Module 6 · Lesson 3 of 3

Personal data in prompts and logs

What the app does with the details
Asha, writes to supportAshawrites to supportSupport app, builds the prompt, NOWSupport appbuilds the prompt2 personal detailsNOWModel provider, another companyModel provideranother companyYour logs, kept for 30 daysYour logskept for 30 days
  • Asha — writes to support — healthy
  • Support app — builds the prompt — healthy — NOW — 2 personal details
  • Model provider — another company — healthy
  • Your logs — kept for 30 days — healthy
  • Message or prompt
  • Answer
  • Log line
Step 1 of 5

Step 1 of 5 · Support app

Done: Asha writes a message with her card number and email

What happens
"My card is 4111 1111 1111 1111 and my email is asha@example.com. Where is my parcel?"
Why
People paste personal details into chats, even when nobody asks for them.
What changes
The app must decide what leaves its own servers.
Next
The app builds the prompt from the message as it is

Event log

4 more to go. Press a line to go back to that step.

Places outside the app with the card number
0
Places outside the app with the email
0
What your logs keep
nothing yet
What the provider receives
nothing yet
What your logs keep
nothing yet

Step 1 of 5: Support app. Asha writes a message with her card number and email. "My card is 4111 1111 1111 1111 and my email is asha@example.com. Where is my parcel?"

What this simplifies. 4111 1111 1111 1111 is a standard test card number, not a real one. Replacing details lowers the risk but does not remove it, since checks miss some. Read your provider's terms on how long it keeps prompts and what it uses them for.

Users paste personal details into chats: card numbers, emails, addresses, health facts. Whatever goes into a leaves your servers and reaches the model provider. What it keeps, and for how long, depends on its terms and your account.

The safest detail is one that never leaves. Before the call, replace details the model does not need with placeholders, such as [CARD] and [EMAIL]. Keep the real values in the app, and put them back into the answer if needed.

Pattern checks find card numbers and email addresses well. Names and addresses in free text are harder: a detection model helps, but it misses some. So replacing details lowers the risk; it does not remove it.

Your own logs are the other copy. A log of every full prompt copies every detail into backups and other tools. Log the request id, counts and timing, and keep full text only where you must, for a short time.

Example. In the picture, sending the message as it is puts the card number in 2 places outside the app: the provider and your logs. Replacing details first puts it in none.

In system design: Decide what may leave the app, replace the rest before the call, and log ids and counts instead of full prompts.

Check yourself

A support bot logs every full prompt for debugging. Users often paste card numbers. What is the best fix?