FastPII is an AI Data Security Platform with an open-source SDK for European personal identifiers. It detects, validates, and transforms sensitive data in text using checksum validation for identifiers like rodné číslo, PESEL, Steuer-ID, and SIREN.

How do I install FastPII?

Install FastPII with pip: pip install fastpii. It requires Python 3.10 or newer and has zero core dependencies.

What countries does FastPII support?

FastPII supports 4 regions: Czech Republic (15 detectors), Poland (6 detectors), Germany (6 detectors), and France (6 detectors). This includes identifiers like rodné číslo, IČO, DIČ, PESEL, NIP, REGON, Steuer-ID, USt-IdNr, SIREN, SIRET, and INSEE/NIR.

Does FastPII have external dependencies?

No. FastPII has zero core dependencies. Optional integrations like FastAPI and LangChain are available through pip extras: pip install fastpii[fastapi] or pip install fastpii[langchain].

How does FastPII validate identifiers?

FastPII uses country-specific checksum algorithms: Mod 11 for rodné číslo and IČO, Mod 10 for PESEL, ISO 7064 MOD 11,10 for Steuer-ID, Luhn for SIREN/SIRET, and Mod-97 for INSEE/NIR. This ensures only structurally valid identifiers are detected.

Create, test, and manage FastPII Gateway policies for real-time LLM traffic enforcement.

Gateway Policies

Name: FastPII
Author: FastPII

Gateway policies define how FastPII should respond when PII is detected in LLM traffic. Policies let you control behavior per provider, model, entity type, user role, country, or confidence threshold.

Use this page together with Gateway Setup and Audit.

How policies work

Each policy contains:

A name and description
A numeric priority
An action to take when the policy matches
One or more conditions
A workspace scope
An optional is_default flag

When a request passes through the Gateway, matching policies are evaluated by priority and the highest-priority match decides what happens.

Evaluation order

Policies are priority-based.

Field	Meaning
`priority`	Integer priority value
Lower number	Higher priority
Higher number	Lower priority

Example order:

Policy	Priority	Effect
Block credit cards on external models	`10`	Evaluated first
Warn on personal email addresses	`50`	Evaluated after higher-priority rules
Default mask policy	`100`	Fallback behavior

Available actions

The Gateway supports seven policy actions:

Action	What it does	Common use
`ALLOW`	Lets the request pass unchanged	Trusted internal workflows
`WARN`	Allows the request but records a warning	Developer or analyst review flows
`MASK`	Replaces sensitive spans before forwarding	Default protection for prompts
`BLOCK`	Stops the request	High-risk or prohibited data
`ESCALATE`	Flags the request for higher review	Sensitive regulated workflows
`LOG`	Records the event without changing content	Observation and tuning
`QUARANTINE`	Holds or isolates the request for manual handling	Incident response and strict review

Supported conditions

Each policy can include one or more condition objects.

Condition field	Type	Description
`entity_type`	`string`	Match a detected entity type, such as `EMAIL` or `CREDIT_CARD`
`country`	`string`	Match a country or region code
`provider`	`string`	Match a provider, such as `openai`
`model`	`string`	Match a specific model
`workspace_id`	`string`	Match a workspace explicitly
`user_role`	`string`	Match caller role or user segment
`confidence_min`	`float`	Require a minimum detection confidence
`sensitivity`	`string`	Match a sensitivity label from your policy model

Example condition set:

[
  {
    "entity_type": "CREDIT_CARD",
    "provider": "openai",
    "confidence_min": 0.9,
    "sensitivity": "restricted"
  }
]

Create a policy

Use POST /api/v1/gateway/policies?workspace_id=... to create a policy.

Request body

{
  "name": "Block payment card data",
  "description": "Block card data before it reaches third-party models",
  "priority": 10,
  "action": "BLOCK",
  "conditions": [
    {
      "entity_type": "CREDIT_CARD",
      "confidence_min": 0.9,
      "provider": "openai"
    }
  ],
  "workspace_id": "ws_prod_eu",
  "is_default": false
}

curl

curl -X POST "$FASTPII_BASE_URL/api/v1/gateway/policies?workspace_id=$FASTPII_WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -H "X-Service-Token: $FASTPII_SERVICE_TOKEN" \
  -d '{
    "name": "Block payment card data",
    "description": "Block card data before it reaches third-party models",
    "priority": 10,
    "action": "BLOCK",
    "conditions": [
      {
        "entity_type": "CREDIT_CARD",
        "confidence_min": 0.9,
        "provider": "openai"
      }
    ],
    "workspace_id": "ws_prod_eu",
    "is_default": false
  }'

