PII Protection &
Secret Detection
AI agents process sensitive data at machine speed. INS scans every request and response bidirectionally, recognizing 10+ categories of PII and 20+ classes of secrets and credentials, and automatically redacts sensitive information before it leaves your perimeter.
Why AI Agents Need PII Protection
When AI agents interact with MCP tools, they routinely process database records, API responses, file contents, and user messages that may contain personally identifiable information. An agent querying a customer database might receive Social Security numbers, credit card details, or medical records in the response, then inadvertently include that data in subsequent tool calls or logs.
Similarly, tool responses often contain secrets that should never leave the server environment: API keys embedded in configuration files, database connection strings with passwords, or authentication tokens in response headers. Without gateway-level scanning, these secrets flow freely through agent workflows.
INS addresses this by operating as a bidirectional filter. It scans data flowing from agents to MCP servers (outbound) and from MCP servers back to agents (inbound), ensuring that sensitive data is caught regardless of direction.
10 PII Types Detected
INS identifies and redacts personally identifiable information across 10+ PII categories using high-accuracy detection tuned to minimize false positives.
Credit Card Numbers
Visa, Mastercard, Amex, Discover — formatted and unformatted
Social Security Numbers
US SSN in both hyphenated (XXX-XX-XXXX) and compact formats
Email Addresses
RFC-compliant detection across all TLD formats
Phone Numbers
International formats with country code support
Medicare IDs
Healthcare identifier detection for HIPAA compliance
Dates of Birth
Multiple date formats with context awareness
Bank Account Numbers
IBAN, routing numbers, and account identifiers
Driver's License
US state format detection and validation
Passport Numbers
US-format passport number detection
IP Addresses
IPv4 address detection with range validation
Comprehensive Secret & Credential Coverage
INS detects API keys, tokens, and credentials from major cloud providers and SaaS platforms, using provider-specific format recognition for high-accuracy results.
Cloud Provider Credentials
- AWS Access Keys & Secret Keys (AKIA prefix detection)
- Azure Subscription Keys & Connection Strings
- Google Cloud API Keys & Service Account Keys
- Generic API Keys & Bearer Tokens
SaaS Platform Tokens
- GitHub Personal Access Tokens (ghp_ prefix)
- Slack Bot & Webhook Tokens (xoxb, xoxp prefixes)
- Stripe API Keys (sk_live, sk_test prefixes)
- OpenAI API Keys (sk- prefix detection)
Infrastructure Secrets
- Private Keys (RSA, ECDSA, ED25519 PEM blocks)
- JWT Tokens (eyJ prefix detection)
- Generic API Key Assignments (key=, token= patterns)
- Microsoft Teams Webhooks
Additional Platforms
- Anthropic API Keys (sk-ant prefix)
- HuggingFace Tokens (hf_ prefix)
- GitLab Personal Access Tokens & Session Cookies
- GitHub Fine-Grained PATs, App Tokens & OAuth Tokens
Automatic Redaction
When INS detects sensitive data, it does not just alert; it acts. Detected PII and secrets are automatically redacted and replaced with type-safe placeholders before the data passes through the gateway. A Social Security number becomes [SSN REDACTED], an API key becomes [API_KEY REDACTED].
This approach preserves the structure of the data while removing the sensitive content. AI agents continue to function normally because they receive valid responses with clear indicators of where redaction occurred. The original sensitive values are never logged, cached, or stored by the gateway.
Bidirectional Scanning
INS scans data in both directions. Outbound scanning catches sensitive data that agents might inadvertently send to MCP servers, such as user-provided credentials in tool call parameters or PII embedded in natural language queries.
Inbound scanning catches sensitive data returned by MCP servers, including database query results with customer records, file contents with embedded passwords, or API responses containing tokens. This dual coverage ensures no sensitive data escapes regardless of its origin.
Built for Compliance
INS PII protection is designed to help organizations meet regulatory requirements when deploying AI agents that process personal or sensitive data.
GDPR
Automatic PII detection and redaction supports data minimization principles. Audit logs provide the processing records required by Article 30.
SOC 2
Secret detection and credential leak prevention map to SOC 2 Type II controls for confidentiality and data processing integrity.
HIPAA
Medical record number detection and automatic redaction help maintain Protected Health Information safeguards in healthcare AI workflows.
How It Works
Intercept
All request and response payloads are captured at the gateway layer before reaching their destination.
Detect
High-accuracy detection scans every field for PII, API keys, tokens, and private keys across dozens of categories.
Redact
Sensitive values are replaced with type-safe placeholders. Original data is never stored or logged by the gateway.
Audit
Every detection is logged with timestamp, type, location, and redaction status for compliance reporting.
Stop Data Leaks Before They Start
Join the waitlist to protect your AI agent workflows with automatic PII redaction and secret detection. Stay compliant while scaling your MCP infrastructure.
Join the Waitlist