Reversible PII tokenization replaces sensitive values in a prompt with consistent placeholders — "Sarah Thompson" becomes <PERSON_7K9X> — before the text reaches an AI model, then restores the real values in the response after it returns. Unlike permanent redaction, the answer comes back readable; unlike blocking, the work continues. The mapping between placeholder and real value lives in an encrypted vault (AES-256-GCM) with a short time-to-live — 15 minutes by default — so the restore window closes automatically. The AI provider only ever sees placeholders.
How the round trip works
On the way out, a detection engine finds identifiers in the prompt — names, emails, phone numbers, UK-specific values like NI and NHS numbers — and swaps each for a typed placeholder. The mapping is written to an encrypted vault. The masked prompt goes to the model.
On the way back, the response usually mentions the placeholders ("advise <PERSON_7K9X> to accept the offer…"). The gateway streams the response through an unmasker that swaps placeholders back to real values — inside your environment, never at the provider. The vault entry then expires on its TTL, closing the restore window.
This round trip is the part most detection engines cannot do. Microsoft’s open-source Presidio, for example, notes in its own documentation that it cannot restore values once an LLM rephrases the output — the productised vault-and-unmask path is exactly the gap.
When you want it — and when you don’t
Reversible tokenization fits workflows where a human needs the real answer: drafting a letter about a specific client, summarising a matter, triaging a complaint. Irreversible masking (no vault entry, no restore) fits analytics, logging, and anything where nobody downstream needs the identity. A policy layer decides which entities get which treatment per tenant.
The short version
- Placeholders out, real values back in — the model never sees the identifiers.
- Vault entries are AES-256-GCM encrypted with a 15-minute default TTL.
- Restoration happens in your environment, not at the AI provider.
- Choose reversible or irreversible per entity type via policy.
Related questions
What happens if the vault entry expires before the response returns?
The response is delivered with placeholders intact — safe by default. TTL is configurable per tenant for long-running workflows; the default is deliberately short so the restore window is minutes, not days.
Is tokenization the same as anonymisation?
No. Tokenized data is pseudonymised — the mapping exists (briefly, encrypted) so values can be restored. True anonymisation is irreversible. That distinction matters under UK GDPR: pseudonymised data is still personal data, which is why the vault is encrypted, short-lived, and access-controlled.
Does consistent placeholder naming leak information?
Placeholders are consistent within a session so the model can reason coherently (<PERSON_7K9X> stays the same person), but the identifiers are random per session — there is no stable cross-session mapping an observer could accumulate.
This page is general information, not legal advice. Where third-party guidance or law is summarised, read the originals via the source links before relying on them. Last reviewed: 17 July 2026.
This is the control in action
Identifiable data is masked in the browser before the prompt ever leaves — try it yourself with a sample prompt, or bring one low-risk workflow to a 20-minute review.
Advise Sarah Thompson, NI AB123456C, on the settlement offer.
Advise <PERSON_7K9X>, NI <NI_8W1R>, on the settlement offer.