How We Protect Your & your Clients Personal Information
Your data never reaches an external AI model without being scanned first.
When you talk to your Nostics AI assistant, your messages pass through a multi-layer privacy guardrail that detects and redacts personal information before it ever leaves your infrastructure. This document explains how it works.
What Is Personal Information (PII)?
Personally Identifiable Information (PII) refers to any data that can identify a specific individual - either on its own or when combined with other information. Under South Africa's Protection of Personal Information Act (POPIA), this includes names, ID numbers, residential addresses, phone numbers, email addresses, passport numbers, and financial account details.
Not all PII is treated equally. POPIA draws an important distinction:
| Category | Examples | Protection Level |
|---|---|---|
| Personal information | Name, address, phone, email, physical address, employment history | Must be processed lawfully, for a defined purpose, with appropriate safeguards |
| Special personal information | ID numbers, passport numbers, biometric data, health info, criminal behaviour, trade union membership, religious/racial/political beliefs | Higher bar - generally prohibited unless specific exemptions apply (e.g. with explicit consent, legal obligation, or vital interest) |
This guardrail focuses on special personal information (and the most risky general PII - phones, emails, credit cards) because those carry the highest consequences if leaked. Physical addresses, while listed as personal information under POPIA Section 1(c), are handled differently (see PII Isolation section below).
How This Guardrail Contributes to POPIA Compliance
POPIA requires organisations to comply with eight conditions when processing personal information. This implementation directly supports several of them:
| POPIA Condition | How the Guardrail Addresses It |
|---|---|
| Condition 1: Accountability (Section 8) | By implementing a technical control, you demonstrate that you take data protection seriously and have taken active steps to safeguard personal information |
| Condition 3: Data Minimisation (Section 10) | Only the minimum information needed for the AI to process your request leaves your infrastructure. Special personal information is stripped before it reaches the AI model |
| Condition 4: Purpose Limitation (Section 13) | The AI processes your business task - not your personal data. The guardrail enforces that personal information is not used for purposes beyond what you consented to |
| Condition 7: Security Safeguards (Section 19) | The guardrail is a technical safeguard that prevents personal information from being transmitted to third-party AI providers. Combined with on-premise scanning, it meets the requirement for appropriate, reasonable technical and organisational measures |
| Condition 8: Participation of Data Subjects (Section 23-24) | You can test the guardrail yourself at any time (see FAQ). If a data subject asks how their information is protected, you can point to this documented control |
The proxy guardrail is one layer in a broader compliance approach. It sits alongside the agent-side PII isolation tool, consent management, data retention policies, secure storage, and the other conditions listed in the FAQ. It does not replace those - but without it, any of them could be undermined by an AI model that inadvertently captures and stores PII from conversations.
The Short Version
Your personal information — ID numbers, passport numbers, bank account details, phone numbers, email addresses — is automatically detected and masked before it reaches any external AI model. The detection happens on your own infrastructure, not in the cloud. No personal information is ever sent to a third-party AI provider.
How It Works
1. Your AI assistant runs on your own infrastructure
The AI system (Hermes Agent) and the AI proxy (LiteLLM) run on Nostics' infrastructure dedicated to you. When you type a message, it goes through the following pipeline:
┌─────────────────────────────────────┐
│ Hermes Agent (your AI) │
│ ┌───────────────┐ │
│ │ PII isolation │ Primary layer │
│ │ (placeholders) │ ✂️ PII out │
│ └───────┬───────┘ │
└──────────┼───────────────────────────┘
│ Safe text with [SA_ID_1]
▼
┌──────────────────────────────────────┐
│ LiteLLM Proxy (AI proxy) │
│ ┌──────────────┐ │
│ │ PII guardrail│ Safety net │
│ │ (regex mask) │ never blocks │
│ └──────┬───────┘ │
└─────────┼─────────────────────────────┘
│ Only masked content
▼
External AI Model
(DeepSeek, Claude, etc.)
Receives only redacted text
2. Two layers of protection
| Layer | What it does |
|---|---|
| Agent-side isolation (primary) | Your AI agent detects PII in the text, replaces it with safe placeholders like [SA_ID_1] before sending to the AI model, and restores the real values in the final response. The AI model never sees the raw data. |
| Proxy guardrail (safety net) | The LiteLLM proxy scans every request as a fallback. Any PII the agent missed is silently masked — never blocked. |
3. Every message is scanned for personal information
Before your message reaches the AI model, the PII Guardrail scans it for South African personal information:
| What we detect | Example | What happens at the proxy guardrail (safety net) |
|---|---|---|
| SA ID number | 9001010001008 | Characters replaced with █████████████ |
| Passport number | A12345678 | Characters replaced with █████████ |
| Phone number | +27 82 560 5347 | Characters replaced with ████████████ |
| Email address | name@email.com | Characters replaced with ████████████████ |
| Credit card | 4111 1111 1111 1111 | Characters replaced with ███████████████████ |
| "My ID is XXXXXX" phrase | Full phrase | Replaced with [REDACTED_SA_ID] marker |
4. The AI model never sees your personal information
If personal information is detected, it is masked — the content is
replaced with block characters (e.g. 9001010001008 becomes
█████████████) or a stable marker like [REDACTED_SA_ID]. The AI can
still understand the structure of your message but never sees the actual
numbers. No message is ever blocked — your work continues uninterrupted.
5. All scanning happens on your infrastructure
Both layers run on your own hardware — the agent-side isolation tool on Hermes Agent and the PII guardrail inside LiteLLM. No data is sent to an external service for scanning and no personal information ever leaves your network without being masked first.
