Skip to main content
Privacy is built into how the guide handles every turn. Sensitive values are tokenized before they reach the model, telemetry is scrubbed before it leaves your app, and consent follows the posture you set for your workspace. This page explains each layer so you can position it confidently with your own privacy team.

​
Redaction at a glance

Before any text reaches the model or the guardrail checks, Puntego scans it and replaces well-defined sensitive values with stable, content-addressed placeholder tokens. Matching tokens map back to the same original value within a turn, so the model can reason about “the same email” or “that card” without ever seeing the real data.
Auto-detection covers the structured, high-confidence patterns above. It does not infer names, postal addresses, or free-form text, because those have no reliable signature to match on. If a workflow collects that kind of information, scope it into a dedicated field that your own systems handle, rather than relying on the guide to recognize it in conversation.

​
How the redaction round-trip works

Redaction is reversible by design. The original values never leave your app boundary, yet the visitor still gets a complete, natural reply. Because tokens are content-addressed, the same input always produces the same token, which keeps replies coherent while the underlying value stays private to your environment.

​
Telemetry stays clean and isolated

Operational events are scrubbed of PII before they ever leave the app, so traces and analytics capture what happened without capturing who it happened to. Every event is workspace-isolated: one workspace’s telemetry is never visible to another. The result is the observability you need to run the guide in production, with none of the raw sensitive payloads. Set the consent posture for your workspace from Dashboard → Privacy. The guide follows the mode you configure, consistently, for every visitor. A few principles make this predictable:
  • GPC always wins. A Global Privacy Control opt-out is honored independently of location, regardless of the configured mode.
  • No geo gating. Consent is driven by the mode you choose for the workspace. A missing or undetected visitor country does not force the strictest mode, and never silently overrides your configuration.
Pair your consent mode with verified domains and a tight content policy so the guide only ever boots where you intend. See Security for the full trust model.

​
Next steps

Configure consent and privacy

Set the consent mode and launcher behavior for your workspace.

Review the security model

See how domains, tokens, and isolation protect every request.