PII Redaction

NanoGPT supports optional PII redaction for API and web chat requests. When redaction is enabled, personal information in your request is replaced with placeholders and the real values are put back into the response. PII redaction is opt-in. You choose between two providers:

	Tinfoil	Grepture
Price	$0.00021 per detection call plus $0.84 per million input tokens, so the charge depends on how much new text a request carries. One call scans up to about 35,000 tokens (about 25,000 words), and overlapping text submitted across calls is counted again. Text scanned in the last 3 days is not scanned or charged again. See Pricing	$0.0005 per request, whatever its size
What sees placeholders	Everything after detection: the model provider, context memory, web search, moderation, fallbacks and retries	The model provider only; context memory and web search receive the original text
Where detection runs	Tinfoil’s privacy-filter enclave. NanoGPT verifies the enclave’s attestation (its hardware report and the published, signed code it runs) and encrypts the text so that only that code can read it	Grepture’s proxy, which receives the request and response
Detection	More thorough, plus deterministic checks for emails, IBANs, cards, IP addresses, profile links and secrets	Fewer categories caught

Tinfoil is the default in web chat and for new setups, and Grepture is opt-in. An account or API key default turned on before November 6, 2026 with no provider chosen stays on Grepture for now. In web chat, you may need to choose Grepture again. This is useful when you want to keep personal or sensitive data away from model providers and other services while still getting a useful final answer.

How Redaction Works

With Tinfoil:

The user sends a request to NanoGPT.
NanoGPT sends the request’s text, encrypted, to the attested Tinfoil privacy filter, which returns where personal information appears.
NanoGPT replaces each value with a placeholder such as ⟦PERSON_k3x9q⟧. The same value keeps the same placeholder throughout a conversation.
Memory, web search, moderation and the model see only placeholders.
NanoGPT restores the placeholders in the response, including streamed responses and tool-call arguments.
NanoGPT returns the final response to the user.

Simple flow:

User -> NanoGPT -> (encrypted) Tinfoil privacy filter
             NanoGPT -> placeholders -> memory / search / model
User <- restored response <- NanoGPT

NanoGPT’s own servers still receive your request as you sent it, as they do without redaction. With Grepture, NanoGPT sends the provider request through Grepture’s proxy, which replaces personal information before the model provider sees it and restores it in the response. Context memory, web search and inline moderation run on the original text. Credential-like secrets are handled differently from normal PII. API keys, tokens, private keys, passwords and similar secrets are replaced with placeholders and are not restored into the response. This is intentional: a credential should never reach a provider, and the model’s output should not echo it.

Supported API Endpoints

PII redaction can be enabled on:

POST /v1/chat/completions
POST /v1/completions
POST /v1/messages
POST /v1/responses
POST /v1/decisions

On Decisions, Tinfoil redaction covers state and each question’s instructions and criteria, including choice option names, and answers come back with the original names. Tinfoil-hosted decision models (vllm-sr/decision-large, vllm-sr/decision-medium, vllm-sr/decision-small; the earlier decision-large, decision-medium and decision-small IDs remain accepted) already run in an attested enclave and do not support redaction. Responses API requests that need OpenAI’s built-in tools (web search, file search, computer use and similar) are always redacted through Grepture and billed at its price, whichever provider you chose.

Enable With API Headers

Pass any one of these headers with a truthy value:

Header	Recommended
`redaction: true`	Yes
`redacted: true`	No
`piiredaction: true`	No
`piiredacted: true`	No

Truthy values accepted by the API:

true
1
yes
on
tinfoil (also chooses Tinfoil for this request)
grepture (also chooses Grepture for this request)

Recommended header:

redaction: tinfoil

true and the other truthy values use the provider set on your API key, then your account (Settings > Privacy), then Tinfoil. An older account or API key default with no provider chosen keeps Grepture.

Chat Completions Example

curl https://api.nano-gpt.com/api/v1/chat/completions \
  -H "Authorization: Bearer $NANOGPT_API_KEY" \
  -H "Content-Type: application/json" \
  -H "redaction: tinfoil" \
  -d '{
    "model": "openai/gpt-5.5",
    "messages": [
      {
        "role": "user",
        "content": "Email jane@example.com and tell her the appointment is tomorrow."
      }
    ]
  }'

Responses Example

curl https://api.nano-gpt.com/api/v1/responses \
  -H "Authorization: Bearer $NANOGPT_API_KEY" \
  -H "Content-Type: application/json" \
  -H "redaction: true" \
  -d '{
    "model": "openai/gpt-5.5",
    "input": "Summarize this customer note: John Smith called from 555-123-4567."
  }'

Disable For One Request

If redaction is enabled by an account-level or API-key default, a request can opt out with any supported redaction header set to a falsy value:

Header	Recommended
`redaction: false`	Yes
`redacted: false`	No
`piiredaction: false`	No
`piiredacted: false`	No

Falsy values accepted by the API:

false
0
no
off

Recommended opt-out header:

redaction: false

If the same request explicitly enables redaction with a model suffix such as :redaction, redaction remains enabled.

