Privacy Shield & PII Redaction

The Privacy Shield is a pre-processing security tool in Brainstorm Reactor. It detects and sanitizes Personally Identifiable Information (PII) — including individual names, bank details (IBANs), physical addresses, corporate entities, phone numbers, and emails — replacing them with opaque XML tokens (<PER_1>, <IBAN_1>, <ADDR_1>) before sensitive data ever leaves your browser or enters an agentic reasoning loop.

Why Pre-Processing Redaction Matters

In multi-step reasoning workflows or long brainstorming sessions, raw clear-text information easily leaks into intermediate conversation history, vector context, or external model providers.

By extracting and pseudonymizing entities before initiating analysis:

1. Opaque Tokens: Downstream reasoning models only receive abstract structural tokens (<PER_1>, <ORG_1>).
2. Context Isolation: The language model cannot memorize or inadvertently output real-world personal identifiers.
3. Audit Compliance: Workflows strictly align with GDPR, HIPAA, and European data sovereignty requirements.

1. Triggering the Privacy Shield

Method A: SmartInput Auto-Detection

When typing or pasting raw briefings containing sensitive identifiers into the main prompt box, SmartInput detects privacy-relevant terminology in real time (e.g. confidential, IBAN, bank account, anonymize, GDPR, personal data, vertraulich).

A green Shield Badge appears directly above the input:

• Clicking the badge automatically switches execution to Direct Mode and activates the PII extraction tool.

Method B: Manual Activation via Sidebar

1. Switch the mode selector to Direct.
2. Open the Tools / Sensitive Data & PII section in the left sidebar.
3. Select PII Redaction / Pseudonymization (mtd_pii_redaction).

2. Understanding the Dual-Block Output

Upon processing your text, the Privacy Shield produces a specialized dual-container response:

┌────────────────────────────────────────────────────────────────────────────────────────┐
│ 🛡️ Sanitized Text (Review recommended)                 [➕ In new session]   [📋 Copy] │
├────────────────────────────────────────────────────────────────────────────────────────┤
│ <PER_1>'s account: IBAN <IBAN_1>, resident at <ADDR_1>                                 │
└────────────────────────────────────────────────────────────────────────────────────────┘

┌────────────────────────────────────────────────────────────────────────────────────────┐
│ 🔑 Entity Mapping (Sensitive Data)                       [🗑️ Purge data]     [📋 Copy] │
├────────────────────────────────────────────────────────────────────────────────────────┤
│ {                                                                                      │
│   "<PER_1>": ["John Doe"],                                                             │
│   "<IBAN_1>": ["AT12 3456 7890 1234 5678"],                                            │
│   "<ADDR_1>": ["1010 Vienna, Stephansplatz 1"]                                         │
│ }                                                                                      │
└────────────────────────────────────────────────────────────────────────────────────────┘

1. Block 1: Sanitized Text (Sky Blue Container)
   The clean, pseudonymized version of your briefing with real entities replaced by standardized token markers.
2. Block 2: Entity Mapping Table (Gray Container)
   The local lookup dictionary mapping every generated token back to its real-world clear-text value.

3. Choosing Your Privacy Path

Depending on your security requirements and subsequent workflow, you have two dedicated interaction paths:

Path A: Isolated New Session ([In new session] / [In neue Session])

Recommended when beginning a multi-step recipe or deep exploration.

• Click [In new session] on the top right of the Sanitized Text block.
• The system opens a brand-new, clean session with only the pseudonymized tokens pinned as context.
• The original un-redacted prompt and the entity lookup table are completely excluded and never touch the new session.
• You can safely delete the temporary extraction session from the sidebar with one click.

Path B: 3-Point In-Place Purge ([Purge data] / [Klardaten löschen])

Recommended when remaining in the current session while enforcing zero-data-footprint.

• First, click [Copy] on the Entity Mapping block to store the resolution table locally (e.g. in your secure local password manager or notes).
• Next, click [Purge data] (German: Klardaten löschen).
• The system executes an irreversible 3-point atomic purge:
  1. User Prompt Wipe: The original clear-text prompt in your chat history is overwritten with the sanitized token string.
  2. Entity Table Erasure: The raw JSON mapping block in the assistant bubble is destroyed and replaced by a subtle security indicator: Entity mapping deleted · No sensitive data stored.
  3. Database Scrubbing: The session record in the cloud database (PostgreSQL) is immediately overwritten with the sanitized arrays.

4. Re-Identification Safety & Best Practices

1. Preserving XML Tokens: When instructing the LLM further down the workflow (e.g., "Draft a contract proposal for <PER_1> regarding <ORG_1>"), always refer to the token identifiers.
2. Local Re-Assembly: Once the LLM generates the final output (e.g. the final contract or strategic pitch), copy the generated text back into your local text editor and perform a global search-and-replace using your locally saved entity lookup table.
3. No Context Retention: Because LLM queries are stateless, neither the LLM provider nor the session history retains clear-text entity records after a purge.