Add-on

PII protection

Keep personal data in your prompts away from the model's provider. Valefront masks it before the prompt leaves Valefront and puts it back in the reply, so your app sees no difference.

What it masks

In the messages of every chat request on a protected key, Valefront replaces these with placeholders such as VF_EMAIL_1X:

  • Email addresses
  • Phone numbers
  • Payment card numbers (checked with the Luhn checksum, so ordinary long numbers pass through)
  • API keys and secrets in common formats (sk-…, AKIA…, ghp_…, AIza…)

The model answers using the placeholders; Valefront restores the real values in the reply, streamed or not, including tool-call arguments. Web addresses (URLs) are left as they are, so agents can still open them. Names, street addresses and ID numbers are not detected by the standard mode; where Valefront offers the thorough mode, a menu next to the switch lets you choose it, at the same price.

Example. You send Email [email protected] about the refund. The provider receives Email VF_EMAIL_1X about the refund. The reply I've drafted the email to VF_EMAIL_1X reaches your app as I've drafted the email to [email protected].

Turn it on

  1. Open the API keys page on the dashboard.
  2. Switch on PII protection for the key, or tick it when you create a new key.
  3. It applies to that key's chat requests (OpenAI /v1/chat/completions and Anthropic /v1/messages) within about 30 seconds. Nothing changes in your code.

Switch it off the same way. Each key has its own setting, so you can protect only the keys that handle customer data.

Price

Add-onPrice
PII protection$0.20 per 1M input tokens

It is charged on the input (prompt) tokens of each protected request, on top of the model's price. A request with 10,000 input tokens costs $0.002 more. The current price is in llm.valefront.com/v1/pricing under addons (pii-protection).

  • Paid from credit. Free tokens never cover PII protection, even on free-tier models. A protected key with a $0.00 balance gets HTTP 402 with the code insufficient_credit: add credit, or switch PII protection off for that key.
  • On your bill. The Billing page's ledger shows it as its own line, PII protection, apart from API usage, and the Spending page lists it under Add-ons (requests, input tokens and dollars).

Speed

Masking runs inside Valefront and adds a few milliseconds to a request; restoring the reply works on the stream as it arrives.