Layer 5 of 8, Protect what runs

Data protection: keep sensitive data out of prompts and training sets

This layer keeps sensitive data out of prompts, uploads, retrieval and training data, or masks, redacts or tokenizes it before a model sees it.

10 tools + 17 also cover it
Last reviewed October 21, 2026

See the tools How the eight layers work

Executive summary

What it is: This layer keeps sensitive data out of prompts, uploads, retrieval and training data, or masks, redacts or tokenizes it before a model sees it.
The risk: Staff pasting or uploading regulated data into AI apps, applications sending personal data to model providers, sensitive records in training and retrieval sets, and secrets left in prompts and agent memory.
What to buy or do: For staff use, add browser or prompt DLP that can warn, coach or block. For your own apps, put PII redaction or tokenization in the request path and before training. First check whether your guardrail or gateway already redacts PII.

Our analysis Our editorial model, not a standard: OWASP, MITRE and NIST did not create or endorse it. Layer placements are our analysis, based on documented capabilities. How the model works.

The question this layer answers

What sensitive data reaches AI tools and models, and can we block, mask or tokenize it first?

Budget line
Data loss prevention for AI (browser and endpoint DLP, prompt inspection), PII redaction services and tokenization vaults, usually in the data security budget.

What it protects against

Our analysis

Staff pasting or uploading sensitive data into AI apps, sanctioned or not
Applications sending personal or regulated data to models
Sensitive data in training, fine-tuning and retrieval sets
Re-identification of masked data
Secrets in prompts and agent memory

Typical controls

Our analysis

Prompt and upload inspection
Browser DLP with warn, coach or block
PII detection with custom entity types
Redaction, masking and synthetic replacement
Tokenization and vaults with role-based re-identification
Image redaction
Data policies by user, app and data type
Audit of AI interactions

How it maps to standards

Source states means the framework's own text names the control or outcome this layer delivers. Our analysis means we drew the link. OWASP LLM ids are the 2025 edition; the ATLAS hub holds the MITRE data version.

Data protection: standards entries, basis, where the source says it and how it applies
Framework	Entry	Basis	Where the source says it	How it applies
OWASP LLM Top 10 (2025)	LLM02 Sensitive Information Disclosure	Source states	Prevention list	Scrub or mask sensitive content before training, and use tokenization and pattern-based redaction before the model processes content.
OWASP LLM Top 10 (2025)	LLM08 Vector and Embedding Weaknesses	Source states	Prevention list	Tag and classify data to control access.
OWASP LLM Top 10 (2025)	LLM07 System Prompt Leakage	Our analysis	Related: prevention list	Finding secrets before they reach prompts. OWASP says to keep credentials out of system prompts.
OWASP Agentic Top 10 (2026)	ASI06 Memory & Context Poisoning (opens in a new tab) OWASP relates it to LLM01, LLM04, LLM08.	Source states	Mitigations 1, 2, 3, 4	Encryption and least-privilege access, scanning memory writes for sensitive content, memory segmentation, and minimizing retention by data sensitivity.
MITRE ATLAS	AML.M0019 Control Access to AI Models and Data in Production	Our analysis	Not named by the source	Vaults and role-based re-identification control who sees data.
MITRE ATLAS	AML.T0057 LLM Data Leakage	Our analysis	Not named by the source	Leakage of sensitive data through model output.
MITRE ATLAS	AML.T0086 Exfiltration via AI Agent Tool Invocation	Our analysis	Not named by the source	Leakage of sensitive data through agent tool calls.
NIST AI RMF	MEASURE Measure (opens in a new tab)	Our analysis	Related: MEASURE 2.10	Data protection controls reduce the privacy risk that MEASURE 2.10 asks you to examine and document.
NIST AI RMF	MANAGE Manage (opens in a new tab)	Our analysis	Related: MANAGE 1.3	Responses to high-priority risks are developed and documented, and data controls are one response.

Tools in this layer (10)

Tools whose category is GenAI data-leak prevention & privacy, listed by name. Compare them with Coverage Scores on the Data protection hub.

Google Cloud Sensitive Data Protection

Google Cloud · cloud API to find and de-identify sensitive data

Commercial Renamed
Harmonic Security

Harmonic Security · workforce AI usage and data protection service

Commercial
Limina (Private AI)

Limina · container PII detection and redaction engine

Commercial Freemium Now Limina
Microsoft Purview Data Security Posture Management (DSPM) for AI

Microsoft · cloud data security posture service for AI use

Commercial Renamed
Nightfall AI

Nightfall · data loss prevention platform for AI and SaaS

Commercial
Presidio

Data Privacy Stack · open-source PII detection and masking toolkit
11,456 GitHub stars as of Oct 21, 2026; last push Oct 19, 2026

Open sourceMIT
Protecto

Protecto · data control plane for AI privacy

Commercial
Skyflow

Skyflow · data privacy vault with LLM data protection

Commercial
Tonic Textual

Tonic.ai · PII redaction and synthesis tool for free text

Commercial
WitnessAI

WitnessAI · AI activity control and data protection platform

Commercial

Also cover this layer (17)

Our analysis Tools from other categories that document a capability in this layer. Each row names the layer the tool belongs to first and the documented capability our placement rests on.

