DEV Community

Cover image for title: How to Stop Accidentally Leaking PII to OpenAI in Python & Node.js
Samir Moukhliss
Samir Moukhliss

Posted on

title: How to Stop Accidentally Leaking PII to OpenAI in Python & Node.js

#ai #iot #webdev #security

If you're building with OpenAI, Anthropic, or Gemini, your backend code probably looks something like this:

# Standard Python OpenAI call
from openai import OpenAI

client = OpenAI(api_key="sk-proj-...")
response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": user_submitted_prompt}]
)
Enter fullscreen mode Exit fullscreen mode

It takes 5 minutes to set up and works like a charm.

The problem? You have zero control over what user_submitted_prompt contains.

If a user pastes a customer support transcript containing credit card numbers, email addresses, or medical details, your code sends that raw Personally Identifiable Information (PII) straight to an external API endpoint. Under GDPR, CCPA, and HIPAA, transmitting unmasked PII across external boundaries without data minimization is an instant compliance violation.

In this post, we'll look at how to intercept outbound LLM requests at the network perimeter and auto-tokenize sensitive data—without rewriting your application logic.

Why Client-Side Regex Isn't Enough

The most common quick-fix developers reach for is client-side regex:

# The fragile approach
clean_prompt = re.sub(r'[\w\.-]+@[\w\.-]+', '[REDACTED]', user_prompt)
Enter fullscreen mode Exit fullscreen mode

This quickly becomes an operational nightmare:

  1. It breaks LLM context: Replacing an email with [REDACTED] means the AI can't reference who sent what when generating its response.
  2. Regex is blind to context: It can't differentiate between a phone number, an internal SKU, or an order ID.
  3. It doesn't scale: Maintaining regex rules for 16+ PII types across multiple microservices is a maintenance sinkhole.

The Solution: Proxy-Based Tokenization

Instead of writing fragile regex filters in every application service, modern AI architectures route outbound LLM calls through a security proxy sitting at the network boundary.

The proxy intercepts the request, runs local Named Entity Recognition (NER) to detect PII in volatile RAM, replaces the data with deterministic tokens (e.g., [EMAIL_001]), forwards the clean prompt to OpenAI, and re-hydrates the response when it returns.

User Request ──> Application ──> Security Proxy ──> Third-Party LLM
                                      │
                           (Tokenizes PII in RAM)
Enter fullscreen mode Exit fullscreen mode

Implementation: The 1-Line Code Change

The cleanest part about using a standard proxy architecture is that you don't need to learn a new SDK. You simply update the base_url parameter in your existing client.

Python Example 

from openai import OpenAI

# Point base_url to your AIGuard proxy instead of default OpenAI
client = OpenAI(
    api_key="your-openai-api-key",
    base_url="https://proxy.aiguard.solutions/v1"  # Routes through security proxy
)

# Your application logic remains 100% identical
response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{
        "role": "user", 
        "content": "Draft a response to John Smith at john.smith@example.com about order #49201."
    }]
)

print(response.choices[0].message.content)
Enter fullscreen mode Exit fullscreen mode

Node.js Example 

import OpenAI from 'openai';

const openai = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY,
  baseURL: 'https://proxy.aiguard.solutions/v1' // Proxy endpoint
});

async function main() {
  const completion = await openai.chat.completions.create({
    messages: [{ role: 'user', content: 'Customer Alice (alice@work.com) requested account deletion.' }],
    model: 'gpt-4o',
  });

  console.log(completion.choices[0].message.content);
}

main();
Enter fullscreen mode Exit fullscreen mode

What Happens Behind the Scenes?

When that request hits the proxy:

  1. Detection: Local NER models flag "John Smith" as [NAME_001] and "john.smith@example.com" as [EMAIL_001].
  2. Outbound Payload: OpenAI only sees: "Draft a response to [NAME_001] at [EMAIL_001] about order #49201."
  3. Inbound Response: OpenAI responds using the tokens: "Hi [NAME_001], regarding your email sent from [EMAIL_001]..."
  4. Re-Hydration: The proxy restores the tokens in local memory, returning the correctly formatted string back to your Python/Node script.

The downstream AI provider does the heavy lifting, but the real raw PII never touches their servers or hard drives.

Conclusion

Securing your AI data pipeline doesn't require rebuilding your tech stack from scratch. By swapping your client SDK's base_url to point to an enterprise proxy like AIGuard, you get instant PII masking, SOC 2 / GDPR compliance logging, and rate-limiting protection out of the box.

Check out the full setup guides and code samples in the AIGuard Developer Documentation.

Top comments (0)