Python

import requests

base_url = "https://gateway.fastpii.com"
service_token = "your-gateway-service-token"
workspace_id = "ws_prod_eu"

payload = {
    "name": "Block payment card data",
    "description": "Block card data before it reaches third-party models",
    "priority": 10,
    "action": "BLOCK",
    "conditions": [
        {
            "entity_type": "CREDIT_CARD",
            "confidence_min": 0.9,
            "provider": "openai",
        }
    ],
    "workspace_id": workspace_id,
    "is_default": False,
}

response = requests.post(
    f"{base_url}/api/v1/gateway/policies",
    params={"workspace_id": workspace_id},
    headers={
        "X-Service-Token": service_token,
        "Content-Type": "application/json",
    },
    json=payload,
    timeout=30,
)
response.raise_for_status()
print(response.json())

Example response:

{
  "id": "pol_01J9X85SP6VC0Y5WKH4WMS83VY",
  "name": "Block payment card data",
  "description": "Block card data before it reaches third-party models",
  "priority": 10,
  "action": "BLOCK",
  "conditions": [
    {
      "entity_type": "CREDIT_CARD",
      "country": null,
      "provider": "openai",
      "model": null,
      "workspace_id": null,
      "user_role": null,
      "confidence_min": 0.9,
      "sensitivity": null
    }
  ],
  "is_default": false,
  "workspace_id": "ws_prod_eu",
  "created_at": "2026-07-10T10:01:12.200000Z",
  "updated_at": "2026-07-10T10:01:12.200000Z"
}

List policies

Use GET /api/v1/gateway/policies to retrieve policies for a workspace. You can filter by action, is_default, page, and page_size.

curl

curl -X GET "$FASTPII_BASE_URL/api/v1/gateway/policies?workspace_id=$FASTPII_WORKSPACE_ID&action=BLOCK&is_default=false&page=1&page_size=20" \
  -H "X-Service-Token: $FASTPII_SERVICE_TOKEN"

Python

import requests

response = requests.get(
    f"{base_url}/api/v1/gateway/policies",
    params={
        "workspace_id": workspace_id,
        "action": "BLOCK",
        "is_default": "false",
        "page": 1,
        "page_size": 20,
    },
    headers={"X-Service-Token": service_token},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Example response:

{
  "policies": [
    {
      "id": "pol_01J9X85SP6VC0Y5WKH4WMS83VY",
      "name": "Block payment card data",
      "description": "Block card data before it reaches third-party models",
      "priority": 10,
      "action": "BLOCK",
      "conditions": [
        {
          "entity_type": "CREDIT_CARD",
          "country": null,
          "provider": "openai",
          "model": null,
          "workspace_id": null,
          "user_role": null,
          "confidence_min": 0.9,
          "sensitivity": null
        }
      ],
      "is_default": false,
      "workspace_id": "ws_prod_eu",
      "created_at": "2026-07-10T10:01:12.200000Z",
      "updated_at": "2026-07-10T10:01:12.200000Z"
    }
  ],
  "total": 1,
  "page": 1,
  "page_size": 20
}

Get a single policy

Use GET /api/v1/gateway/policies/{policy_id} to inspect one policy.

curl

curl -X GET "$FASTPII_BASE_URL/api/v1/gateway/policies/pol_01J9X85SP6VC0Y5WKH4WMS83VY" \
  -H "X-Service-Token: $FASTPII_SERVICE_TOKEN"

Python

import requests

policy_id = "pol_01J9X85SP6VC0Y5WKH4WMS83VY"

response = requests.get(
    f"{base_url}/api/v1/gateway/policies/{policy_id}",
    headers={"X-Service-Token": service_token},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Update a policy

Use PUT /api/v1/gateway/policies/{policy_id} to change the action, conditions, description, or priority.

Request body

{
  "name": "Mask payment card data",
  "description": "Mask card data instead of blocking for trusted support flows",
  "priority": 20,
  "action": "MASK",
  "conditions": [
    {
      "entity_type": "CREDIT_CARD",
      "provider": "openai",
      "user_role": "support_agent",
      "confidence_min": 0.9
    }
  ]
}

curl

curl -X PUT "$FASTPII_BASE_URL/api/v1/gateway/policies/pol_01J9X85SP6VC0Y5WKH4WMS83VY" \
  -H "Content-Type: application/json" \
  -H "X-Service-Token: $FASTPII_SERVICE_TOKEN" \
  -d '{
    "name": "Mask payment card data",
    "description": "Mask card data instead of blocking for trusted support flows",
    "priority": 20,
    "action": "MASK",
    "conditions": [
      {
        "entity_type": "CREDIT_CARD",
        "provider": "openai",
        "user_role": "support_agent",
        "confidence_min": 0.9
      }
    ]
  }'

Python

import requests

policy_id = "pol_01J9X85SP6VC0Y5WKH4WMS83VY"

payload = {
    "name": "Mask payment card data",
    "description": "Mask card data instead of blocking for trusted support flows",
    "priority": 20,
    "action": "MASK",
    "conditions": [
        {
            "entity_type": "CREDIT_CARD",
            "provider": "openai",
            "user_role": "support_agent",
            "confidence_min": 0.9,
        }
    ],
}

response = requests.put(
    f"{base_url}/api/v1/gateway/policies/{policy_id}",
    headers={
        "X-Service-Token": service_token,
        "Content-Type": "application/json",
    },
    json=payload,
    timeout=30,
)
response.raise_for_status()
print(response.json())

