Tokenize PII before it reaches an LLM

Draft a reply to the customer at sarah.chen@example.com about the disputed
$420 charge on card 4532015112830366. Their phone on file is +1 415-555-0142
and their SSN is 123-45-6789.

Draft a reply to the customer at [EMAIL:cfd20fe2-8872-d109-780b-5bcadb96ebd0]
about the disputed $420 charge on card [CARD:600c5f6d-a18d-1f01-da05-4a5c3ee5ac24].
Their phone on file is [PHONE:dce7e4f4-4aeb-231c-daaf-2efd7bd2ae71] and their
SSN is [SSN:b6c14fa6-715f-ee1d-aede-9dad4059da03].

I've emailed [EMAIL:cfd20fe2-8872-d109-780b-5bcadb96ebd0] to confirm, and the
$420 charge on card [CARD:600c5f6d-a18d-1f01-da05-4a5c3ee5ac24] will be reversed
within 3 business days.

I've emailed sarah.chen@example.com to confirm, and the $420 charge on card
4532015112830366 will be reversed within 3 business days.

prompt ──▶ find PII ──▶ TokenCreateBulk ──▶ prompt with tokens ──▶ model
                                                                     │
 answer ◀── BulkListTokens ◀── reply with tokens ◀───────────────────┘

docker run -p 3000:3000 -d --rm --name databunkerpro securitybunker/databunkerpro demo

import re

DETECTORS = [
    ("EMAIL", re.compile(r"\b[\w.%+-]+@[\w.-]+\.[A-Za-z]{2,}\b")),
    ("SSN",   re.compile(r"\b\d{3}-\d{2}-\d{4}\b")),
    ("CARD",  re.compile(r"\b(?:\d[ -]?){12,18}\d\b")),
    ("PHONE", re.compile(r"\+?\d[\d\s().-]{7,}\d")),
]

def find_pii(text):
    spans = []
    for label, rx in DETECTORS:
        for m in rx.finditer(text):
            if not any(m.start() < e and s < m.end() for s, e, _, _ in spans):
                spans.append((m.start(), m.end(), label, m.group()))
    return sorted(spans)

import json, os, re, urllib.request

BUNKER = os.environ.get("DATABUNKER_URL", "http://localhost:3000/v2")
BUNKER_TOKEN = os.environ.get("DATABUNKER_TOKEN", "DEMO")

def bunker(op, body):
    req = urllib.request.Request(
        f"{BUNKER}/{op}", data=json.dumps(body).encode(),
        headers={"X-Bunker-Token": BUNKER_TOKEN, "Content-Type": "application/json"})
    with urllib.request.urlopen(req) as r:
        return json.load(r)

def tokenize(text, ttl="24h"):
    spans = find_pii(text)
    if not spans:
        return text
    records = [{"tokentype": "creditcard" if label == "CARD" else "string", "record": value}
               for _, _, label, value in spans]
    resp = bunker("TokenCreateBulk",
                  {"records": records, "unique": True, "finaltime": ttl})
    minted = {r["record"]: r["tokenuuid"]
              for r in (resp.get("created") or []) + (resp.get("duplicates") or [])}
    for start, end, label, value in reversed(spans):
        text = text[:start] + f"[{label}:{minted[value]}]" + text[end:]
    return text

import anthropic

SYSTEM = """Text in square brackets such as [EMAIL:<uuid>] is a placeholder for
redacted personal data. Treat each one as an opaque identifier for a real value
of that type. Copy any placeholder you need to reference exactly as written.
Never invent, complete, or alter a placeholder."""

client = anthropic.Anthropic()

def ask(prompt):
    response = client.messages.create(
        model="claude-opus-5",
        max_tokens=16000,
        system=SYSTEM,
        messages=[{"role": "user", "content": prompt}],
    )
    return "".join(b.text for b in response.content if b.type == "text")

PLACEHOLDER = re.compile(r"\[([A-Z]+):([0-9a-fA-F-]{36})\]")

prompt = ("Draft a reply to the customer at sarah.chen@example.com about the "
          "disputed $420 charge on card 4532015112830366. Their phone on file "
          "is +1 415-555-0142 and their SSN is 123-45-6789.")

safe = tokenize(prompt)
reply = ask(safe)
print(detokenize(reply))

curl -X POST http://localhost:3000/v2/TokenCreate \
  -H "X-Bunker-Token: DEMO" \
  -H "Content-Type: application/json" \
  -d '{"tokentype":"string","record":"sarah.chen@example.com","unique":true,"finaltime":"24h"}'

import uuid

placeholders = {}                   # placeholder -> real value, for this request
safe = prompt
for start, end, label, value in reversed(find_pii(prompt)):
    token = f"[{label}:{uuid.uuid4()}]"
    placeholders[token] = value
    safe = safe[:start] + token + safe[end:]