AI Defense Stack

GenAI data-leak prevention & privacy

Presidio: open-source PII detection and masking toolkit

Presidio is an open-source PII detection and masking toolkit from Data Privacy Stack. It is released under the MIT license and is offered as: Library, Self-hosted.

  • Last reviewed
Visit Presidio (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceMIT Layer 5: Data protection

Best for

Engineering teams that want a free, self-hosted library to detect and anonymize PII before text reaches a model or a log

Ownership

A Data Privacy Stack post (page marked last updated June 29, 2026) says the Presidio project has a new home under Data Privacy Stack, an independent, community-driven organization, and thanks Microsoft for supporting Presidio earlier. Source, checked October 21, 2026: dataprivacystack.org (opens in a new tab)

Consider instead if

  • You want a hosted guardrail API that screens prompts and responses without building your own pipeline. See Lakera Guard.

What Presidio does

Presidio is an open-source toolkit for finding and masking personal data. It has an Analyzer that identifies PII in text using recognizers built on named entity recognition, regular expressions, rules and checksums, an Anonymizer that de-identifies what the Analyzer finds, an Image Redactor that uses OCR, and a Structured module for tables and similar data. You run it yourself, as a Python library, in Docker or on Kubernetes. The project is released under the MIT license, and the docs include a LiteLLM proxy sample for masking PII in LLM calls. The docs warn that there is no guarantee it will find all sensitive information, so treat it as a building block rather than a complete data loss prevention product.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Data Privacy Stack Source, checked October 21, 2026: dataprivacystack.org (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Ownership
A Data Privacy Stack post (page marked last updated June 29, 2026) says the Presidio project has a new home under Data Privacy Stack, an independent, community-driven organization, and thanks Microsoft for supporting Presidio earlier. Source, checked October 21, 2026: dataprivacystack.org (opens in a new tab)
Open source
Yes: MIT Source, checked October 21, 2026: github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars
11,456 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 19, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
July 22, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
Library, Self-hosted Source, checked October 21, 2026: presidio.dataprivacystack.org (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: github.com (opens in a new tab)
Website
presidio.dataprivacystack.org Source, checked October 21, 2026: presidio.dataprivacystack.org (opens in a new tab)
Documentation
presidio.dataprivacystack.org Source, checked October 21, 2026: presidio.dataprivacystack.org (opens in a new tab)
API reference
presidio.dataprivacystack.org Source, checked October 21, 2026: presidio.dataprivacystack.org (opens in a new tab)
Quickstart
presidio.dataprivacystack.org Source, checked October 21, 2026: presidio.dataprivacystack.org (opens in a new tab)
Security page
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Attestations or disclosure
Vulnerabilities are reported through GitHub Private Vulnerability Reporting, not public issues Source, checked October 21, 2026: github.com (opens in a new tab)

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Presidio fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Presidio covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L5 Data Data protection Primary Keep sensitive data out of prompts, uploads, retrieval and training data, or remove and tokenize it first. Follows its category, GenAI data-leak prevention & privacy

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Presidio, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM02 Sensitive Information Disclosure Detects and anonymizes personal data in text, which can be applied before text reaches a model. Identifies PII in text with recognizers based on named entity recognition, regular expressions, rules and checksums; De-identifies detected PII in text using configurable operators; Identifies PII in structured and semi-structured data

Not mapped in our analysis: LLM07, LLM08. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in GenAI data-leak prevention & privacy, ranked within the category by Coverage Score.

Protecto

Protecto

Commercial
  • SaaS
  • On-prem
  • API

Detects sensitive data and tokenizes or masks it before it reaches LLMs, RAG pipelines and agents.

Best for: Teams that want an API that tokenizes or masks sensitive data before it reaches LLMs and RAG pipelines and restores it afterwards

Coverage Score 70 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM08 Vector and Embedding Weaknesses

Reviewed

Limina (Private AI)

Limina

Commercial Freemium Now Limina
  • Self-hosted
  • On-prem
  • API

Detects PII, PHI and PCI in text, files, images and audio in a container you run in your own environment.

Best for: Teams that need PII, PHI and PCI de-identification of text, files and audio that runs inside their own VPC or on-premises

Coverage Score 64 out of 100
  • LLM02 Sensitive Information Disclosure

Reviewed

Tonic Textual

Tonic.ai

Commercial
  • SaaS
  • On-prem
  • API
  • Library

Detects sensitive entities in text and audio, then redacts or replaces them before data reaches an LLM.

Best for: Teams preparing free text, documents or call audio for LLM training, RAG or testing that need entity-level redaction or synthetic replacement

Coverage Score 60 out of 100
  • LLM02 Sensitive Information Disclosure

Reviewed

Presidio FAQ

Is Presidio open source?

Yes. Presidio is released under the MIT license, and the code is on GitHub at data-privacy-stack/presidio.

Who maintains Presidio now?

A Data Privacy Stack post, with the page marked last updated June 29, 2026, says Presidio has a new home under Data Privacy Stack, an independent, community-driven organization, and thanks Microsoft for earlier support.

Does Presidio find all sensitive data?

No guarantee is given. The documentation says there is no guarantee that Presidio will find all sensitive information, so additional safeguards are recommended.

Key facts you can cite

We have no commercial relationship with Data Privacy Stack.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.