PII Detection — User Guide

Oversai can find personal information (PII) in text, such as names, email addresses, phone numbers and card numbers. It can also give you back a copy of the text with that information hidden. Use it to clean conversation transcripts, notes or exports before you share them or analyze them further.

Your data stays private

• Everything happens inside Oversai. The text is not sent to any outside AI service or third-party provider.

• Nothing is saved. The text you submit and the results are not written to any database or log. Once the response comes back, nothing is kept.

• You must be signed in. Only authenticated Oversai users can use it.

How detection works

Detection uses two complementary methods together:

1. Pattern recognition (structured data)

Many kinds of personal data have a fixed format. Email addresses always have an @ and a domain, and card numbers follow known lengths and pass a checksum (the Luhn algorithm). For these, Oversai matches the text against those known formats and runs validation checks where they exist.

• Strengths: consistent and precise. A valid card number or email is almost always found.

• Typical confidence: high (often 0.75–1.0).

2. Language understanding (unstructured data)

Names of people, places and organizations follow no fixed format. “Jordan” can be a person or a country. For these, Oversai uses a natural-language model that reads the surrounding words to decide what a word refers to.

• Strengths: finds information that no pattern could describe.

• Trade-off: results depend on context, so they are less certain. Expect lower confidence scores and occasional mistakes (see Known limitations below).

Context boosts confidence

If words like “phone”, “card” or “email” appear near a match, the detector becomes more confident that the match really is that type of information.

Confidence scores

Every detection has a score from 0 to 1 that shows how sure the detector is:

You can set a minimum score (score_threshold) so that only detections at or above it are returned. By default no minimum is applied (0.0), so every detection is returned, including low-confidence ones.

What can be detected

Structured (pattern-based):

Unstructured (language-based):

Language support

English only. Text in other languages may still have structured data (emails, card numbers) detected, but names and places will be unreliable. Country-specific identifiers outside the US and UK (for example Spanish NIF/NIE or Italian fiscal codes) are not supported at this time.

Hiding the detected information

You can choose how detected information is hidden:

Tip: custom labels cannot contain angle brackets (< >). Use [REDACTED] or *** instead.

If a piece of text is matched as more than one type (for example, a card number that is also recognized as a date), Oversai resolves the conflict automatically when hiding it, so the value is replaced only once.

Accuracy: how it is tested

What is tested today

Oversai runs automated tests on every code change. They check that:

• Common PII is found. A reference sentence that contains a name, an email, a phone number and a card number must have all four detected, at the correct positions in the text.

• Hidden data is really gone. After anonymization, the original name, email and card number must no longer appear in the output.

• Each hiding method behaves exactly as described. Replace, mask (full and partial), redact and hash are each checked against the exact expected output.

• Filters work. Restricting detection to one type returns only that type, and a minimum score removes every detection below it.

• Clean text is left alone. Text without personal information comes back unchanged and with no detections.

• Invalid requests are rejected with a clear error instead of returning partial results.

What this does — and does not — guarantee

These tests confirm that the feature works correctly and reliably detects common, clearly written PII. They are not a statistical accuracy benchmark. Oversai has not yet measured detection rates (how much real PII is caught, how many false alarms there are) against a large set of real-world conversations, and publishes no precision or recall figures today.

In practice:

• Structured data (emails, card numbers, IBANs, IP addresses) is highly reliable, because it follows strict formats and is often validated with checksums.

• Names, places and organizations are good but not perfect, and quality depends on how the text is written.

Known limitations

⚠️ Automatic detection reduces risk but does not remove it. For regulated or highly sensitive data, combine it with a human review step.

Best practices

1. For maximum protection (catch as much as possible): keep the minimum score low (0.0–0.3) and accept that some non-PII words may be hidden too.

2. For readable output (fewer false alarms): set a minimum score of about 0.6, and/or limit detection to the structured types you care about.

3. When you only care about payment data: restrict detection to CREDIT_CARD and IBAN_CODE, and use mask to keep the last digits visible.

4. Check a sample first. Before processing large volumes, run a few representative conversations and review what is caught and what is missed.

5. Keep a human in the loop for anything shared outside your organization.

FAQ

Is my text sent to ChatGPT, Claude or any other AI provider? No. Detection runs entirely inside Oversai’s own infrastructure.

Is the text stored anywhere? No. Neither the input nor the result is saved.

Why was the first request slow? The first request after a period of inactivity loads the language model and can take a few seconds. Requests after that are almost instant.

Why does the same text show two detections? The two detection methods can both flag the same value, for example a phone number. When you anonymize, Oversai merges these automatically.

Is there a size limit? Yes. Up to 50,000 characters per request.

Can it detect PII in Spanish (or another language)? Not reliably today. Only English is supported.