How Lexlaw masks personal data
What happens to a name, a medical record number or an API key between your keyboard and the AI model, and what masking can and can't do.
When you ask an AI model about a document, the model needs the text. It doesn't need Jane Q. Sample's Social Security number to summarize her intake notes. Lexlaw's personal data guardrail is built on that difference.
Placeholders in, real values out
Say you write:
Summarize the intake notes for Jane Q. Sample, DOB 01/02/1980, MRN 000-00-0000.
With masking on (and Presidio for the name, more on that below), the model receives:
Summarize the intake notes for [PERSON_1], DOB [DOB_1], MRN [MRN_1].
The same value always gets the same placeholder, so the model can still tell people and records apart. When the reply comes back, Lexlaw puts the real values back before you see it. Masking runs on replies as they stream in, without splitting a value in half.
What it can find
Lexlaw recognizes 65 kinds of personal data in seven groups:
| Group | Examples |
|---|---|
| Personal | names, phone numbers, email and street addresses, Social Security numbers, dates of birth |
| Payment and financial | card numbers and security codes, bank account numbers, IBANs, crypto wallets |
| Health (HIPAA identifiers) | patient and doctor names, medical record numbers, patient IDs, NPI and DEA numbers |
| Credentials and secrets | passwords, access tokens, API keys for the major AI and cloud providers |
| Technical | IP and MAC addresses, UUIDs, vehicle identification numbers |
| EU identity numbers | national ID, tax and social insurance numbers from 11 countries, EU VAT numbers |
| Legal | case and docket numbers |
Forty of them are found by built-in patterns, many double-checked with the number's own checksum (the Luhn check on card numbers, for example) so ordinary numbers aren't masked by mistake. Some only match next to a label, such as "MRN" or "CVV". Names, places and many national ID numbers need language understanding rather than patterns. For those, Lexlaw can add Microsoft Presidio, an open-source detector.
You decide what's masked
Every organization's needs differ. A litigation team may need case numbers left alone, while a clinic wants every date masked. Administrators switch each kind of identifier on or off, and choose where each guardrail applies: the whole organization, a team, a project, a model or a single skill.
Guardrails can run at six checkpoints: when a file is uploaded, before a message is sent, when context is gathered, before and after a tool runs, and on the reply. Each can monitor (log what it would have done) or enforce.
What masking doesn't do
We'd rather you hear the limits from us:
- It's set up by your administrator. Masking is a guardrail an admin turns on and tunes; it isn't on until they do.
- Names need Presidio. Built-in patterns can't reliably tell a name from an ordinary word.
- Tools see real data. If your organization connects external tools to chat, those tools receive the unmasked text, so connect only ones you trust.
- Your originals stay yours. Masking protects what goes to the AI provider. Your own chats and files are stored in your workspace, protected by sign-in with a second factor and an audit trail.
For health information, pair masking with data privacy mode, which restricts chats to zero-retention models, and with Business Associate Agreements with your providers.
Questions about a specific setup? Talk to us.