AI Defense Stack

GenAI data-leak prevention & privacy

Google Cloud Sensitive Data Protection: cloud API to find and de-identify sensitive data

Google Cloud Sensitive Data Protection is a cloud API to find and de-identify sensitive data from Google Cloud. It is a commercial product offered as: Cloud-native, API. Pricing model: usage-based.

  • Last reviewed
Visit Google Cloud Sensitive Data Protection (opens in a new tab) Documentation (opens in a new tab)
Commercial Renamed Layer 5: Data protection

Best for

Google Cloud teams that want an API to detect and de-identify sensitive data before it reaches storage, analytics or LLM prompts

Ownership

Google's release notes page states that Cloud Data Loss Prevention (Cloud DLP) is now a part of Sensitive Data Protection and that the API name remains the same. Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)

Consider instead if

  • You want a free open-source library for PII detection and masking that you host yourself. See Presidio.

What Google Cloud Sensitive Data Protection does

Sensitive Data Protection is Google Cloud's managed service for finding, classifying and de-identifying sensitive data, and it now includes Cloud Data Loss Prevention. You use it from the Google Cloud console or the DLP API. Detection uses built-in infoType detectors or custom detectors you create from dictionaries or regular expressions. De-identification can mask, redact, replace, shift dates or pseudonymize values, and image redaction covers matches found with OCR. Discovery profiles BigQuery, Cloud SQL, Cloud Storage and Vertex AI training data. The docs list inspecting and redacting LLM prompt inputs as a use case. It is a closed-source Google Cloud service. The docs say discovery is charged by pricing mode, and we could not read the pricing page, so check Google for prices.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Google Cloud Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Status
Renamed Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Ownership
Google's release notes page states that Cloud Data Loss Prevention (Cloud DLP) is now a part of Sensitive Data Protection and that the API name remains the same. Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Latest release
October 9, 2026 Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Deployment
Cloud-native, API Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Pricing model
Usage-based Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Website
cloud.google.com Source, checked October 21, 2026: cloud.google.com (opens in a new tab)
Documentation
docs.cloud.google.com Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
API reference
docs.cloud.google.com Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Quickstart
docs.cloud.google.com Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Google Cloud Sensitive Data Protection fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Google Cloud Sensitive Data Protection covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L5 Data Data protection Primary Keep sensitive data out of prompts, uploads, retrieval and training data, or remove and tokenize it first. Follows its category, GenAI data-leak prevention & privacy

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Google Cloud Sensitive Data Protection, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM02 Sensitive Information Disclosure Detects and de-identifies sensitive data, including in LLM prompt inputs, before it is stored or shared. Detects sensitive data with built-in infoType detectors or custom infoType detectors you create from dictionaries or regular expressions; De-identifies data by masking, redaction, replacement, bucketing, date shifting and tokenization; Pseudonymizes values with reversible deterministic or format-preserving encryption, or one-way cryptographic hashing; Lists inspecting and redacting LLM prompt inputs before storage as a use case

Not mapped in our analysis: LLM07, LLM08. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in GenAI data-leak prevention & privacy, ranked within the category by Coverage Score.

Protecto

Protecto

Commercial
  • SaaS
  • On-prem
  • API

Detects sensitive data and tokenizes or masks it before it reaches LLMs, RAG pipelines and agents.

Best for: Teams that want an API that tokenizes or masks sensitive data before it reaches LLMs and RAG pipelines and restores it afterwards

Coverage Score 70 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM08 Vector and Embedding Weaknesses

Reviewed

Presidio

Data Privacy Stack

Open sourceMIT
  • Library
  • Self-hosted

Finds and masks personal data in text, images and structured data, and you run it yourself.

Best for: Engineering teams that want a free, self-hosted library to detect and anonymize PII before text reaches a model or a log

Coverage Score 67 out of 100
  • LLM02 Sensitive Information Disclosure

Reviewed

Limina (Private AI)

Limina

Commercial Freemium Now Limina
  • Self-hosted
  • On-prem
  • API

Detects PII, PHI and PCI in text, files, images and audio in a container you run in your own environment.

Best for: Teams that need PII, PHI and PCI de-identification of text, files and audio that runs inside their own VPC or on-premises

Coverage Score 64 out of 100
  • LLM02 Sensitive Information Disclosure

Reviewed

Google Cloud Sensitive Data Protection FAQ

Is Cloud DLP the same as Sensitive Data Protection?

Google's release notes say Cloud Data Loss Prevention (Cloud DLP) is now a part of Sensitive Data Protection and that the API name remains the same.

Does it handle images?

Yes. The docs describe image redaction that uses OCR to find text and covers matches with opaque rectangles. They say content redaction is not supported for SVG, PDF, XLSX, PPTX or DOCX files.

What does it cost?

The docs say discovery is charged according to a discovery pricing mode. We could not read the vendor's pricing page text, so no prices are recorded here. Check Google Cloud for current pricing.

Key facts you can cite

We have no commercial relationship with Google Cloud.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.