Enable With Model Suffixes

You can also enable redaction by appending a redaction suffix to the model name:

Suffix
`:redaction`
`:redacted`
`:piiredaction`
`:piiredacted`

Example:

{
  "model": "openai/gpt-5.5:redaction",
  "messages": [
    {
      "role": "user",
      "content": "My phone number is 555-123-4567. Write a short reminder text."
    }
  ]
}

NanoGPT strips the redaction suffix before sending the request onward, so the model is still resolved as the base model. The suffix is only used to turn redaction on for that request; the provider comes from a redaction: tinfoil or redaction: grepture header if you send one, else from your API key or account setting. Redaction suffixes can be combined with other supported NanoGPT model routing suffixes. For example:

{
  "model": "openai/gpt-5.5:redaction:online",
  "messages": [
    {
      "role": "user",
      "content": "Search for updates related to this customer domain: example.com"
    }
  ]
}

With :online, the web search runs on the redacted query, so results about a redacted person or company can be missing. For general suffix composition rules, see Model Suffixes.

Enable In Web Chat

In the NanoGPT web app, users can enable PII redaction from:

Settings > Privacy > PII redaction for chats

When this setting is enabled, web chat messages and chat titles are redacted automatically, with the provider you pick under Redaction provider for chats. While it is on, cloud quick replies and cloud memory suggestions are paused (local models still work). With Tinfoil, web app tools that call outside services (web search, image search, reading links, YouTube transcripts, GitHub, AI-writing detection, image generation, connected MCP tools) receive placeholders.

Redact on this device

With PII redaction for chats on and Tinfoil as the provider, you can also turn on:

Settings > Privacy > Redact on this device

Your browser then verifies Tinfoil’s privacy-filter enclave itself and encrypts the text to it; NanoGPT only relays the ciphertext. Your browser replaces the values, sends NanoGPT only placeholders, and restores the answer as it streams, so for regular chats NanoGPT never receives your personal data or the mapping. Multi-model chats, Fusion, chat titles and uploaded documents are still redacted on NanoGPT’s servers. The setting is saved on that device only. Pricing is the same.

API Default Settings

Users can enable redaction by default for API requests from:

Settings > Privacy > PII redaction for API requests

When this account-level API setting is enabled, supported API text requests are redacted by default. Users can still opt out per request with redaction: false. Redaction provider for API requests sets the provider for API requests that do not name one. API keys can also be configured individually from the API key settings modal:

API key setting	Behavior
Inherit account	Use the account-level API default.
Always redact	Redact requests made with this API key unless the request opts out.
Never redact	Do not apply the account-level API redaction default to this API key.
Redaction provider	Inherit account, Tinfoil or Grepture, for this key’s redacted requests.

The provider is chosen in this order: the request header (redaction: tinfoil or redaction: grepture), the API key, the account, then Tinfoil. Turning on an account or API key default now saves Tinfoil as its provider when there is none to inherit. A default turned on before November 6, 2026 with no provider chosen stays on Grepture for now. Explicit per-request headers and model suffixes are still the clearest way to control redaction for a single request.

What Gets Redacted

All message text is scanned: system, developer, user, assistant and tool messages, earlier turns, tool-call arguments in the history, and instruction fields.

Personal Information

Category	Description
Person	Names of people
Email	Email addresses
Phone	Phone numbers
Address	Postal addresses
Account	IBANs, card numbers and other account numbers
ID	National ID, tax, passport and similar numbers
Date	Private dates such as dates of birth
IP address	IPv4 and IPv6 addresses
Personal link	Profile links such as LinkedIn or X profiles

These values are replaced with placeholders before reaching the model and restored in the response. With Tinfoil, in addition to the enclave model, NanoGPT runs deterministic checks for email addresses, IBANs (with checksum), payment cards (with checksum), IP addresses, profile links and common secret formats. Grepture applies its own detection.

Secrets And Credentials

Category	Behavior
API keys and access tokens (OpenAI, Anthropic, GitHub, AWS, Stripe, Slack and others)	Replaced, never restored
JSON Web Tokens	Replaced, never restored
Private key material	Replaced, never restored
Password or secret assignments	Replaced, never restored

Pricing

Tinfoil: $0.00021 per detection call plus $0.84 per million input tokens. The charge depends on how much new text a request carries, so Tinfoil has no fixed price per request. One call scans up to about 35,000 tokens, about 25,000 words of English. Longer text is split into several calls, and short texts in one request share a call. Overlapping text submitted across calls is counted again. Text scanned in the last 3 days is not scanned or charged again, so in a conversation each turn usually pays only for its new message and the previous reply.

