GuardRail: Data Protection

Data Protection is the WitnessAI data leakage, anonymization, and control Guardrail. Its purpose is to safeguard sensitive information from being transmitted to AI models via prompts.

This Guardrail also ensures sensitive data is protected by redacting (tokenizing) specific data types (e.g., US Social Security Numbers) before they are sent, and then restoring them to plaintext in responses to the user.

This allows a transparent experience for the user, while preventing sensitive data from being sent to any AI Apps or Models that should not receive it.

When the Guardrail detects potentially sensitive or protected data, it provides administrators with options to Allow, Warn, Block, or Route the activity to a different AI Model with a customizable message.

WitnessAI Policies leverage the Data Protection Guardrail to prevent unauthorized data exposure, enforce compliance, and manage data securely within AI interactions.

Use Cases

Preventing Data Leakage

Warn or Block users from sending prompts or file attachments containing sensitive data to AI Apps or Models (collectively AI Apps).

Redacting & Restoring Sensitive Data

Automatically tokenize and reconstitute sensitive information (e.g., credit cards, employee IDs) during AI interactions to ensure secure handling.

Routing Sensitive Data

Redirect prompts involving protected data to an alternative model designed for secure processing. This activity is invisible to the user.

Add a Data Protection Guardrail

Select Data Protection Guardrail from the list of Guardrails.

WitnessAI Create Policy page showing the Data Protection GuardRail selected in the left panel (highlighted in orange). The right panel shows ‘Enable GuardRail’ toggle, options for ‘Inspect Attachments’, ‘Anonymize sensitive data before sending to the AI Model’, and ‘Show redacted data in model response’. The Rules section shows validation errors highlighted in red requiring at least one action and one rule.

Click the Enable Guardrail toggle to enable the guardrail. When enabled, all prompts routed through this policy will be inspected for sensitive data.

Define Guardrail Rules & Actions

Image of Data Protection Guardrail Dashboard to configure rules and alerts.

With the Enable Guardrail toggle enabled, configure these settings below it:

Inspect Attachments: Check this box to scan file attachments. Supports text and PDF files under 100 MB.

Anonymize Sensitive Data: When enabled, detected sensitive data is tokenized (replaced with a hash value) before being sent to the AI model. When the tokenized values are included in responses, they are automatically restored. In normal usage, the tokenization and restoration is invisible to the user.

Show Masked Data in Model Response: When enabled, the tokenized values will not be visible in plaintext in the model’s response.

In the Rules section, define how the guardrail responds when sensitive data is detected. Click the None dropdown and choose an action — Warn, Block, or Route — for the selected data types. Enter a custom message to display to the user when the action is triggered.
In the Generate Alert section, set up alert rules for specific data types. Click Add Rule to select from available data categories to monitor and trigger alerts when detected.
Once all rules and options are configured, click Save to apply the guardrail to the policy.

💡

Note: At least one rule must be defined in the Rules section before saving.

Create Custom Data Types

In the Generate Alert section, click Add Rule, then click Add Data Type. The Select Data Types panel will slide open on the right.

Click Add Data Type button, and the ADD CUSTOM DATA TYPE panel will slide out

In the Data Type field, enter a name for your custom data type (e.g., Employee ID).

Under Expressions, click + Add Pattern to add one or more regex patterns that define what this data type looks like. Each pattern requires a confidence Score (0–100) that reflects how strongly a match of this regex pattern should be considered as contributing to a true detection.

You can add one or more Expressions.

Optionally, add Keywords to improve detection accuracy. Keywords are contextual terms that typically appear near the sensitive data in a prompt (e.g., “Employee ID” or a company domain). Multiple keywords can be entered as a comma-separated list.

Review the warning notice before saving: you are responsible for testing your regex patterns before deploying to production. Confirm they correctly match your intended data format and do not generate false positives or negatives.

Click Add to save the custom data type. It will now be available for selection in the SELECT DATA TYPES panel when configuring Rules and Generate Alert conditions across your policies.

View Custom Data Types

Once a Custom Data Type has been saved. It can be located in the right-side SELECT DATA TYPES slide-out panel.

To view saved Customer Data Types, click on the Add Data Type button below the Generate Alert section. The right-side panel will open. The Custom Data Types is at the top of the list of Data Types.

Click the checkbox next to the Custom Data Types label, and it will expand to show all the custom data types, and check all their checkboxes. Uncheck any you do not want to apply, then click Save.

Test the Guardrail configuration in a controlled environment to ensure it works as expected.

File Attachments Scanning & Blocking

See the File Attachments page for details.

Best Practices

User Education: Use warning messages to educate users about data security policies.
Testing: Validate the configuration in test environments before rolling out policies to all users.
Policy Documentation: Maintain detailed records of policy configurations for compliance audits.

Data Protection Guardrail Use Cases Preventing Data Leakage Redacting & Restoring Sensitive Data Routing Sensitive Data Add a Data Protection Guardrail Define Guardrail Rules & Actions Create Custom Data Types View Custom Data Types File Attachments Scanning & Blocking Best Practices