RAG Pipeline PII Sanitization: Three Places To Intervene
A retrieval-augmented generation pipeline moves personal data through ingestion, embedding, storage, retrieval, and prompt assembly before any model sees it. Each stage is an opportunity to exclude identifiers. This page lists where a deterministic sanitization step reduces exposure and where it does not.
Summary
Source documents often contain identifiers that the retrieval task does not need. If they are embedded as-is, the vector store becomes a second copy of sensitive data, and retrieved chunks carry those identifiers into every prompt.
Tokenizing at ingestion keeps the vector store free of raw identifiers. Tokenizing at prompt assembly protects the case where the store already holds raw text. Both use the same reversible surrogate contract.
Pipeline Stage Mapping
| Stage | Exposure | Sanitization option |
|---|---|---|
| Ingestion | Raw documents loaded for chunking and embedding. | Tokenize before chunking so stored chunks and embeddings derive from surrogates. |
| Vector store | Embeddings and chunk text persist in a database with its own access controls. | Store only surrogate text; keep the mapping outside the store. |
| Retrieval | Top results are returned to the application. | Results already carry surrogates when ingestion was sanitized. |
| Prompt assembly | Retrieved context and the user question are joined and sent to a provider. | Tokenize the assembled prompt as a final gate before egress. |
| Response handling | The model answer references surrogates. | Restore surrogates locally for the authorized reader. |
How ZTDS Applies
Recommended order of adoption:
- Add the prompt-assembly gate first because it protects every existing pipeline immediately.
- Then sanitize at ingestion for new collections to keep raw identifiers out of the vector store.
- Keep one mapping scope per user session or per tenant and never share it across tenants.
- Test with a scanner run that confirms no cleartext identifiers appear in outbound requests.
What This Control Does Not Cover
- Tokenizing before embedding can change retrieval quality for queries that rely on the removed values; measure it on your corpus.
- It does not enforce document-level access control. That remains the job of the retrieval layer.
- It does not address poisoning of the vector store or injection through retrieved text.
- Embeddings of text that still contains free-text context can carry indirect information.
Frequently Asked Questions
Should PII be removed before or after embedding?
Before, when possible. Tokenizing at ingestion keeps raw identifiers out of both the stored chunks and the embeddings. A gate at prompt assembly is still useful as a final check.
Does sanitizing before embedding hurt retrieval?
It can for queries that depend on the removed values, for example searching by a specific name. Measure retrieval quality on your own corpus and decide per collection.
Can the token map be shared across users?
It should not be. Scope the mapping to a session or tenant and keep it in volatile memory so one user can never restore another user values.
Related Specifications and Tools
- AI and RAG Blueprints — Integration recipes for agent and retrieval stacks.
- ZTDS RFC v1.0 Specification — The four invariants referenced on this page.
- Perimeter Scanner — Browser-based egress audit with local receipts.
- Framework Mappings Hub — All framework mappings in one index.
- OWASP LLM02 Sensitive Information Disclosure — Maps pre-egress tokenization to OWASP LLM02:2025 and states what it does not cover.
- NIST AI RMF Generative AI Profile — Places ZTDS across GOVERN, MAP, MEASURE, and MANAGE for generative AI data privacy risk.
- EU AI Act Article 10 Data Governance — Describes how pre-ingestion sanitization supports Article 10 data governance practices.
- GDPR Articles 25 and 32 for AI Prompts — Explains data protection by design and security of processing for prompts sent to AI providers.
- HIPAA Safe Harbor for LLM Prompts — Shows how 18-identifier removal applies to clinical text sent to language models.
- MCP stdio PII Sanitization — Describes a local gateway that sanitizes JSON-RPC traffic over the MCP stdio transport.
- Client-Side Sanitization vs Proxy DLP — Compares client-side in-memory sanitization with network proxy and cloud DLP approaches.