PII redaction

PII is personally identifiable information: anything that identifies a person, such as a name, email address, phone number, account or card number, or home address. Dimension Labs has a policy of not ingesting or storing any PII, so remove it before your data reaches us.

Redaction happens on your side: in your export before a file upload, or in the script that sends messages to the universal API.

What to remove

Category	Types
Personal	NAME, ADDRESS, PHONE, EMAIL, AGE
National	SSN, PASSPORT_NUMBER, DRIVER_ID
Financial	BANK_ACCOUNT_NUMBER, BANK_ROUTING, CREDIT_DEBIT_NUMBER, CREDIT_DEBIT_CVV, CREDIT_DEBIT_EXPIRY, PIN

These are the entity names Amazon Comprehend uses; other tools use similar names, which makes them easy to configure.

Look beyond text. Personal information also turns up in metadata: in the extra columns of an upload file (a customer_email column), in API payloads (a customer’s name in platformUserJson, an email address in a platformJson field), and in ids (a phone number used as a userId). Never use an email address, phone number or name as userId, sessionId or a join key.

How redacted text is read

Replace what you remove with a marker such as [REDACTED], [NAME] or XXXX. The model reads markers as expected, not as a data problem, and still enriches the rest of the message. Markers are better than deleting words outright, because the sentence still reads naturally.

Libraries and services

These already know how to find many kinds of PII. Each can be configured to remove names, email addresses, phone numbers, Social Security numbers and other identifiers. Treat the list as a starting point, and check whether a tool meets your own PII requirements before you rely on it.

Tool	Runs in	What it is
Microsoft Presidio	Python, or Docker	Open-source, comprehensive PII detection and redaction SDK. Highly configurable.
Azure AI Language PII detection	Any language, via Azure	Managed service from Microsoft
Amazon Comprehend PII detection	Any language, via AWS	Managed service from Amazon
deep-redact	Node	Redacts whole objects in process. Highly configurable.
@coffeeandfun/remove-pii	Node	Redacts a single text field. Light configuration.
redact-pii	Node	Redacts a single text field. Light configuration. Marked deprecated.

How to choose:

• One text field per message (the usual case): a single-field library, or Presidio.
• Whole objects, when PII can sit in any field of a vendor’s payload: an object library such as deep-redact, or your own pass over the fields.
• Large volumes, or a team without a Node or Python service: a managed service in the cloud you already use.

Redact in Node before you send

The steps below use redact-pii, the library the older Dimension Labs guide was built on. The same shape works with any library: redact, then send.

Caution

redact-pii is listed as deprecated. It still shows the pattern clearly, but for new work pick a maintained library from the table and check its own docs for the exact calls.

1. Install and set up the library

npm install redact-pii

const { AsyncRedactor } = require('redact-pii');
const redactor = new AsyncRedactor();

The library finds names, email addresses, phone numbers, Social Security numbers and other identifiers, using built-in patterns you can customize.

2. Redact the text

async function redactText(text) {
  return redactor.redactAsync(text);
}

3. Redact before every send

Apply it to each message just before you post it, using the sendToDimensionLabs helper from the universal API:

import { sendToDimensionLabs } from './dimensionlabs.mjs';

async function sendRedacted(msg) {
  const clean = { ...msg, text: await redactText(msg.text) };
  await sendToDimensionLabs(clean);
}

Redact other fields too

If personal information can sit anywhere in the payload, add a second step that works on a copy of the whole object before it is sent. Run the text redaction first, then hand its output to the object step:

async function redactMessage(msg) {
  // Step 1: the text field.
  const copy = structuredClone(msg);
  copy.text = await redactor.redactAsync(copy.text);

  // Step 2: the rest of the object. Check every field before you touch it.
  if (copy.platformJson && typeof copy.platformJson.email === 'string') {
    copy.platformJson.email = '[EMAIL]';
  }
  if (copy.platformUserJson) {
    delete copy.platformUserJson.firstName;
    delete copy.platformUserJson.lastName;
  }
  return copy;
}

Platform payloads vary

If you redact whole objects, write the code defensively. In our experience every platform’s payloads vary a lot, including when the platform ships new versions: a property that was there in one payload may be missing from the next, or may disappear in future. Check that a field exists and has the type you expect before you change it.

If you used the dimensionlabs npm package

Older guides showed redaction through callbacks in the dimensionlabs npm package (redactAsync for text, redactObjectAsync for the whole object, run in that order). That package is no longer maintained. Send messages with the universal API instead, and move the bodies of your two callbacks into a step like redactMessage above: text first, then the object.

Redact in Python

Presidio has two parts: an analyzer that finds PII and an anonymizer that replaces it. Its own docs cover installation, the language models it needs and the entity types it supports. Run it over text (and any free-text metadata) before you call send_to_dimension_labs, and over each text column before you write an upload file.

Keep the ids you need to join

Redact free text, not the keys you’ll join on. Join on your tools’ internal ids (an account id, a customer id) rather than on anything personal. If the only shared key is an email address, or you need to protect a customer id, replace it with the same hash in both your conversation file and your business data, so the join still works. See Join business data.

Check before the full run

1. Run your redaction on a sample of a few hundred real messages.
2. Read the output. Look for identifiers it missed (order numbers that contain names, emails written as “name at domain”) and for text it removed that you needed.
3. Adjust the configuration, then run the full export.

Security and compliance

Dimension Labs has a policy of not ingesting or storing any PII. Its certifications (SOC 2 Type II, ISO 27001) and GDPR compliance are listed on Security and compliance (as of October 2026). For audit reports, security questionnaires and DPAs, email [email protected]; for help with redaction, email [email protected].