What Is PII Redaction and Why Does It Matter for Chatbots?

PII redaction means automatically removing personal data, such as email addresses, card numbers and ID numbers, from chat messages before they are stored or processed. Support conversations attract exactly this kind of data, because people paste whatever they think will help. EquilAI redacts it automatically, on by default, so personal data that never needed to be kept is never kept.

What Counts as PII in a Chat?

Anything that identifies a person. In real support conversations the usual suspects are email addresses, phone numbers, payment card numbers and national identity numbers. Customers volunteer these constantly, even when nobody asked: they paste an email address and a card number just in case it helps the bot check their order faster.

Under the GDPR, storing personal data you do not need is a liability, not an asset. The cleanest way to reduce that liability is to make sure the data never enters your systems at all.

What Does EquilAI Redact?

• Email addresses.
• Payment card numbers, validated with a checksum first, so genuine card numbers are removed while ordinary long numbers like order ids and tracking codes pass through untouched.
• National identity numbers in several formats, including Finnish and other Nordic personal identity codes, US social security numbers, UK national insurance numbers and Canadian social insurance numbers.
• Phone numbers, in both compact and formatted international forms.

Each match is replaced with a neutral placeholder such as [REDACTED_EMAIL], so the conversation still reads sensibly and the assistant still understands what the customer meant.

Where Does the Redaction Happen?

In three places, on purpose:

1. In the visitor's browser. The website widget redacts messages on the visitor's device, before anything is sent. The personal data never crosses the network and never reaches EquilAI's servers in the first place.
2. On the server. Messages arriving through the REST API and channel integrations are redacted server-side, before they are stored and before they are passed to the language model.
3. On attachments. The filename of every uploaded file and the text extracted from PDF documents pass through the same redaction before storage, so a card number inside a sent document is caught just like one typed into the chat.

The extra layers matter because they protect every path into the system, not just the widget.

Is Redaction Alone Enough for GDPR?

No. Redaction is pattern-based: it catches the structured identifiers listed above, not every conceivable personal detail someone might type in free text. It is one layer in a bigger posture that includes encrypted storage of secrets, EU hosting, data minimisation and the principle that customer data is never used to train models. What redaction does is remove the most common and most sensitive identifiers automatically, at scale, without anyone having to remember to do it.

Do You Need to Configure Anything?

No. Redaction is on by default for every bot, in the widget and on the server. It is the kind of protection that works best precisely because nobody has to think about it.