Every organization holds identifiers that would cause serious harm if they got out. Social Security numbers sit in payroll and benefits files, tax IDs in vendor records, and account numbers in billing systems, claims, and loan files. These are Personally Identifiable Information (PII) at its most consequential. When documents that carry them enter an AI workflow, they pass through several stages, and each stage is a place to protect them.
The risk is current. A 2025 survey of more than 400 security leaders found that 68% of organizations had experienced data leaks tied to employees sharing sensitive information with AI tools. Only 23% reported having proper AI data security policies in place.
Pensato builds secure AI around a pattern that is simple to describe. Sensitive values are detected early and swapped for secure tokens. The token vault, which matches each token to its real value, stays in your environment. A local LLM, an AI model running on hardware at your location, reads the tokens and does the work. It does not send your data to the cloud to do it, and the real numbers stay in the vault.
Before the AI reads anything
The workflow starts with intake: scanned forms, PDFs, spreadsheets, email attachments. Converting a scan to text is the moment an SSN becomes searchable and easy to copy into places it was never meant to go. Detection comes next. Pattern rules catch familiar shapes, like nine digits laid out as an SSN. Context-aware detection catches the rest, like a tax ID typed without dashes or an account number in a footnote. Each value is then masked, removed, or replaced with a secure token.
Tokens solve a problem that plain redaction creates. A blacked-out field leaves the AI guessing what was there. A token holds the field’s place, so the local LLM can tell that a field is an SSN and that it belongs to the same person named on page three. It can reason about the document correctly while the real number stays in the vault.
After the answer
When the work is done, the real values are swapped back in, inside your environment, for the people and systems entitled to see them. Everyone else continues to see the token.
Storage, logs, and retention carry as much risk as intake, and they need the same level of control. Store outputs as tokens wherever the real value adds nothing and keep audit logs with PII redacted.
What this looks like in practice
Mortgage and banking: A loan file holds an SSN on the application, account numbers on bank statements, and a tax ID on returns. An AI step that checks income documents for completeness can work entirely on tokens, and only the underwriter sees the real values. FRAME (Framework for Responsible AI in Mortgage Ecosystems) carries the governance side of this work.
Law: A client matter can span thousands of pages with SSNs, account numbers, and birth dates scattered through them. A local LLM can sort the documents and surface the relevant passages while identifiers stay tokenized, and the real values reach only the attorneys on the matter.
Life sciences: Trial and patient records pair names and participant IDs with health details. A local LLM can check tokenized records for consistency and missing fields, and real identities stay with the study team.
The rules point the same way
GDPR Article 32 requires controllers and processors to put technical and organizational measures in place that are appropriate to the risk, and it lists pseudonymization and encryption as examples. California’s CCPA, as amended by the CPRA, requires covered businesses to use reasonable security procedures and practices suited to the nature of the personal information. For U.S. mortgage lenders and brokers, the FTC’s Safeguards Rule under the Gramm-Leach-Bliley Act requires encryption of customer information in transit over external networks and at rest. This is general information, and each organization should confirm its own obligations with counsel.
An SSN that becomes a secure token at intake stays protected through the stages. Run that on local AI, with a local LLM inside your environment, and protecting PII becomes part of the design.
We are building Pensato so your PII stays local from the start. See how we tokenize PII before the AI reads it →