CAIN-42 CAIN StudioCGMS · Module 3 of 5 · 13 min
Personal data in prompts, memory and logs
Agents copy personal data everywhere: into prompts, memory, tool arguments and logs. Each copy is a privacy obligation (purpose limitation, minimisation, retention, erasure).
Redact before storing: detect identifiers (emails, phone numbers, IDs, card numbers) and replace them with typed placeholders; keep a reversible mapping only where strictly needed and protect it separately.
Evidence logs need care too: hash or redact personal data so audit trails do not become a breach.
Key points
- Every copy of PII is an obligation.
- Redact before storing; typed placeholders.
- Protect any reversible mapping separately.
- Audit logs must not leak PII.
In the CAIN-42 codebase
pii-redactor/— PII detection and redaction service
Practice check
Practice 1 · choose one
Best time to redact personal data from agent memory is…
Practice 2 · true or false