERSON_NAME_2>") without seeing who is involved.

Typed placeholders only

AgentID sends typed placeholders only. It does not replace values with realistic fake names, numbers or addresses. Typed placeholders can always be found and restored exactly, while realistic substitutes get reformatted by models and can end up in derived values (ages, sums, weekdays) that cannot be restored.

The Guard API reports this as client_substitute_style: "tokens".

Prompting with placeholders

Models handle placeholders well. If a model rewrites them, for example PERSON_NAME_1 without angle brackets, restoration of that occurrence can fail. Two tips:

  • Ask the model to keep placeholders unchanged when you write system prompts for your own application.
  • Do not ask the model to compute from masked values (ages from <DATE_OF_BIRTH_1>, totals from <BANK_ACCOUNT_1>); it cannot see them.

What is never sent

With masking on, the AI provider receives only the protected text. The original values stay:

  • on the user's device or in your application, if restoration is on,
  • encrypted in AgentID, only if Store Encrypted Payloads is on (for audited Reveal).

See What is logged.

SDK local masking

The Node.js and Python SDKs can also mask locally before calling Guard. Local masking uses the same <TYPE_n> format with its own, smaller set of types, for example <PERSON_1>, <EMAIL_1>, <PHONE_1>, <IBAN_1>, <CREDIT_CARD_1>, <PASSWORD_1> and <SECRET_1>.