How do you keep personal and sensitive data out of prompts, outputs and logs?

Send less (only the fields the task needs, with personal data masked or replaced where possible), control where it goes (a provider and contract whose retention and training terms you have checked), filter what comes back, and treat logs and traces as sensitive data, because they usually hold full prompts. OWASP lists this as sensitive information disclosure (LLM02:2025).

1. Minimise the input

• Send only what the task needs. A model classifying a support ticket's topic does not need the customer's address.
• Mask or replace personal data before the call: detect names, emails, phone numbers, account numbers, and replace them with placeholders (<EMAIL_1>), keeping a mapping to restore them in the reply if needed.
• Never put secrets (API keys, passwords) in prompts. Tools should hold credentials, not the model.

2. Control where it goes

• Know the provider's terms. Anthropic, for example, does not use inputs and outputs from its commercial products, the API included, to train models by default. Its API data-retention page says prompts and outputs are not retained by default, apart from certain models that require 30-day retention, and offers zero data retention by arrangement.
• Check region, sub-processors and certifications against your obligations (GDPR, HIPAA, contracts). Cloud platforms such as Amazon Bedrock have their own data terms.
• Features that store data (files, batches, code execution containers) may have their own retention. Check each one you use.

3. Control access inside the app

In RAG and agents, data reaches the prompt through retrieval and tools. Enforce the user's permissions there, so the model never sees what the user may not.

4. Filter the output

Scan responses for personal data patterns and secrets before showing or storing them, especially where outputs reach other users (shared summaries, public posts).

5. Logs, traces and evaluation sets

• Prompts and responses in logs are often the largest copy of sensitive data in the system.
• Mask before logging, restrict access, set short retention, and keep them out of general analytics.
• Build evaluation sets from anonymised or synthetic data.

6. Memory and fine-tuning

Data written to agent memory or used for fine-tuning can resurface later in other contexts. Exclude personal data from both unless there is a clear legal basis and a way to delete it.

7. Tell users

Say what is sent where, and avoid inviting users to paste sensitive data the feature does not need.

How to show maturity: "I map every copy of a prompt — provider, logs, traces, caches, memory, eval sets — and apply masking and retention to each, not just to the API call."