AI data protection & PII masking

⚠️ PROPOSAL — DO NOT USE IN SALES OR TRUST CONVERSATIONS (as of 2026-09-22, #3463). The framing below describes a design, not the product. Two things have changed since it was written:

The Comprehend scrubber it builds on has been withdrawn, not merely left disabled — see ../ai/pii-filter-coverage.md. Gevell does not mask PII before sending text to a model, and no setting offers to.

Bedrock Guardrails may not deliver the headline claim as written. In an ad-hoc ApplyGuardrail call against us-east-1 on 2026-09-21, source=INPUT returned action: NONE, units: 0 while source=OUTPUT returned GUARDRAIL_INTERVENED with the PII replaced — i.e. ANONYMIZE appeared to act on model output only. This is not yet a reproducible artifact: no test, log or script in this repo captures it, and the cost discussion below assumes input and output are both guardable. Re-run it before relying on either statement. If it holds, “masked before it is sent to an AI model” is not achievable by the mechanism this page proposes. Tracked on #3276.

Beyond that, masking the text channel does little for the PDF→HTML conversion cascade, which prompts the model with the page image rather than the extracted text — the finding that ended the previous attempt. Any revived version of this design has to answer the image channel first. (Note “preserve lane” in this repo means the flyer-tagger tag-in-place pipeline, which is a different code path and was never in scope for either attempt.)

Retained as the Guardrails cost/design analysis (#3276, open). Every capability sentence below should be read as “would, if built and if the input path worked” — not as a description of today.

Gevell uses AI to convert and remediate your documents. Because those documents can contain personal information, we add a protection layer that detects and masks personal information before it is sent to an AI model. This page explains how that works, where it applies, the extra option available for healthcare data, and what it costs.

The short version

Personal information (names, Social Security numbers, emails, phone numbers, addresses, financial identifiers, and more) is automatically detected and masked in the text we send to our AI models.
Your original document is never changed — masking happens only on the copy of the text that goes to the model.
AI processing runs under a zero-data-retention configuration: your content is not stored by the model provider and is not used to train any AI model.
The protection is inexpensive by design and included at no extra cost to you.

How PII masking works

We use Amazon Bedrock Guardrails, a safety layer built into the AWS AI platform that inspects text on its way to and from an AI model.

Before the model sees it — the text extracted from your document is scanned for personal information.
Detected information is masked — anything identified as personal is replaced with a neutral placeholder (for example, a Social Security number becomes a redacted marker) so the model works with the structure and meaning of your document without receiving the raw identifiers.
The response is checked too — output coming back from the model is scanned before it is used, as a second line of defense.

Because this happens at the platform layer, the same protection is applied consistently across our AI features rather than being bolted onto one feature at a time.

What counts as personal information

The masking layer recognizes common categories of personal data, including:

Names
Social Security numbers and other government IDs
Email addresses and phone numbers
Postal addresses
Financial identifiers such as credit card and bank account numbers

Where we apply it

PII masking is applied to the text our AI models process across Gevell’s document features, including:

Document conversion (turning PDFs and other files into accessible formats)
Alt-text and description generation
Accessibility auditing and report generation (including VPAT/ACR document parsing)
Remediation of document and page content

An important limitation: text vs. images

The masking layer scans text. Some of our features analyze images or scanned pages directly (for example, generating a description of a picture, or reading a scanned form as an image). In those cases the AI works from the visual content, which the text-masking layer does not inspect.

For that reason, if a document contains highly sensitive information that must never be shared with a third-party AI service, the safest approach is not to submit it for AI processing at all. Automated masking is a strong safeguard, not a substitute for that judgment. Detection is also best-effort and works best on English-language content.

Extra protection for healthcare data (PHI)

Standard PII masking covers personal identifiers. Some organizations — for example in healthcare — also need to protect Protected Health Information (PHI): clinical details such as diagnoses, medications, and medical record numbers that go beyond ordinary identifiers.

For these regulated use cases, Gevell can enable an additional detection layer powered by Amazon Comprehend Medical, which is trained to recognize clinical language, not just standard identifiers. This is available for customers with HIPAA or similar obligations. If this applies to your organization, contact us so we can enable it for your account.

What it costs

This protection is included at no additional charge — it does not change your per-document pricing.

For transparency, the underlying detection is inexpensive:

Protection	Approximate cost of detection
Standard PII masking (Bedrock Guardrails)	about $0.10 per million characters of text — a few hundredths of a cent per page
Healthcare PHI detection (Comprehend Medical)	about $1.00 per million characters of text, for regulated use cases

These are the costs of the detection itself; they are a small fraction of the overall cost of AI document processing. Guardrails only bills for the policies enabled — for PII masking we need only the sensitive-information filter. Applying the guardrail to the whole request re-bills large static system prompts on every call, so apply it to user/document content rather than the full payload where it matters. Input and output are both billed when both directions are guarded.

Summary

	Standard PII masking	Healthcare PHI detection
What it catches	Names, SSNs, emails, phones, addresses, financial IDs	The above plus diagnoses, medications, medical record numbers
How it’s applied	Automatically, across AI text processing	Optional, enabled per account for regulated use
Scans	Text sent to / returned from the model	Text
Cost to you	Included	Included; contact us to enable

Implementation status (internal)

Guardrails wiring: PR #3276. An optional guardrail is folded into the shared Bedrock credentials object, so every Bedrock Converse caller — the PDF cascade, the Gemini→Bedrock shim (~30+ document-AI services), agentic vision, alt-text, Nova AI-fix, and VPAT/ACR parsing — inherits it with no per-call-site changes. Gated on BEDROCK_GUARDRAIL_ID (+ optional BEDROCK_GUARDRAIL_VERSION, defaults to DRAFT), wired into both hosts (node server + Lambda) past the env-parity ratchet. bedrock:ApplyGuardrail was added to the Lambda IAM policy.
Not live yet. The env var is unset in production, so Guardrails are off and behavior is unchanged. Go-live requires: (1) creating the Bedrock Guardrail in AWS with the sensitive-information policy set to ANONYMIZE, (2) setting BEDROCK_GUARDRAIL_ID (SSM for Lambda, .env.node-server for the node host), (3) a node-host rebuild + a CDK deploy for the new IAM action. Hold external promotion of this page until go-live — the prose above is present-tense.
Comprehend is WITHDRAWN, not merely disabled (#3463). The flag is AI_PII_FILTER_ENABLED — the AI_PII_COMPREHEND_ENABLED named in earlier revisions of this page never existed in the codebase. The scrubber no-ops unless that var is 'true', the customer-facing setting has been removed, and it should not be described as a fallback we offer. The code is retained only so the integration is recoverable; see ../ai/pii-filter-coverage.md. Its PHI-entity detection is likewise not a capability we currently have.
Known coverage gaps: Guardrails and the scrubber both act on text only — image/PDF byte inputs (agentic vision, alt-text, org-chart extraction) are not scanned. The forms builder’s AI runs in a separate formspec sidecar and is not covered by this wiring.
Tracking: see issue #3273 for the tenant-level toggle and the security-doc scope follow-ups.