PII redaction software for LLM apps: 14 tools compared

20 October 2026 · Written and maintained by Nonimo

PII redaction software for LLM apps finds personal data in a prompt before it reaches the model, then blocks it, masks it or replaces it with a stand-in. The tools differ less in what they detect than in where they sit: libraries you call from your code, cloud APIs, plugins inside an API gateway, and proxies that do the whole round trip and put the real values back in the answer.

Nonimo Gateway runs on your own servers. See plans and get in touch.

This guide groups 14 tools by kind rather than ranking them. Nonimo Gateway is ours, and we say where it fits. Every fact about other vendors comes from their own pages, checked on 20 October 2026.

First, three words that get mixed up

Searches for “data masking tools” and “data anonymization tools” often land on the same products, but the terms are not the same.

Blocking stops the request. Nothing leaves, and nothing useful comes back.
Masking swaps a value for a placeholder or a label. The model sees {NAME} or PLACEHOLDER1.
Pseudonymisation swaps a value for a stand-in and keeps a key, so the real value can be put back. The data remains personal data for whoever holds the key.

True anonymisation is rare in this category, because LLM apps usually need the answer to refer to the real person. Our guides on what to redact before you paste a document into an AI and pseudonymisation under UK GDPR go into the legal difference.

The 14 tools in one table

Tool	Kind	Where it runs	Restores values	Streaming	Published price	Languages
Nonimo Gateway	Self-hosted proxy	Your own servers	Yes	Real values back in the answer	Plans on the Gateway page	National IDs of each country it serves
Presidio	Library and services	Your infrastructure	Only via encrypt and decrypt	Not documented (not a proxy)	Free, MIT	English by default, adaptable
LLM Guard	Library and API, archived	Your infrastructure	Yes, Vault and Deanonymize	Not documented	Free, MIT	PII in English and Chinese
LiteLLM	Self-hosted proxy with guardrails	Your infrastructure	Yes, with Presidio	Guardrails run on streams by default	Open source free; Enterprise not published	Depends on the engine
Portkey	AI gateway	Portkey cloud; hybrid on Enterprise	No, “irreversible by design”	Output guardrails on streams informational only	Free tier; Production $49/month; PII plan not stated	Not published
Limina	De-identification service	Container on-prem or VPC; SaaS	Yes, separate re-identify call	Not documented	Free 75 calls/day; paid not published	52 (homepage)
Protecto	De-identification API	SaaS; VPC or on-prem on Enterprise	Yes, explicit Unmask API	Not documented	From $250/month	7
Nightfall	DLP platform	Cloud, endpoint agents, browser extension	No automatic restore documented	Not documented; model responses monitor-only	Per user, not published; free API tier	English-centric
Skyflow	Data privacy vault	Skyflow-operated: SaaS, dedicated VPC or your AWS/GCP account	Yes, per caller	Kong plugin buffers the full completion	Not published	40+
Lakera Guard	AI security screening API	EU, US, Singapore; self-hosted on Enterprise	Not described	Chunked screening by your app	Not published	100+ platform-wide
Cloudflare AI Gateway	Edge gateway	Cloudflare’s network	No, flag or block	Response scan buffers the whole stream	DLP free on all plans	Not published
Kong AI Sanitizer	Gateway plugin	Self-managed Kong or Konnect	Optional	Not documented	Enterprise, custom	9 language images
AWS Bedrock Guardrails	Cloud API	AWS	No	Sync mode buffers; no masking in async	$0.10 per 1,000 text units	17
Azure AI Language PII	Cloud API and container	Azure, or a container on your servers	No built-in restore	Not a proxy	Free web tier; text PII price not quoted here	79 entries for text

“Not documented” means we did not find it on the vendor’s official pages on 20 October 2026. It does not mean the feature is missing.

Where Nonimo Gateway fits

Nonimo Gateway is for teams that call the OpenAI API with their own key, need the real values back in the answer, and want the whole thing on their own servers. It runs on your own servers and has an OpenAI-compatible API, so you change base_url and keep your code:

from openai import OpenAI

client = OpenAI(base_url="https://gateway.your-company.internal/v1", api_key="sk-...")