New text in the request	Calls	Redaction charge
A short chat message (100 tokens)	1	$0.000294
A 5,000-word document (7,200 tokens)	1	$0.006258
A 40,000-word document (56,000 tokens)	2	about $0.047
None (all scanned in the last 3 days)	0	$0

Code, JSON and text in other languages use more tokens per word, so they cost more for the same number of words. Grepture: $0.0005 per request, whatever its size. The charge appears as a separate PII redaction add-on in usage details, with the number of Tinfoil detection calls. Before any text is sent to Tinfoil, NanoGPT checks that your balance covers the calls the request needs; if it does not, the request is refused for insufficient balance and nothing is charged.

Failure Behavior

Redaction is fail-closed. With Tinfoil, if the detector cannot be reached, its attestation does not verify, or it does not answer in time, NanoGPT refuses the request with HTTP 503 and code pii_redaction_unavailable instead of sending it unredacted. A request with more new text than redaction can scan at once (about 160,000 tokens) is refused with HTTP 413 and code pii_redaction_too_large. Tinfoil charges for each detection call, including calls for requests that are then refused, fail or end without an answer (for example, a stream stopped before its first token); once an account has 100 such unpaid calls in a day, further detection is refused with HTTP 429 and code pii_redaction_unbilled_limit until the day’s count resets. Private (TEE) models already keep your prompt confidential from the provider; requests for them with redaction enabled are refused with HTTP 400 and code pii_redaction_unsupported_model.

Limitations

Redaction is a privacy and safety layer, not a compliance guarantee.
Detection is best-effort. It can miss items (most often names) and occasionally mask public names; it is strongest in English.
Restoration depends on the model keeping the placeholder. If the model rewrites or drops a placeholder, the original value cannot be put back.
Images, audio and files are sent as they are. Redaction applies to text only.
With Claude models, prior signed reasoning is not replayed while redaction is on; Claude starts fresh reasoning on each turn. Some Claude thinking modes cannot continue tool calls with redaction; use adaptive thinking on a supported model.
Users should still avoid sending unnecessary personal data or credentials to AI systems.

FAQ

Does redaction change the model I selected?

No. Redaction changes the text the model receives, not the model or provider.

Does redaction work with streaming?

Yes. Placeholders are restored as the response streams, including placeholders split across chunks and inside tool-call arguments.

Are redacted values restored in the final answer?

For personal information, yes, when the model keeps the placeholder. Secrets are not restored.

Can I enable redaction globally for API requests?

Yes. Users can enable an account-level API redaction default in Settings > Privacy. API keys can inherit that default, always redact, or opt out of the account default. Per-request headers and model suffixes are also supported.

Can I opt out if my account or API key has redaction enabled by default?

Yes. Send redaction: false on the request to opt out of account-level or API-key redaction defaults. Model suffixes such as :redaction explicitly enable redaction for that request.

What happens if I use both the header and the model suffix?

Redaction is enabled once, with one set of detection calls.

Get Started

Endpoint Examples

API Reference

Miscellaneous

Integrations

PII Redaction

PII Redaction

How Redaction Works

Supported API Endpoints

Enable With API Headers

Chat Completions Example

Responses Example

Disable For One Request

Enable With Model Suffixes

Enable In Web Chat

Redact on this device

API Default Settings

What Gets Redacted

Personal Information

Secrets And Credentials

Pricing

Failure Behavior

Limitations

FAQ

Does redaction change the model I selected?

Does redaction work with streaming?

Are redacted values restored in the final answer?

Can I enable redaction globally for API requests?

Can I opt out if my account or API key has redaction enabled by default?

What happens if I use both the header and the model suffix?

​PII Redaction

​How Redaction Works

​Supported API Endpoints

​Enable With API Headers

​Chat Completions Example

​Responses Example

​Disable For One Request

​Enable With Model Suffixes

​Enable In Web Chat

​Redact on this device

​API Default Settings

​What Gets Redacted

​Personal Information

​Secrets And Credentials

​Pricing

​Failure Behavior

​Limitations

​FAQ

​Does redaction change the model I selected?

​Does redaction work with streaming?

​Are redacted values restored in the final answer?

​Can I enable redaction globally for API requests?

​Can I opt out if my account or API key has redaction enabled by default?

​What happens if I use both the header and the model suffix?

PII Redaction

How Redaction Works

Supported API Endpoints

Enable With API Headers

Chat Completions Example

Responses Example

Disable For One Request

Enable With Model Suffixes

Enable In Web Chat

Redact on this device

API Default Settings

What Gets Redacted

Personal Information

Secrets And Credentials

Pricing

Failure Behavior

Limitations

FAQ

Does redaction change the model I selected?

Does redaction work with streaming?

Are redacted values restored in the final answer?

Can I enable redaction globally for API requests?

Can I opt out if my account or API key has redaction enabled by default?

What happens if I use both the header and the model suffix?