PII detection logs

The PII log records every decision PII detection made about text users typed, in chats and in training cards, and about datasets attached in chats. Use it to find out why a message was blocked or warned, what was found, and how it was resolved. It sits in the Logs tab of Observability, next to Audit, SSO Logs, AI, Sockets and Notifications. Audit, sign-in and notification logs covers the audit and notification logs, and AI, socket and PII logs covers the AI log.

Open the PII log

1. Open Observability from the sidebar, then click Logs.
2. In the row of sub-tabs, click PII.

The sub-tab appears only if your role gives you its permission. See Permissions below.

What the table shows

Each row is one decision, with Date & Time, Outcome, User, Source, Scope, Mode, Labels, Threshold, Input Length, Context ID and Log ID.

• Source shows where the text came from: Message, Message edit, Artifact prompt or Task prompt. Text written in a training card and a dataset confirmed in a chat keep their stored origin values, training_card_description and dataset_upload.
• Scope shows what was checked: Chats or Training cards. A dataset confirmation shows file_uploads.
• Mode shows the mode the check ran in, as set in PII detection: block, warn or tokenize.
• Labels shows the kinds of personal data that were found. The column is not sortable and can be widened up to 500 px; its cell shows up to three labels with a +N counter, and the row's details list every label.
• Threshold shows the confidence cut-off that applied to the check, as a percentage.
• Input Length is the length of the text that was checked; for a dataset confirmation it is the dataset's column count. Context ID and Log ID are identifiers you can copy to cross-reference a decision.

What the outcomes mean

Investigate a blocked message

1. Open Observability > Logs > PII.
2. Set Period, then filter Outcome to blocked, or filter User to the person you are after.
3. Click the row. The PII Detection panel opens on the right; click the row again to close it.
4. Read the panel. The header shows the outcome, the mode and the threshold as a percentage. Below it: When, User, Source, Scope, Context ID, Input length and Log ID. Empty values are hidden.
5. Read Labels for every kind found, and each card under Detections ({n}) for the label, its confidence as a percentage, and a snippet with the matched text highlighted.
6. Use a copy control to copy an ID or a value; the check mark clears after two seconds.

What the snippets and percentages mean

• A snippet shows a short window of the original text around the match, about 40 characters on each side, not the whole message. The matched text is highlighted in the label's colour.
• The percentage on a detection card says how confident the check is that the match is that kind of personal data. An AI model match shows the score the model gave it; a regex match shows 100%, because a pattern either matches or it does not.
• A bypassed chat message or training card is not scanned again: instead of detections, its card shows a short preview of the text that was sent, up to the first 500 characters, under the label bypass_preview.
• Threshold is the confidence cut-off that applied when the check ran; a match below it is not counted. It is set in PII detection.

Export the log

1. Set Period, and filter or search as needed.
2. In the export control in the toolbar, pick CSV, Excel, JSON or TSV, then click the download icon next to it. Its tooltip reads Download as and the format.

• The export contains the rows that match your period, filters, sorting and search, up to 300,000 rows. When the log holds more rows than the page shows, the download first offers a choice: the rows on screen, or all rows that match. To cover more than 300,000 rows, narrow the Period or add filters, and export in parts.
• The file is named after the log and the date, for example pii_logs_2026-10-16.xlsx.
• The export control shows only if your role holds Export PII Logs. It is separate from reading the log because the file includes the detection snippets.

Periods and limits

• The Period offers Today, Last 7d, Last 30d and Custom, and starts on Last 7d.
• A custom range can span at most one year. A longer range is refused with Date range too large and the message Custom date range cannot exceed 1 year.
• Your last period and your column layout are remembered in this browser, not on your account.
• Rows per page offers 50, 100 or 200 rows, and starts at 50.
• If the log cannot load at the first attempt, the table is replaced by an Error card reading Failed to load PII detection logs with the reason. If a load fails after the table has appeared, it keeps its rows and your search text and shows a slim error bar with a Retry button. A failed refresh reads Refresh failed, and a failed export reads Export failed. See Observability troubleshooting.
• The controls behave like the rest of the section; Periods, filters and exports describes them in full.

Permissions

Questions, answered

A user says their message was blocked for personal data. Where do I see why?

Open Observability > Logs > PII, set Period, and filter User or Outcome to blocked. Open the record: its Labels and detections show what was found, and each snippet highlights the matched text.

What does bypassed mean in the PII log?

Personal data was detected, and the user chose to continue past the warning. Only users with Bypass PII Detection can do this. The attempt that was held back for the warning appears as its own row, with outcome warned.

What does declared_clean mean in the PII log?

The user confirmed that a dataset attached in a chat had no personal data, so nothing was masked from it. Only the person who uploaded the dataset can confirm this.

Why is the PII sub-tab missing although I am an Observability Administrator?

The Observability Administrator and Observability Viewer presets do not include a PII permission. Add PII Log Viewer to your role to show the PII sub-tab.

Why is the export control missing on the PII log?

Exporting needs Export PII Logs. PII Log Viewer does not add it, and it is separate from reading the log because the file includes the detection snippets. Ask an administrator for PII Log Manager or the permission.

Only part of the user's text shows in a detection. Why?

A snippet shows a short window of the original text around the match, about 40 characters on each side, not the whole message. The highlighted part is the exact match.

What does the percentage next to a detection mean?

It is how confident the check is that the match is that kind of personal data. An AI model match shows the score the model gave it; a regex match shows 100%, because a pattern either matches or it does not.

What is the Threshold column?

The confidence cut-off that applied when the check ran, shown as a percentage; a match below it is not counted. The cut-off is set in PII detection.

A user edited their message after it was flagged. Does the log show that?

Yes. The edited text is checked again, and the new decision appears as its own row with Source set to Message edit.

Does the log cover training cards?

Yes. Text written in a training card is checked while the Training Cards surface is on, and its decisions appear with Scope set to Training cards and Source set to training_card_description. See PII detection.

How do I find everything one person typed?

Filter the User column to the person and set Period to the window you need; a custom range can cover up to one year.