Privacy Shield & PII Redaction

The Privacy Shield is a pre-processing security tool in Brainstorm Reactor. It detects and sanitizes Personally Identifiable Information (PII) — including individual names, bank details (IBANs), physical addresses, corporate entities, phone numbers, and emails — replacing them with opaque XML tokens (<PER_1>, <IBAN_1>, <ADDR_1>) before sensitive data ever leaves your browser or enters an agentic reasoning loop.

Why Pre-Processing Redaction Matters

In multi-step reasoning workflows or long brainstorming sessions, raw clear-text information easily leaks into intermediate conversation history, vector context, or external model providers.

By extracting and pseudonymizing entities before initiating analysis:

Opaque Tokens: Downstream reasoning models only receive abstract structural tokens (<PER_1>, <ORG_1>).
Context Isolation: The language model cannot memorize or inadvertently output real-world personal identifiers.
Audit Compliance: Workflows strictly align with GDPR, HIPAA, and European data sovereignty requirements.

1. Triggering the Privacy Shield

Method A: SmartInput Auto-Detection

When typing or pasting raw briefings containing sensitive identifiers into the main prompt box, SmartInput detects privacy-relevant terminology in real time (e.g. confidential, IBAN, bank account, anonymize, GDPR, personal data, vertraulich).

A green Shield Badge appears directly above the input:

Clicking the badge automatically switches execution to Direct Mode and activates the PII extraction tool.

Switch the mode selector to Direct.
Open the Tools / Sensitive Data & PII section in the left sidebar.
Select PII Redaction / Pseudonymization (mtd_pii_redaction).

Method C: PII-Alarm-Gate (Pre-Flight Intercept)

When sending prompts to models hosted outside the EU, the system executes an automated, client-side pre-flight check:

Instant Client-Side Regex (0ms): Scans the input text and attached non-media files completely offline in your browser for emails, IBANs, and credit card numbers. Zero data is transmitted to external servers or remote models during this evaluation.

If sensitive personal data is detected, the PII-Alarm-Gate intercepts the send action and presents 3 options:

[PII pseudonymisieren] (Recommended): Activates mtd_pii_redaction and routes the prompt through the EU Privacy Gateway to tokenize all personal identifiers before downstream reasoning.
[Mit EU-Modell ausführen]: Re-routes the prompt to certified European infrastructure (Mistral Small 3) so clear-text data never leaves the EU jurisdiction.
[Fortfahren & ignorieren]: Respects user sovereignty to proceed unmasked with the originally chosen model.

2. Understanding the Dual-Block Output

Upon processing your text, the Privacy Shield produces a specialized dual-container response:

┌────────────────────────────────────────────────────────────────────────────────────────┐
│ 🛡️ Sanitized Text (Review recommended)                 [➕ In new session]   [📋 Copy] │
├────────────────────────────────────────────────────────────────────────────────────────┤
│ <PER_1>'s account: IBAN <IBAN_1>, resident at <ADDR_1>                                 │
└────────────────────────────────────────────────────────────────────────────────────────┘

┌────────────────────────────────────────────────────────────────────────────────────────┐
│ 🔑 Entity Mapping (Sensitive Data)                       [🗑️ Purge data]     [📋 Copy] │
├────────────────────────────────────────────────────────────────────────────────────────┤
│ {                                                                                      │
│   "<PER_1>": ["John Doe"],                                                             │
│   "<IBAN_1>": ["AT12 3456 7890 1234 5678"],                                            │
│   "<ADDR_1>": ["1010 Vienna, Stephansplatz 1"]                                         │
│ }                                                                                      │
└────────────────────────────────────────────────────────────────────────────────────────┘

Block 1: Sanitized Text (Sky Blue Container)
The clean, pseudonymized version of your briefing with real entities replaced by standardized token markers.
Block 2: Entity Mapping Table (Gray Container)
The local lookup dictionary mapping every generated token back to its real-world clear-text value.

3. Choosing Your Privacy Path

Depending on your security requirements and subsequent workflow, you have two dedicated interaction paths:

Path A: Isolated New Session (`[In new session]` / `[In neue Session]`)

Recommended when beginning a multi-step recipe or deep exploration.

Click [In new session] on the top right of the Sanitized Text block.
The system opens a brand-new, clean session with only the pseudonymized tokens pinned as context.
The original un-redacted prompt and the entity lookup table are completely excluded and never touch the new session.
You can safely delete the temporary extraction session from the sidebar with one click.

Path B: 3-Point In-Place Purge (`[Purge data]` / `[Klardaten löschen]`)

Recommended when remaining in the current session while enforcing zero-data-footprint.

First, click [Copy] on the Entity Mapping block to store the resolution table locally (e.g. in your secure local password manager or notes).
Next, click [Purge data] (German: Klardaten löschen).
The system executes an irreversible 3-point atomic purge:
1. User Prompt Wipe: The original clear-text prompt in your chat history is overwritten with the sanitized token string.
2. Entity Table Erasure: The raw JSON mapping block in the assistant bubble is destroyed and replaced by a subtle security indicator: Entity mapping deleted · No sensitive data stored.
3. Database Scrubbing: The session record in the cloud database (PostgreSQL) is immediately overwritten with the sanitized arrays.

4. Re-Identification Safety & Best Practices

Preserving XML Tokens: When instructing the LLM further down the workflow (e.g., "Draft a contract proposal for <PER_1> regarding <ORG_1>"), always refer to the token identifiers.
Local Re-Assembly: Once the LLM generates the final output (e.g. the final contract or strategic pitch), copy the generated text back into your local text editor and perform a global search-and-replace using your locally saved entity lookup table.
No Context Retention: Because LLM queries are stateless, neither the LLM provider nor the session history retains clear-text entity records after a purge.