How to redact PII from LLM prompts in Python

Why does my Python app leak PII to LLM providers?

Because that is the default. Whatever string you pass to the OpenAI or Anthropic client goes to their servers verbatim, and user input carries names, emails, and pasted card numbers more often than anyone expects.

The fix is a redaction step in the request path: swap personal values for tokens before the call, swap them back in the reply. This post shows how in Python; the background and the tool landscape are in the complete guide.

Install

pip install sether

# or with the wrapper for your LLM client:
pip install "sether[openai]"
pip install "sether[anthropic]"
pip install "sether[httpx]"

The base package is sether on PyPI, currently v0.1.1, supporting Python 3.9+. Phone detection uses the phonenumbers package, the Python counterpart of the libphonenumber-js dependency in the TypeScript build.

The redact-then-restore round trip

from sether import Sether

sether = Sether()

user_message = "Hi, I'm Sarah, my email is sarah@acme.com"

safe = sether.redact_sync(user_message)
# -> "Hi, I'm Sarah, my email is <EMAIL_uuid>"

reply = call_openai(safe)               # your existing call

restored = sether.restore_sync(reply)   # real values back

The rule that trips people up: the same instance must handle both directions. Redacting stores the token-to-value mapping in a vault on the instance, and restoring reads it back. A fresh instance has an empty vault and will leave tokens in the output.

Why the design works this way, and what the vault stores, is covered in Reversible PII redaction: how redact-then-restore works.

Which integration path should I use?

The wrappers redact on the way in and restore on the way out, so existing call sites do not change. The extras only pull in the client library they wrap; the base install stays small.

How do I cover a whole FastAPI or Flask app?

If your service proxies user text to an LLM from several routes, wrapping each call site gets tedious. SetherASGIMiddleware sits in your ASGI middleware stack instead, so request bodies are redacted before your route handlers see them and responses are restored on the way back out.

Place it like any other ASGI middleware in FastAPI, and scope it to the routes that forward text to a provider rather than your whole API. SetherWSGIMiddleware does the same job for Flask and other WSGI apps. Both ship in the base package with no extra dependency.

Does it handle streaming responses?

Yes, both sync and async streaming. This matters because streaming is where naive redaction silently fails: a value split across two chunks passes a per-chunk regex on both sides.

Sether holds back a small window of bytes until it can prove no match spans the chunk boundary. The failure mode, and how we caught it in testing before release, is written up in the chunk-boundary bug post.

What do tokens and the vault look like?

Tokens are typed: <EMAIL_uuid>, <PHONE_uuid>, and so on, with a fresh identifier per value. The type prefix keeps the model reasoning normally; the identifier is meaningless to anyone without your vault.

The vault is in-memory by default and stays inside your process. It never leaves your infrastructure, so the mapping between tokens and real values exists only where you run the code.

What gets detected?

• Basic pack (default): email, phone (via phonenumbers), credit card with Luhn validation, SSN, IPv4, IPv6, IBAN with mod-97 validation.
• Secrets pack (opt-in): AWS access keys, OpenAI keys, Anthropic keys, GitHub PATs, Slack tokens, Stripe keys, JWTs, and high-entropy strings (Shannon entropy of 3.5+ bits per character).
• Identity pack (opt-in): label-anchored name, date of birth, passport, and address, with labels recognised across Latin, CJK, Cyrillic, and Arabic scripts.

How do I test it?

Assert the round-trip property: restoring a redacted string returns the original exactly. Also assert the redacted form no longer contains the raw value.

from sether import Sether

def test_round_trip():
    sether = Sether()
    original = "Reach me at sarah@acme.com or +14155552671"

    redacted = sether.redact_sync(original)
    assert "sarah@acme.com" not in redacted
    assert "+14155552671" not in redacted

    restored = sether.restore_sync(redacted)
    assert restored == original

Limitations and maturity, honestly

The Python package is a port of the TypeScript original, which is further along. Same design, same token format, same detector philosophy, but at v0.1.1 it is the younger sibling, and some features land in the TypeScript package first.

• Free-text names ("tell Chidi I sent it") are out of scope for pattern and label detection. That class needs NER; see Regex vs NER for PII detection.
• The default vault is in-memory, so redact and restore must happen in the same process unless you plug in a shared store.
• Redaction is a technical measure that helps with data minimisation. It is not a compliance certificate on its own.

Docs live at /docs/python, the source is at github.com/raeven-co/sether, and you can try detection in the browser sandbox first.