PII Scrubbing

import { scrubPII } from '@/lib/pii/scrubber'
import { createAIModel } from '@/lib/ai/provider'

const rawTranscript = "Hi, I'm John from Acme Inc. My email is john@acme.com and I'm canceling because the price is too high at $99/month. You can reach me at 555-123-4567."

const model = createAIModel()
const { text, aiApplied } = await scrubPII(rawTranscript, model)

// text: "Hi, I'm [REDACTED] from [REDACTED]. My email is [REDACTED_EMAIL] and I'm canceling because the price is too high at $99/month. You can reach me at [REDACTED_PHONE]."
// If aiApplied is false, text is null — store null, not the raw input.

import { scrubWithRegex } from '@/lib/pii'

const quickScrub = scrubWithRegex(rawText)

import { containsPotentialPII } from '@/lib/pii'

if (containsPotentialPII(userInput)) {
  // Warn user or process differently
}

const complete_interview = {
  description: 'Complete the interview and save redacted summary',
  inputSchema: completeInterviewSchema,
  execute: async (input) => {
    // PII scrub the summary before saving
    const model = createAIModel()
    const redactedSummary = await scrubPII(input.summary, model)

    // Save to database
    await db.interviews.update({
      transcript_summary: redactedSummary
    })
  }
}

import { scrubPII, containsPotentialPII } from '@/lib/pii'
import { createAIModel } from '@/lib/ai'

export async function POST(request: Request) {
  const { summary } = await request.json()

  // Check for PII before processing
  if (containsPotentialPII(summary)) {
    console.log('[PII] Potential PII detected, scrubbing...')
  }

  // Scrub before saving
  const model = createAIModel()
  const scrubbed = await scrubPII(summary, model)

  // Save scrubbed version
  await db.summaries.create({ content: scrubbed })
}

You are a PII redaction specialist. Your job is to identify and replace
personally identifiable information (PII) in the text below.

REPLACE WITH [REDACTED]:
- Names of SPECIFIC people (e.g., "John Smith", "Sarah", "Dr. Johnson")
- Names of SPECIFIC companies or organizations (e.g., "Acme Corp", "Google", "Stark Industries")
- Names of SPECIFIC locations (e.g., "San Francisco", "123 Main St", "Texas")
- Specific usernames, handles, or screen names (e.g., "@johndoe", "user123")
- Specific account/ID/ticket numbers (e.g., "account #12345", "ticket #ABC-123")

DO NOT REDACT - Keep these unchanged:
- Generic terms: "customer", "user", "client", "merchant", "company", "platform", "service", "product"
- Common pronouns: "our", "their", "my", "your", "his", "her", "its"
- Generic descriptors: "the system", "the software", "the tool", "the app"
- Common business terms: "team", "support", "sales", "billing", "management"
- Feature names unless they contain personal info: "dashboard", "API", "integration"

EXAMPLES:
Input: "Contact John Smith at john@example.com or call 555-123-4567"
Output: "Contact [REDACTED] at [REDACTED_EMAIL] or call [REDACTED_PHONE]"

Input: "Customer left due to finding a cheaper alternative with better perceived value"
Output: "Customer left due to finding a cheaper alternative with better perceived value"
(NO redaction - these are generic terms)

Input: "Sarah from Acme Corp said their team was unhappy with our platform's pricing"
Output: "[REDACTED] from [REDACTED] said their team was unhappy with our platform's pricing"
(Redact Sarah and Acme Corp, but keep "their", "our", "platform")

Text to redact:
[TEXT]

Return ONLY the redacted text, no explanation.

Input: "Customer left due to finding a cheaper alternative with better perceived value, despite our platform's features."
Output: "Customer left due to finding a cheaper alternative with better perceived value, despite our platform's features."

Input: "My email is john at test dot com"
Output: "My email is john at test dot com" // Not regex-matched, but AI catches it

Input: "I work at Apple in Cupertino"
Output: "I work at [REDACTED] in [REDACTED]" // Both company and location

import { describe, it, expect } from 'vitest'
import { scrubWithRegex } from '@/lib/pii'

describe('PII Scrubbing', () => {
  it('redacts email addresses', () => {
    const input = 'Contact john@test.com'
    const output = scrubWithRegex(input)
    expect(output).toBe('Contact [REDACTED_EMAIL]')
  })

  it('redacts multiple PII types', () => {
    const input = 'Call John at 555-123-4567 or email jane@test.com'
    const output = scrubWithRegex(input)
    expect(output).toContain('[REDACTED_PHONE]')
    expect(output).toContain('[REDACTED_EMAIL]')
  })
})