Data Protection

Data Protection is the WitnessAI data leakage, anonymization, and control Guardrail. Its purpose is to safeguard sensitive information from being transmitted to AI models via prompts.

This Guardrail also ensures sensitive data is protected by redacting (tokenizing) specific data types (e.g., US Social Security Numbers) before they are sent, and then restoring them to plaintext in responses to the user.

This allows a transparent experience for the user, while preventing sensitive data from being sent to any AI Apps or Models that should not receive it.

When the guardrail detects potentially sensitive or protected data, administrators can have it Warn the user, Block the activity, or Route it to a different AI Model, with a customizable message. An action of None takes no action, which is useful when you only want anonymization or alerts.

WitnessAI Policies leverage the Data Protection Guardrail to prevent unauthorized data exposure, enforce compliance, and manage data securely within AI interactions.

Use Cases

Preventing Data Leakage

Warn or Block users from sending prompts or file attachments containing sensitive data to AI Apps or Models (collectively AI Apps).

Redacting & Restoring Sensitive Data

Automatically tokenize and reconstitute sensitive information (e.g., credit cards, employee IDs) during AI interactions to ensure secure handling.

Routing Sensitive Data

Redirect prompts involving protected data to an alternative model designed for secure processing. This activity is invisible to the user.

Add a Data Protection Guardrail

Select Data Protection Guardrail from the list of Guardrails.

The Data Protection guardrail selected in a policy's Guardrails list, with the Enable Guardrail toggle on and the Inspect Attachments, Anonymize sensitive data and Show masked data in model response options beside it.

Click the Enable Guardrail toggle to enable the guardrail. When enabled, all prompts routed through this policy will be inspected for sensitive data.

Define Guardrail Rules & Actions

Image of Data Protection Guardrail Dashboard to configure rules and alerts.

With the Enable Guardrail toggle enabled, configure these settings below it:

Inspect Attachments: Check this box to scan file attachments for sensitive data. Plain text, PDF, Office and image files under 100 MB are inspected. See File Attachments for the full list. When this box is clear, attachments are not scanned, even though the guardrail is enabled.

Anonymize sensitive data: When enabled, detected sensitive data is tokenized (replaced with a hash value) before being sent to the AI model. When the tokenized values are included in responses, they are automatically restored. In normal usage, the tokenization and restoration is invisible to the user.

Show masked data in model response: When enabled, the response shows the masked (tokenized) values instead of restoring the original plaintext. This option appears only while Anonymize sensitive data is checked, and clearing anonymization clears it too.

In the Rules section, define how the guardrail responds when sensitive data is detected. Click Add Action, choose Warn, Block, Route or None for the selected data types, and enter the message to display to the user when the action is triggered. You can add up to two actions, one of each type. A message is required for Warn and Block and optional for Route.

The Data Protection action menu showing None, Warn, Block and Route.

In the Generate Alert section, set up alert rules for specific data types. Click Add Rule to select from available data categories to monitor and trigger alerts when detected. Each rule has its own severity (High, Medium or Low). A data type that is already used in another rule shows as unavailable, so each data type belongs to one rule. WitnessAI maintains the list of data types, so the categories you see can vary by tenant.
Once all rules and options are configured, click Save to apply the guardrail to the policy.

💡

Note: At least one rule must be defined in the Rules section before saving.

Create Custom Data Types

In the Generate Alert section, click Add Rule, then click Add Data Type. The Select Data Types panel will slide open on the right.

Click Add Data Type button, and the ADD CUSTOM DATA TYPE panel will slide out

In the Data Type field, enter a name for your custom data type (e.g., Employee ID).

Under Expressions, click + Add Pattern to add one or more regex patterns that define what this data type looks like. Each pattern requires a confidence Score (0 to 100) that reflects how strongly a match of this regex pattern should be considered as contributing to a true detection.

You can add one or more Expressions.

Optionally, add Keywords to improve detection accuracy. Keywords are contextual terms that typically appear near the sensitive data in a prompt (e.g., “Employee ID” or a company domain). Multiple keywords can be entered as a comma-separated list.

Review the warning notice before saving: you are responsible for testing your regex patterns before deploying to production. Confirm they correctly match your intended data format and do not generate false positives or negatives.

Click Add to save the custom data type. It will now be available for selection in the SELECT DATA TYPES panel when configuring Rules and Generate Alert conditions across your policies.

View Custom Data Types

Once a Custom Data Type has been saved. It can be located in the right-side SELECT DATA TYPES slide-out panel.

To view saved Custom Data Types, click on the Add Data Type button below the Generate Alert section. The right-side panel will open. The Custom Data Types is at the top of the list of Data Types.

Click the checkbox next to the Custom Data Types label, and it will expand to show all the custom data types, and check all their checkboxes. Uncheck any you do not want to apply, then click Save.

Test the Guardrail configuration in a controlled environment to ensure it works as expected.

File Attachments Scanning & Blocking

See the File Attachments page for details.

Best Practices

User Education: Use warning messages to educate users about data security policies.
Testing: Validate the configuration in test environments before rolling out policies to all users.
Policy Documentation: Maintain detailed records of policy configurations for compliance audits.

Data Protection Guardrail Use Cases Preventing Data Leakage Redacting & Restoring Sensitive Data Routing Sensitive Data Add a Data Protection Guardrail Define Guardrail Rules & Actions Create Custom Data Types View Custom Data Types File Attachments Scanning & Blocking Best Practices