Privacy and data handling

Sensitive user data plus careless API calls = your company on the news. This lesson keeps you off the news.

A loud diary read aloud in a cafe. Privacy in AI is making sure the diary is only read where it should be, by whom it should be.

Best practices:

1. Know your provider's data retention policy (OpenAI does not train on API data by default but check current terms).
2. Minimize: only send the fields needed.
3. Redact PII before LLM calls when possible.
4. Avoid logging raw prompts that contain user PII.
5. Region: check data residency requirements.
6. Use private deployments for highly regulated data (self-hosted Llama, Azure OpenAI with no training).
7. User consent and transparency: tell users you use AI, how, and on what.

PII redaction snippet:

import re
def redact(text):
    text = re.sub(r"\b[\w.+-]+@[\w-]+\.[\w.-]+\b", "[EMAIL]", text)
    text = re.sub(r"\b\d{10}\b", "[PHONE]", text)
    return text

Then call the LLM with redact(user_text). Map back on the way out only if needed.