It replaces personal data in what goes out and restores the real values in the response. It recognises the national documents and numbers of each country it serves, such as the Spanish DNI, NIE and NIF, Spain’s CUPS energy supply number, the German Steuer-ID, the French NIR, the Italian codice fiscale, the Brazilian CPF and the Mexican RFC and CURP. There is a plugin for LiteLLM, and you keep your own OpenAI key. Plans and prices are on the Nonimo Gateway page.

The other 13 tools follow, grouped by kind, each with what it does in one line and where it stops for LLM calls.

Libraries you build on

Presidio

It offers a modular, open-source toolkit with 80 documented entity types, including Spanish NIF and NIE and recognisers for Italy and Germany. Originally a Microsoft project, which is why people still search for “Microsoft Presidio”, it is moving to community governance under the Data Privacy Stack organisation, still MIT. Only its encrypt operator is reversible, it works in English by default, and it is not an LLM proxy: the layer around the call is yours to build. Full comparison: Presidio alternative.

LLM Guard

It offers a full reversible round trip, Anonymize with a Vault and Deanonymize, alongside scanners for prompt injection, secrets and toxicity. The repository is archived, and Protect AI, its maker, has been part of Palo Alto Networks since 22 July 2025. PII detection covers English and Chinese. Full comparison: LLM Guard alternative.

Gateways and gateway plugins

LiteLLM

It offers an open-source, OpenAI-compatible proxy for over 100 providers with a broad guardrail framework. For PII it relies on guardrails: Presidio with output_parse_pii to restore values, a built-in regex filter, or a third-party API in beta. The Presidio page does not describe restoration in a stream. Full comparison: LiteLLM PII guardrails.

Portkey

It offers a hosted gateway with logging, routing, fallbacks and guardrails in one place, with a published entry price. Palo Alto Networks acquired it on 29 May 2026. Its PII redaction uses numbered placeholders such as {{EMAIL_ADDRESS_1}} and, in its words, “Redaction is irreversible by design.” Which plan includes PII redaction is not clear from its pages. Full comparison: Portkey alternative.

Cloudflare AI Gateway

It needs no install: DLP in AI Gateway is free on all plans. DLP flags or blocks and does not mask, and when it scans responses it buffers the whole streamed answer. PII detection in prompts across 13 categories is also available through AI Security for Apps, a paid Enterprise add-on. Full comparison: Cloudflare AI Gateway vs Nonimo Gateway.

Kong AI Gateway

It offers PII handling inside the API gateway you may already run, with placeholder or synthetic values and optional restoration. The AI Sanitizer plugin needs a separate kong/ai-pii-service container, Kong lists it as an Enterprise plugin with custom pricing, and streaming and tool calls are not described. Full comparison: Kong AI Gateway vs Nonimo Gateway.

Cloud APIs

AWS Bedrock Guardrails

It offers a per-type, per-direction policy (block, anonymize or detect only) that checks any model’s text through the ApplyGuardrail API, with a clear price of $0.10 per 1,000 text units. It has 31 built-in types, including three UK identifiers alongside US and Canadian ones, and no EU national IDs such as the Spanish DNI. There is no restore feature, and masking is not supported in asynchronous streaming.

Azure AI Language PII detection

It offers a long entity list that includes Spain DNI, Italy fiscal code, Germany tax ID, Brazil CPF and Portugal tax ID, with 79 language entries for text and a container option. It returns redacted text plus the entities with their original text and position, so an application can map values back itself; there is no built-in restore into an LLM answer, and it is not a proxy.

So cloud APIs are not uniform on European identifiers. Azure lists many; AWS lists UK identifiers but not EU national ones. Check the list of the service you plan to use.

De-identification services

Limina (formerly Private AI)

It offers a container that runs fully in your infrastructure, with broad language coverage and a documented re-identify route for LLM round trips. Private AI renamed itself Limina on 5 March 2026. The reidentify call is one you orchestrate in your own code; it is not a proxy. Full comparison: Limina alternative.

