Prohibit PII transmission

Prohibit PII transmission is a company setting on DataMind Platform. With it on, the platform checks every request made with your company's API key before it reaches a model, and a request that carries personal data is refused. It applies to your applications' calls through the API and to the AI features of DataMind OS.

Turn the policy on

1. Open Settings in the console.
2. On the Company card, click Edit details.
3. In the Edit company dialog, turn on Prohibit PII transmission and click Save changes.

The Company card shows the current state next to your region: PII blocked or PII off. The dialog describes the option as: "Proxy rejects requests that match PII detectors before upstream."

What the check covers

The check runs on everything you send with the company's API key:

• the text of every chat message, in plain text and in text blocks;
• tool-call arguments recorded in a conversation;
• embedding input;
• web search queries;
• web read URLs;
• the questions sent through the Docs tab.

It detects five kinds of personal data: email addresses, Georgian mobile numbers, payment card numbers, IBANs and Georgian personal ID numbers.

Tool definitions are not checked. The static descriptions of the tools an application offers a model stay outside the check.

A blocked request

When the check finds personal data, nothing is forwarded. The request is refused with:

• Status: 400
• Code: content_filter
• Message: PII detected in request: <TYPE> (<count>), ... This company's policy prohibits PII transmission to upstream providers; the request was not forwarded.

The message names the kinds of data found and how many of each, never the values. A blocked request uses no tokens and does not appear in your Usage log. While the policy is on, prompt and answer content is kept out of your usage data, even for requests that are forwarded. The full lists of statuses and codes are on Errors and retries.

Questions, answered

Is the policy on by default?

No. It is off until an Administrator turns it on. The Company card in Settings shows the current state.

Who can change the setting?

An Administrator. Every member of the company sees the state on the Company card, but changing it needs the Administrator role.

Is the whole conversation checked, or only my newest message?

The whole request. Every message in the conversation is checked, and so are the tool-call arguments recorded in it.

Can it replace the personal data and send the request anyway?

No. The check has one outcome: a request that matches is refused. Nothing is forwarded, and no masked or edited copy is sent in its place.

Are the model's answers checked too?

No. The check runs on your request before it is forwarded to a model. What a model returns is not scanned.

Can I exclude one application, one person or one request?

No. It is a company-wide setting covering every request made with the company's API key. A single caller or request cannot skip the check.

Are prompt and answer contents kept with my usage data?

Not while the policy is on. Prompt and answer content is kept out of your usage records, and a blocked request leaves no record at all.

Does the error message show the values it found?

No. The message names the kinds of data and how many of each, never the values.