Example response:

{
  "id": "pol_01J9X85SP6VC0Y5WKH4WMS83VY",
  "name": "Mask payment card data",
  "description": "Mask card data instead of blocking for trusted support flows",
  "priority": 20,
  "action": "MASK",
  "conditions": [
    {
      "entity_type": "CREDIT_CARD",
      "country": null,
      "provider": "openai",
      "model": null,
      "workspace_id": null,
      "user_role": "support_agent",
      "confidence_min": 0.9,
      "sensitivity": null
    }
  ],
  "is_default": false,
  "workspace_id": "ws_prod_eu",
  "created_at": "2026-07-10T10:01:12.200000Z",
  "updated_at": "2026-07-10T10:04:19.801000Z"
}

Delete a policy

Use DELETE /api/v1/gateway/policies/{policy_id} to remove a policy. A successful delete returns 204 No Content.

curl

curl -X DELETE "$FASTPII_BASE_URL/api/v1/gateway/policies/pol_01J9X85SP6VC0Y5WKH4WMS83VY" \
  -H "X-Service-Token: $FASTPII_SERVICE_TOKEN"

Python

import requests

policy_id = "pol_01J9X85SP6VC0Y5WKH4WMS83VY"

response = requests.delete(
    f"{base_url}/api/v1/gateway/policies/{policy_id}",
    headers={"X-Service-Token": service_token},
    timeout=30,
)
response.raise_for_status()
print(response.status_code)

Expected response status:

Test a policy

Use POST /api/v1/gateway/policies/{policy_id}/test to evaluate sample text before putting the policy into production.

Request body

{
  "text": "Send john.doe@example.com and 4111 1111 1111 1111 to OpenAI",
  "entity_types": ["EMAIL", "CREDIT_CARD"],
  "country": "CZ",
  "provider": "openai",
  "model": "gpt-4o-mini"
}

curl

curl -X POST "$FASTPII_BASE_URL/api/v1/gateway/policies/pol_01J9X85SP6VC0Y5WKH4WMS83VY/test" \
  -H "Content-Type: application/json" \
  -H "X-Service-Token: $FASTPII_SERVICE_TOKEN" \
  -d '{
    "text": "Send john.doe@example.com and 4111 1111 1111 1111 to OpenAI",
    "entity_types": ["EMAIL", "CREDIT_CARD"],
    "country": "CZ",
    "provider": "openai",
    "model": "gpt-4o-mini"
  }'

Python

import requests

policy_id = "pol_01J9X85SP6VC0Y5WKH4WMS83VY"

payload = {
    "text": "Send john.doe@example.com and 4111 1111 1111 1111 to OpenAI",
    "entity_types": ["EMAIL", "CREDIT_CARD"],
    "country": "CZ",
    "provider": "openai",
    "model": "gpt-4o-mini",
}

response = requests.post(
    f"{base_url}/api/v1/gateway/policies/{policy_id}/test",
    headers={
        "X-Service-Token": service_token,
        "Content-Type": "application/json",
    },
    json=payload,
    timeout=30,
)
response.raise_for_status()
print(response.json())

Example response:

{
  "matched": true,
  "action": "MASK",
  "matched_policy": {
    "id": "pol_01J9X85SP6VC0Y5WKH4WMS83VY",
    "name": "Mask payment card data",
    "description": "Mask card data instead of blocking for trusted support flows",
    "priority": 20,
    "action": "MASK",
    "conditions": [
      {
        "entity_type": "CREDIT_CARD",
        "country": null,
        "provider": "openai",
        "model": null,
        "workspace_id": null,
        "user_role": "support_agent",
        "confidence_min": 0.9,
        "sensitivity": null
      }
    ],
    "is_default": false,
    "workspace_id": "ws_prod_eu",
    "created_at": "2026-07-10T10:01:12.200000Z",
    "updated_at": "2026-07-10T10:04:19.801000Z"
  },
  "entity_types_detected": ["EMAIL", "CREDIT_CARD"]
}

Default policies

Set is_default to true for fallback policies that should apply when no more specific rule wins. A common pattern is:

High-priority BLOCK rules for critical entities
Mid-priority WARN or ESCALATE rules for special workflows
Lower-priority MASK default policy for general traffic

Example default policy body:

{
  "name": "Default mask policy",
  "description": "Apply masking to unmatched medium-risk traffic",
  "priority": 100,
  "action": "MASK",
  "conditions": [
    {
      "confidence_min": 0.7
    }
  ],
  "workspace_id": "ws_prod_eu",
  "is_default": true
}

Recommended policy design

Keep critical BLOCK rules at low numeric priority values
Use MASK for most production prompt sanitization
Add LOG or WARN policies first when you are learning traffic patterns
Test every policy with representative prompts before rollout
Review policy outcomes in Audit and dashboard metrics regularly

Gateway Policies

On this page