Protecto

It offers reversible, deterministic tokens with a permission-controlled Unmask API, which it calls “always explicit, always permission-controlled, and never automatic”, and published self-serve prices from $250 a month. It lists 7 languages, and streaming is not documented. Full comparison: Protecto alternative.

DLP platform

Nightfall AI

It offers company-wide coverage across SaaS apps, endpoints, browsers and AI agents from one console. For AI it blocks or monitors prompts and tool calls, while model responses are monitor-only, and no automatic restore is documented. Full comparison: Nightfall AI alternative.

Vault

Skyflow

It offers a documented round trip that restores reversible vault tokens per caller in the answer and inside tool-call arguments. Skyflow operates the vault for you, in shared SaaS, a dedicated VPC or your own AWS or GCP account, and its Kong plugin buffers the full completion before re-emitting it as a stream. Prices are not published. Full comparison: Skyflow alternative.

AI security screening

Lakera Guard

It offers AI security screening, including agent and tool traffic, in one API. Now owned by Check Point and called AI Guardrails in its docs, it detects 8 built-in PII types and can block, or return positions so your application masks the text; no restore step is described. Full comparison: Lakera Guard alternative.

How to choose by kind of tool

You want to build it yourself and have engineers to maintain it: a detection library.
You already run a gateway: check what its own PII plugin does with the answer and with streaming.
You live in one cloud: that cloud’s API, after checking its entity list against the documents you actually handle.
Security teams want company-wide control across SaaS, endpoints and agents: a DLP platform.
You want tokens held by a third party under role-based access: a vault.
Prompt attacks are the main risk: a security screening API.
You call the OpenAI API, need real values back in the answer, and want it on your own servers: a self-hosted proxy such as Nonimo Gateway.

None of these choices settles on its own whether sending client data to a provider is lawful. Our guide on whether putting client data in ChatGPT is a data breach covers that, and what HIPAA and the CCPA require of de-identification covers the US side.

If the last line of that list describes you, Nonimo Gateway is built for it. See plans and get in touch.

Sources

Presidio, project transition. Community governance under Data Privacy Stack, MIT licence.
Presidio, anonymizer. Operators, decrypt as the reversible path.
Presidio, supported entities. The 80 entity types, Spanish NIF and NIE.
Presidio, languages. English by default.
LLM Guard, repository. Archived, MIT.
LLM Guard, Deanonymize scanner. Restoring real values.
LLM Guard, Anonymize scanner. English and Chinese, Vault.
Palo Alto Networks, Protect AI acquisition, 22 July 2025. Ownership.
LiteLLM, documentation. OpenAI-compatible proxy for 100+ providers.
LiteLLM, Presidio PII masking. Mask or block per entity, output_parse_pii.
LiteLLM, guardrails quick start. Guardrails on streaming requests by default.
LiteLLM, Enterprise. Custom pricing.
Portkey, PII redaction. Numbered placeholders, irreversible by design.
Portkey, guardrails. Streaming behaviour of output guardrails.
Portkey, private cloud deployments. Hybrid deployment on Enterprise.
Portkey, pricing. Free Developer plan, Production $49 a month.
Palo Alto Networks, Portkey acquisition, 29 May 2026. Ownership.
Limina, rebrand announcement, 5 March 2026. The new name.
Limina, homepage. 52 languages.
Limina, pricing. Deployment options, free tier.
Limina, re-identify text. Restoring values into an LLM answer.
Protecto, unmasking. Explicit Unmask API.
Protecto, supported languages. The 7 languages.
Protecto, SaaS pricing. Plans from $250 a month, Enterprise deployment.
Nightfall, choosing a control. Block or monitor, responses monitor-only.
Nightfall, Developer API pricing. Free 3 GB a month.
Nightfall, pricing. Per-user price not shown.
Nightfall, deploying Nightfall. SaaS integration by OAuth.
Nightfall, supported languages. English-centric semantic detection.
Skyflow, deployment models. SaaS, dedicated VPC, BYOC.
Skyflow, de-identification. 40+ languages.
Kong, Skyflow AI Data Control plugin. Reversible tokens, tool calls, buffered streaming.
Lakera, homepage. The “100+ languages” claim, platform-wide.
Lakera, data leakage prevention. Eight PII types, block or mask.
Lakera, guard API reference. Masking by your application, chunked streaming.
Lakera, self-hosting. Enterprise licence.
Check Point, Lakera acquisition, 16 September 2025. Ownership.
Cloudflare, DLP in AI Gateway. Flag or block, stream buffering.
Cloudflare, AI Gateway pricing. DLP free on all plans.
Cloudflare, AI Security for Apps PII detection. Prompts only, 13 categories.
Cloudflare, AI Security for Apps. Paid Enterprise add-on.
Kong, AI Sanitizer plugin. Enterprise plugin, service container, restoration, language images.
Kong, pricing. AI Sanitizer among Enterprise plugins, custom Enterprise pricing.
AWS, Bedrock Guardrails sensitive information filters. Actions, the 31 types, the trace.
AWS, ApplyGuardrail API. Use with any model.
AWS, Guardrails streaming. No masking in asynchronous mode.
AWS, Guardrails supported languages. The 17 languages.
AWS, Bedrock pricing. $0.10 per 1,000 text units, regex free.
Microsoft, Azure PII detection overview. Detect and redact in text, conversations and documents.
Microsoft, redact text PII. Redaction policies, entities with offsets.
Microsoft, PII entity categories. Spain DNI, Italy fiscal code, Germany tax ID, Brazil CPF.
Microsoft, PII language support. Language table.
Microsoft, PII containers. Container option, billing connection.
Microsoft, Azure Language pricing. Free web tier.

