Keeping PII out of prompts

The surest way to keep a model provider from leaking or training on student data is to not send it. Redaction means detecting personal information in text before a model call and replacing it with placeholders, then restoring the real values in the response only if the user is allowed to see them. Microsoft's open-source Presidio is the usual starting point: it combines pattern matching, checksums and named entity recognition to find names, emails, phone numbers, ID numbers and similar fields, and it lets you add recognizers for your own identifiers such as student ID formats.

Automated redaction is a safety net, not a guarantee. It misses unusual names, nicknames, context that identifies someone without naming them (the only student in the class who uses a wheelchair), and identifiers in images or attachments. It also produces false positives that can break the task. That is why redaction belongs alongside two other controls: data minimization, so the prompt never includes fields the task does not need, and a written policy that says what may and may not be sent to which model.

The module's main deliverable is that policy. An AI and student data policy covers which data may be used with AI, no training on student data, redaction requirements, retention and deletion of prompts and outputs, human review for decisions that affect students, and how a suspected data exposure is reported and handled.