Sanitization and DLP for AI

Structured identifiers

ARC1’s detection packs find structured identifiers in three categories. Health: labeled medical record numbers, NPI and DEA numbers, Medicare Beneficiary Identifiers, labeled plan and member IDs, labeled diagnosis codes and dates of birth. Personal: Social Security numbers and ITINs, payment card numbers, IBANs, email addresses, phone numbers, and labeled passport and driver’s license numbers. Credentials: private keys, cloud and model-provider API keys, access tokens and passwords inside URLs.

The managed gate on Claude Code and Codex blocks a prompt or tool call, or redacts a tool call’s input when the person approves the rewrite; Codex blocks instead. Kong blocks, and redaction there needs Kong Enterprise. Azure API Management and LiteLLM can block or redact. The ARC1 Gateway replaces supported identifiers on the request and blocks what it cannot inspect or safely rewrite. Gateways cannot validate a number the way the managed gate can, so their patterns match more broadly.

Narrative text

Names, addresses and clinical narrative are not structured identifiers, and ARC1’s own packs do not detect them. For narrative text, the ARC1 Gateway calls an external DLP service the customer runs, bound by two-person approval: Microsoft Presidio, Google Cloud DLP or Microsoft Purview. The call comes before any budget is reserved or the request is dispatched, and a timeout, a changed binding or a malformed answer fails closed.

Exact data match LAB

Exact data match protects the values a company actually holds: member names, member IDs, medical record numbers and dates of birth from its own roster. The customer hashes the roster on its own machine with a salt that never leaves it. The hub learns only the index’s digest and size and, for each request, whether something matched and in which field.

On a synthetic 10,000-member roster it found 10,000 of 10,000 names, member IDs, record numbers and dates of birth, flagged none of 1,000 non-member cases, and took 0.18 milliseconds per request at the 95th percentile. One limit is deliberate: a name made only of ordinary English words, typed in lower case with nothing beside it, is recorded, not blocked.

Prompt injection LAB

The injection detector weighs where text came from. An instruction to ignore earlier instructions is a warning in a user’s own turn and is blocked inside a tool result. The detector permits, warns or blocks and never rewrites. Its recall is modest and we publish it: at the blocking threshold it caught between 1.7% and 31.7% of attacks across four public test sets, and it blocked 15 of 2,400 benign web pages.

Privacy canaries LAB

Every hour a canary sends one synthetic sensitive case through each surface’s own path (the ARC1 Gateway, the managed gate, external DLP, Kong, LiteLLM and Azure API Management) and signs the outcome: held, missed, misrouted, drifted or unreachable. Anything but held raises an alert. A canary shows that a control acted on that case in that hour. It does not show coverage.

Published miss rates LAB

Our evaluation runs a fixed synthetic corpus of 199 cases through each point and signs the results. The first run:

The structured pack found no names, and Presidio found every name and none of the Social Security or record numbers. No structured scanner caught any of the 35 injection and jailbreak cases. That is why we pair the two kinds of detector.

The response side NEXT

Inspection of model responses and tool results is not built. On the managed gate today, a tool result or a file a tool reads reaches the next model request unscanned. Response-side inspection, with a holdback for streamed answers, is next.

Where it stands

LIVE: in the released product and running on our hosted production deployment, with synthetic data. LAB: built or being built, and run only in our lab or against a vendor’s documented interface. NEXT: designed, not yet built. How we use these words.