All checked 20 October 2026.

This page is for information. Product details of other vendors were checked on their official pages on 20 October 2026 and can change.

Nonimo is the software that does this on your own computer: it redacts client names and IDs before your text reaches ChatGPT. No account needed, and the app does it without your files leaving your machine.

Common questions

What is PII redaction software for LLM apps?

Software that finds personal data such as names, ID numbers and account numbers in text before it reaches a language model, and then blocks, masks or replaces it. Some tools also put the original values back into the model's answer, which is pseudonymisation rather than anonymisation.

What is the difference between data masking tools and data anonymization tools?

Masking hides a value, often with a placeholder or a type label. Anonymisation means nobody can link the data back to a person, which a reversible replacement does not achieve: if a tool can restore the values, someone holds the key, and the data is pseudonymised. Most tools in this list mask or pseudonymise.

Which PII tools restore the real values in the LLM's answer?

Among the tools in this guide, LLM Guard, LiteLLM with Presidio, Limina, Protecto, Skyflow, the Kong AI Sanitizer and Nonimo Gateway document a way to restore. Presidio does it through its encrypt and decrypt operators. Portkey states its redaction is irreversible, and Cloudflare DLP flags or blocks.

Do cloud APIs recognise European national ID numbers?

It depends on the service. Azure AI Language lists Spain DNI, Italy fiscal code, Germany tax ID, Brazil CPF and others. AWS Bedrock Guardrails has 31 built-in types including three UK identifiers, and none for EU national IDs such as the Spanish DNI. Check the list of the specific service.

Which PII redaction tools can run on my own servers?

Presidio, LLM Guard, LiteLLM and Nonimo Gateway run on your own infrastructure. Limina deploys as a container on-premises or in your VPC. Azure AI Language offers a container. Lakera, Protecto and Portkey offer self-hosted or hybrid options on Enterprise plans, and Kong can be self-managed.

Is there free PII redaction software?

Presidio and LLM Guard are open source under MIT terms. LiteLLM's open-source proxy is MIT outside its enterprise folder. Cloudflare says DLP in AI Gateway is free on all plans. Several vendors offer free tiers with limits, such as Limina's 75 API calls a day.

Where does Nonimo Gateway fit among these tools?

It is a self-hosted proxy on your own servers with an OpenAI-compatible API. It replaces personal data before the request reaches the model and restores the real values in the answer. Plans and prices are on the Gateway page.