LiteLLM guardrails for PII: Presidio or Nonimo Gateway

If you already run LiteLLM in front of your models, you do not need a second router to keep personal data out of LLM calls. LiteLLM stays where it is, and you choose the PII filter behind it: the Presidio guardrail LiteLLM documents, or the plugin for Nonimo Gateway.

Nonimo Gateway runs on your own servers. See plans and get in touch.

This is an integration guide, not a case for replacing LiteLLM. It covers how LiteLLM guardrails work, what the Presidio guardrail does and does not document, the smaller built-in options, and where Nonimo Gateway fits.

LiteLLM and its guardrails, in brief

LiteLLM is a router: it puts one OpenAI-compatible interface in front of “100+ LLMs”, self-hosted, with virtual keys and cost tracking. Your application talks to it as it would to OpenAI, and guardrails run inside the proxy, so adding one does not change your code:

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://litellm.your-company.internal",  # your LiteLLM proxy
    api_key=os.environ["LITELLM_KEY"],  # a LiteLLM virtual key
)

Three guardrail behaviours matter for PII:

• Modes. pre_call checks the input before the model is called, post_call checks input and output afterwards, during_call runs alongside the call, and logging_only changes only what is logged.
• Streaming. “A guardrail runs on both streaming and non-streaming requests by default.” What a specific guardrail does with a stream is documented per guardrail.
• Always on. A guardrail with default_on: true “will run even if user specifies a different guardrail or empty guardrails array”, which stops a caller opting out.

Per-key control, tag-based modes, model-level guardrails and team restrictions are marked “This feature requires a LiteLLM Enterprise license”, which has custom pricing. The basic configuration is in the MIT-licensed proxy.

The Presidio guardrail

This is the most complete PII option LiteLLM documents.

• What you deploy. Presidio Analyzer and Presidio Anonymizer containers, which LiteLLM calls. Presidio itself is covered in our Microsoft Presidio alternative guide.
• Mask or block, per entity. MASK swaps the value for a placeholder such as <PERSON>. BLOCK will “Block the request entirely if this entity type is detected.”
• Restoring values. With output_parse_pii, “For presidio ‘replace’ operations, LiteLLM can check the LLM response and replace the masked token with the user-submitted values.”
• Language. You set a default with presidio_language, but detection quality depends on your Presidio set-up, which is English by default until you add models.

Where it gets thin:

• Streaming is not documented. The Presidio guardrail page does not mention streams. If your chat interface streams, restoration of a placeholder split across chunks is untested ground.
• Two more containers to run and tune, plus language models for every language your documents use.
• National IDs depend on Presidio’s list, which has recognisers for Spain, Italy and Germany but none for France, Portugal, Brazil or Mexico.

The other built-in routes

Content Filter. A built-in, on-device regex and keyword filter with prebuilt patterns for us_ssn, email, us_phone, visa, mastercard and amex. It can BLOCK (HTTP 400) or MASK with a label such as [EMAIL_REDACTED], and in during_call mode it checks streaming chunks. Its patterns are US formats, and the page does not describe restoring masked values.

Generic Guardrail API. A beta contract, POST /beta/litellm_basic_guardrail_api, that lets an external service receive the texts and tool call fields and answer BLOCKED, NONE or GUARDRAIL_INTERVENED. The default is fail closed. The page does not cover streaming.

Custom guardrail. A Python class where “You only have to implement one method: apply_guardrail.” For streams, async_post_call_streaming_iterator_hook is where real-time filtering lives. Restoring values in a stream is then code you write and maintain.

Presidio guardrail compared with Nonimo Gateway

	Presidio guardrail in LiteLLM	Nonimo Gateway
Role next to LiteLLM	Guardrail calling your Presidio containers	Plugin for LiteLLM, or an OpenAI-compatible endpoint on its own
What you run	Presidio Analyzer and Anonymizer, plus language models	Nonimo Gateway on your own servers
Restores real values	Yes, output_parse_pii for replace operations	Yes, real values back in the answer
Streaming	Not mentioned on its page	Real values back in the answer
Languages and IDs	Presidio’s, English by default	National documents per country, such as Spanish DNI/NIE/NIF, German Steuer-ID, French NIR, Italian codice fiscale, Brazilian CPF, Mexican RFC and CURP
Licence	MIT, with Enterprise features on custom pricing	Plans on the Nonimo Gateway page

If your data is English and you already run Presidio, the Presidio guardrail is a small step. If your documents carry European or Latin American IDs, that is where the plugin comes in.

How Nonimo Gateway does it

Nonimo Gateway is a private proxy that replaces personal data before a request reaches the LLM API and restores the real values in the response. It runs on your own servers.

For LiteLLM users, there is a Nonimo Gateway plugin for LiteLLM, so you keep LiteLLM as your router. It recognises the national documents and numbers of each country it serves, including Spain’s CUPS number alongside the IDs above. If you do not run LiteLLM, the Gateway also works on its own as an OpenAI-compatible endpoint: you change base_url and keep your code. You keep your own OpenAI key, and plans and prices are on the Nonimo Gateway page.

Whichever route you take, replacing identifiers is pseudonymisation, not anonymisation; our guide on de-identified versus anonymised data explains the difference. It sits inside a wider process: a written rule for staff, such as our AI policy template, and a plan for when something slips, as in is putting client data in ChatGPT a data breach. If you are also moving off the archived LLM Guard toolkit, see our LLM Guard alternative guide.

Keep LiteLLM, add the plugin

You do not have to rebuild your router to protect personal data in it. Add Nonimo Gateway behind LiteLLM and keep everything else as it is. See Nonimo Gateway’s plans and get in touch for the plugin details.

Sources

Checked 20 October 2026.

• LiteLLM, documentation home. What LiteLLM and its proxy are, OpenAI format.
• LiteLLM, guardrails quick start. Modes, streaming default, default_on, Enterprise-gated features.
• LiteLLM, PII masking with Presidio. Mask or block per entity, output_parse_pii, presidio_language.
• LiteLLM, Content Filter. Prebuilt patterns, BLOCK and MASK, streaming chunks.
• LiteLLM, Generic Guardrail API. Beta endpoint, actions, fail closed.
• LiteLLM, custom guardrail. apply_guardrail and the streaming hook.
• LiteLLM, Enterprise. Custom pricing.
• Presidio, languages. English by default.
• Presidio, supported entities. National ID recognisers by country.

---

This page is for information. Product details of other vendors were checked on their official pages on 20 October 2026 and can change.