AI + Sensitive Data = Risk. Content Scanning = Control.

Users will accidentally paste sensitive data into AI prompts. Credit card numbers, social security numbers, API keys, patient information—it happens.

Content scanning catches these mistakes before data leaves your perimeter.

What Gets Scanned

Personally Identifiable Information (PII):

• Social Security Numbers
• Credit card numbers
• Phone numbers
• Email addresses
• Physical addresses
• Names + identifying info

Protected Health Information (PHI):

• Medical record numbers
• Diagnosis information
• Treatment details
• Insurance identifiers

Financial Data:

• Bank account numbers
• Financial statements
• Trading information

Security Credentials:

• API keys
• Passwords
• Tokens
• Certificates

Custom Patterns:

• Your specific sensitive data types
• Industry-specific identifiers
• Internal classification markers

How Scanning Works

[User Input]
     ↓
[Content Scanner]
     ↓
[Pattern Detection]
     ↓
[Policy Check]
     ↓
[Allow/Block/Redact]
     ↓
[If allowed: Send to LLM]

Scanning happens before data reaches the AI model.

Scan Actions

When sensitive content is detected:

Block: Stop the request entirely. User sees error message.

Redact: Remove/mask sensitive portions, continue with sanitized input.

Warn: Alert user, allow to proceed if confirmed.

Log: Record the detection for audit, allow request.

Configure based on data type and risk tolerance.

Scanning Responses Too

Scan AI outputs, not just inputs:

Why scan outputs?

• AI might generate data similar to training data
• RAG might surface sensitive documents
• Prompts might trick AI into revealing information

Response scanning: Same detection, applied to AI responses before showing to user.

Detection Quality

Content scanning effectiveness depends on:

Pattern accuracy: Good patterns catch real sensitive data without excessive false positives.

Coverage: All the data types you care about are covered.

Performance: Scanning doesn’t add unacceptable latency.

Tuning: Adjust sensitivity based on your needs.

False Positives

Some legitimate content looks like sensitive data:

Example numbers: “Use SSN format: XXX-XX-XXXX” → Pattern match, not real SSN

Test data: “Test credit card: 4111-1111-1111-1111” → Known test number

Documentation: Explaining data formats, not exposing data

Handle with:

• Allow lists for known test data
• Context-aware detection
• Human review for ambiguous cases

Compliance Support

Content scanning supports compliance:

GDPR: Prevent PII from inappropriate processing HIPAA: Block PHI from unauthorized exposure PCI DSS: Catch credit card numbers Internal policies: Enforce data classification rules

Scanning provides evidence of control for auditors.

Configuring Scanning

In Zentinelle:

1. Enable scanning for your organization
2. Select data types to detect
3. Configure actions per data type
4. Add custom patterns as needed
5. Set up alerts for detections
6. Review logs regularly

The Content Scanning Checklist

Implementing content scanning:

• Identify sensitive data types for your organization
• Configure detection patterns
• Set appropriate actions (block/redact/warn/log)
• Test with sample sensitive data
• Train users on what triggers scans
• Monitor detection logs
• Tune for false positive reduction

Catch mistakes before they become breaches.

Set up content scanning with Zentinelle →