Feature types: Text PII (synchronous, string payloads), Conversation PII (turn-based transcripts, asynchronous), Document PII (native .pdf, .docx, .txt, asynchronous, preserves structure and emits JSON metadata).
SDKs: C#, Java, JavaScript, Python, plus REST.
Redaction: redactionPolicies parameter from API version 2025-11-15-preview, multiple policies per request.
Output: entity categories with confidence scores. No customisation of the model on your data.
Guidance: use GA API versions in production; do not mix payload examples across versions.
Data handling (verified 14 September 2026): no storage or processing outside your deployment region; all content encrypted at rest; up to 48 hours temporary storage for catastrophic-failure debugging, governed by LoggingOptOut — which defaults to true on the PII and health endpoints, so it does not apply to PII calls.
| # | Safeguard | Reversible | Preserves coreference | Typical use |
|---|---|---|---|---|
| 1 | Remove | No | n/a | Default; the field was not needed |
| 2 | Redact | No | No | One-shot classification |
| 3 | Mask | No | No | Human-facing confirmation |
| 4 | Generalise | No | No | Analytics, banded reasoning |
| 5 | Pseudonymise | Yes | Yes | Conversational work, the default |
| 6 | Surrogate | Yes | Yes | Where natural text matters |
| 7 | Format-preserving encrypt | Yes | Yes | Downstream format validation |
| 8 | Synthesise | No | n/a | Test and demo data |
| Control | Effort | Reduces |
|---|---|---|
| Field projection | Hours | Every entity in the fields you drop, structurally |
| Turn off prompt logging | Hours | The largest personal data store most teams have |
| Deterministic layer | Days | Highest-consequence identifiers, near-certainty |
| Log sink redaction | Hours | Incidental telemetry exposure |
| Output host allowlist | Hours | Rendered exfiltration |
| Provider zero data retention | A procurement conversation | Provider-side persistence |
| Retrieval permission filter | Hours | Cross-tenant retrieval |
| De-identify at ingestion | Days | Bulk exposure in the vector index |
| Model-based detector | Weeks, plus operations | About half of what remains |
| Round trip with vault | Weeks | Real values at the provider |
The ordering is the argument of the book. The most expensive row is the least effective, and it should be sized against what is left after the cheap rows, not against the original problem.
Fastest to age: provider retention terms (changed at least twice during 2026), maintenance status, API preview version names, package download counts.
Slower: accuracy figures, latency characteristics, the shape of the trade-offs.
Effectively stable: checksum algorithms, the ladder of safeguards, the five doors, the fact that in-distribution scores do not predict out-of-distribution performance.
Re-verify anything in the first group before you rely on it, and print the date you checked.
Download the full PDF for free?
Free download — no account required