Why This Matters
POPIA Compliance
The Protection of Personal Information Act (POPIA) classifies certain data as special personal information — this includes ID numbers, passport numbers, and financial information. This data may only be processed under specific conditions. Our guardrail ensures that:
- Your personal information is never unnecessarily sent to third-party AI providers
- Data minimisation principles are respected — only what's needed reaches the model
- You remain the responsible party under POPIA; we act as your operator
Protection on Cheaper Models
Not all AI models offer the same data protection guarantees. When using cost-effective models (which may process data in different jurisdictions), the guardrail is especially important — it ensures that even if a model's data handling policies are less stringent, your personal information never reaches it.
Physical Addresses - Why They Pass Through Unmasked
Physical addresses ARE personal information under POPIA Section 1(c), but they are deliberately excluded from this guardrail.
Why: If you work in property, real estate, or valuation - your agent needs street addresses, suburb names, and location data to do its job. A CMA for "42 Silver Lakes Road" must analyse "15 Silver Stream Drive" as a comparable. An address is not an accidental data leak in this context - it is the core business input.
Addresses are managed through your agent's file hygiene and PII isolation procedures (see next section), ensuring they appear only where necessary in the workflow and are not retained longer than needed.
PII Isolation — The Clean Way to Handle Personal Data
When your agent produces reports that contain client names, ID numbers, addresses, and contact details (e.g. a CMA brief, a transfer instruction, a valuation motivation), the PII isolation workflow ensures this data never reaches the AI model in raw form:
1. Agent saves sensitive data to: workspace/<case>/sensitive_data.json
2. Model prompt uses placeholders: "[SA_ID_1] at [ADDR_001]"
3. Model returns analysis with placeholders intact
4. Agent injects real values into the final PDF / document
5. Temp files are deleted after the task completes
This means your property work proceeds uninterrupted - the AI model analyses market data, not client PII. The guardrail is a safety net for anything the agent misses, but with this workflow your data never enters the model at all.
How to use it: Simply tell your agent: "save the sensitive data to a workspace temp file and use placeholders." Your agent has this skill and will handle the extraction, restoration, and cleanup automatically.
Frequently Asked Questions
Q: Does this mean the AI can't help me with ID numbers or personal details?
No. The guardrail masks the sensitive numbers but preserves the context. For example, if you say "My ID number is 9001010001008, please update my profile", the AI receives "My ID number is [REDACTED_SA_ID], please update my profile" — it understands the intent and can act on it without ever seeing the actual number.
Q: Can the guardrail be bypassed?
Two independent layers protect your data. The agent-side isolation tool replaces PII with placeholders before any data leaves the agent — there's nothing for a model to request. The proxy guardrail then scans every byte at the network layer as a second check. Both layers operate on your infrastructure, before data reaches any external AI model. Neither can be bypassed by the model.
Q: What about information I intentionally want to include in documents?
If you need to include personal information in a report or document your assistant is generating (e.g. a client ID number in a mandate), use the PII isolation workflow. Tell your agent: "save the sensitive data separately with placeholders" — the agent will replace the real values with markers before sending to the AI, then restore them in the final document after. This way the AI model helps with the work but never sees the raw data.
Q: Is this enough for full POPIA compliance?
This guardrail addresses the data minimisation and security safeguards requirements of POPIA. Full compliance also requires: - Maintaining a consent register for marketing contacts - Honouring opt-out requests immediately - Secure storage of any personal information you do collect - Regular data cleansing and deletion when no longer needed
Your AI assistant can help with all of these — just ask.
Q: How do I know it's working?
You can test it yourself. Try typing a message with a fake ID number (e.g. "9001010001008") — the AI will respond with the masked version, confirming the guardrail is active.
Technical Architecture (for the curious)
┌──────────────────────────────────────────┐
│ Hermes Agent (your AI) │
│ ┌─────────────────────────────────────┐ │
│ │ PII Isolation Tool (primary layer) │ │
│ │ Extracts PII → replaces with │ │
│ │ markers → stores mapping locally │ │
│ └─────────────┬───────────────────────┘ │
└────────────────┼──────────────────────────┘
│ Safe text with markers
▼
┌──────────────────────────────────────┐
│ LiteLLM Proxy Process │
│ ┌──────────┐ ┌──────────────────┐ │
│ │ Router │──▶│ custom_code PII │ │
│ │ │ │ Guardrail (safety │ │
│ └──────────┘ │ net — never │ │
│ │ block) │ │
│ └────────┬───────────┘ │
└──────────────────────────┼──────────────┘
│ Only masked content
▼
External AI Model
(DeepSeek, Claude, etc.)
Receives only redacted text
- Hermes Agent (your AI): Runs the PII isolation tool as its
primary layer. Before sending any content to the AI model, it scans for
personal information, replaces it with stable markers
(
[SA_ID_1],[PHONE_1],[EMAIL_1]) and stores the real values temporarily. After the model responds, it restores the originals. - LiteLLM Proxy: AI proxy that routes requests to different AI models. The PII guardrail runs inline inside LiteLLM's own process — no separate service, no sidecar, no extra infrastructure. It acts as a safety net, masking anything the agent's isolation tool might have missed.
- Upstream AI Model: The actual AI (DeepSeek, Claude, GPT, etc.) — receives only redacted/cleaned content. Your personal information never leaves the guardrail.
This document is provided by Nostics Digital as part of your AI assistant deployment. For questions about POPIA compliance or data protection, contact your account manager or email support@nostics.biz.