Tools from other categories that also cover Data protection, with the capability each placement rests on
Tool	Its primary layer	How it applies	Based on
Alice WonderSuite	L6 Runtime	Lists PII masking among the detectors a customer policy can use.	Policy detectors include PII masking
Amazon Bedrock Guardrails	L6 Runtime	Documents masking of personal data in prompts and responses.	Blocks or masks PII and custom regex patterns in inputs and responses
CalypsoAI (F5 AI Guardrails)	L6 Runtime	Documents controls for personal data leakage and semantic data security.	Controls PII leakage and applies semantic data security for standard and custom categories
Cisco AI Defense	L6 Runtime	Documents screening of prompts and responses for PII, PCI and PHI.	Screens for PII, PCI and PHI leakage in prompts and responses
Cloudflare AI Gateway	L6 Runtime	Documents scans of prompts and responses for personal and other sensitive data.	Scans prompts and responses for PII and other sensitive data and flags or blocks matches
Cloudflare Firewall for AI (AI Security for Apps)	L6 Runtime	Documents detection of personal data in prompts.	Detects PII such as phone numbers, email addresses and card numbers in incoming prompts
Google Cloud Model Armor	L6 Runtime	Documents detection and redaction of personal data through Sensitive Data Protection.	Detects and can redact PII and other sensitive data with Sensitive Data Protection
HiddenLayer AI Runtime Security (AIDR)	L6 Runtime	Documents blocking or redaction of sensitive data.	Blocks or redacts sensitive information exposed in model interactions
Kong AI Gateway44,287 GitHub stars as of Oct 21, 2026; last push Oct 19, 2026	L6 Runtime	Documents an AI Sanitizer plugin that redacts personal data in prompts.	Redacts PII from prompts before they reach the upstream LLM provider with the AI Sanitizer
Lakera Guard	L6 Runtime	Documents protection of personal and other sensitive data from leaking.	Protects personally identifiable information and other sensitive data from leaking
Lasso Security	L6 Runtime	Documents a data loss prevention policy that blocks or masks sensitive data.	Blocks, masks or alerts on sensitive data under data loss prevention policies
NVIDIA NeMo Guardrails7,341 GitHub stars as of Oct 21, 2026; last push Oct 22, 2026	L6 Runtime	Documents masking of personal data.	Detects and masks personal data in inputs, outputs and retrieved content
Pangea AI Guard	L6 Runtime	Documents redaction of personal and other sensitive data with a PII detector.	Redacts PII and sensitive data with a Confidential and PII detector; Redaction actions for PII, secrets and custom entities: replacement, mask, partial mask, salted hash or reversible format-preserving encryption
Portkey AI Gateway13,245 GitHub stars as of Oct 21, 2026; last push May 25, 2026	L6 Runtime	Documents PII redaction that replaces detected personal data with identifiers before a request reaches the model.	Checks model output for PII leaks; Redacts detected PII from requests before they reach the model, replacing each item with a standardized identifier
Prompt Security	L6 Runtime	Documents redaction of sensitive data across AI services.	Redacts sensitive data and enforces policies across more than 15,000 AI services
Radware LLM Firewall	L6 Runtime	Detects PII in prompts and responses and masks, blocks or logs it, which also places it in data protection.	Detects and masks, blocks or logs PII in prompts and responses, and blocks attempts to extract PII before it reaches the LLM
LLM Guard3,217 GitHub stars as of Oct 21, 2026; last push Jul 8, 2026 archived	L6 Runtime	Documents anonymization of personal data in prompts and detection of secrets.	Anonymizes personal data and detects secrets in prompts, and restores values in output with a Deanonymize scanner

Gaps we can see

Only 3 tools (Protecto, Pangea AI Guard, Lakera Red) are mapped to OWASP LLM08 Vector and Embedding Weaknesses. No listed tool documents posture checks of vector store access.

What this layer will not do

Detection by pattern or classifier misses data it was not built to recognize, such as your own customer or account identifiers, so add custom entity types and measure misses on your own data. Each control protects only the traffic it sees: a browser extension does not see API calls, and an API redaction service does not see staff on a personal device. Tokenized data can be turned back into real values by anyone with re-identification rights, so those rights need their own access control. OWASP's LLM08 page asks for permission and access control on vector stores, which this layer supports through classification but does not replace.

Related guides

Data protection FAQ

Do we need a separate DLP product if our guardrail redacts PII?

Not always. Several guardrails and AI gateways in this directory also cover this layer through PII redaction in the request path, and this page lists them with the capability each placement rests on. A dedicated product adds what an inline filter does not: browser and upload controls for staff, tokenization vaults with controlled re-identification, or redaction before training.

What does OWASP recommend for sensitive data?

Source states: the OWASP LLM02 page lists data sanitization so user data does not enter training, tokenization and redaction of sensitive information, access limited by least privilege, guidance for users on what not to enter, and clear policies on data retention, usage and deletion. Sanitization and tokenization are this layer; the policies and user guidance sit in governance (layer 1).

Should we redact or tokenize?

They solve different problems. Redaction removes or replaces the data, so the model and its logs never hold it. Tokenization swaps the data for tokens that authorized users or systems can map back, which keeps workflows that need the real value. Our analysis: redact when nobody needs the value back, and tokenize when an approved step does.

Framework sources & last reviewed

Last reviewed October 21, 2026. We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.

Drafted with AI assistance; facts checked against primary sources on October 21, 2026.

OWASP Top 10 for LLM Applications 2025 (list page) (1 sources)