Private beta | n8n + LLM

Protect supported structured data before it reaches your LLM.

PII Redactor is an n8n community node backed by a managed API. It detects six supported categories of structured data, replaces detected values with temporary placeholders, and lets your workflow restore those values after the LLM responds. Detection is deterministic and best effort, and the service performs reversible pseudonymization rather than complete anonymization.

Supported categories: email addresses, phone numbers, credit-card candidates, IP addresses, IBANs, and selected contextual national identifiers.

Request private beta access See how it works

Beta access includes installation instructions, a managed HTTPS Base URL, a client-specific API key, synthetic workflow examples, and direct setup support.

PII Redactor performs temporary, reversible pseudonymization. It is not irreversible anonymization. The service stores a short-lived server-side mapping so supported values can be restored.

The protected path

Redact

Replace supported PII with placeholders.

LLM

Process only the masked text.

Restore

Put the original values back once.

Original inputContact ana@example.comSent to the LLMContact {{EMAIL_1}}

+100automated tests

18countries with contextual IDs

HTTPSmanaged API

These figures describe the current synthetic corpus and environment. They do not guarantee identical accuracy on every real-world input.

A safer handoff

Protect the prompt, not the workflow.

LLMs are useful for support, forms, tickets, and internal automation, but the original input can contain information the model provider should never see. PII Redactor creates a short-lived mapping outside the LLM path. Your n8n workflow can then send the masked text to the LLM and restore the original values in the model response.

Webhook->PII Redactor
Redact->LLM->PII Redactor
Restore->Response

Readable placeholders

Values become tokens such as {{EMAIL_1}} and {{PHONE_1}}, so the model can still reason about the message.

Temporary mapping

The service temporarily stores the server-side mapping and metadata required to complete the matching Restore operation.

One-time restore

A successful Restore request consumes its mapping, even when the submitted text contains none of its known placeholders.

Client isolation

Each beta client receives a separate API key. Mappings and idempotency records are scoped to that client credential.

What the service does not do: the npm package does not include the API service. Installing the community node alone is not enough; you need a Base URL and API key supplied by the PII Redactor beta team.

Get ready

Install the node and connect your API.

PII Redactor is designed for self-hosted n8n instances that allow community nodes. Start with synthetic data while you build and verify the workflow.

What you need

A self-hosted n8n instance with community nodes enabled.
The n8n-nodes-pii-redactor package.
An HTTPS API Base URL supplied by the PII Redactor beta team.
An API key supplied by the PII Redactor beta team.

Keep keys private. Never generate your own key, reuse another customer's key, or put your key in node fields, workflow JSON, code nodes, screenshots, logs, or support requests.

n8n interface

Install from Settings

Sign in as the n8n owner or an administrator.
Open Settings > Community Nodes.
Select Install.
Enter n8n-nodes-pii-redactor@beta.
Accept the community node warning and complete installation.
Restart n8n if PII Redactor is not in the node selector.

Manual installation

For queue mode or manual community node installations, install the package in the n8n nodes directory.

npm install n8n-nodes-pii-redactor@beta

Restart every n8n process that must load the node, including all required workers in queue mode. Manual installation requires Node.js 22 or later.

Credential

Create the PII Redactor API credential

In n8n, create a credential of type PII Redactor API. Use the exact Base URL and API key assigned to your beta account.

Field	Value	Rules
Base URL	The HTTPS URL supplied by the PII Redactor beta team	No path, query string, fragment, username, or password.
API Key	The key assigned to your beta account	Store it only in the n8n credential.

Example Base URLhttps://the-api.example.com

Do not append /v1/redact or /v1/restore. Remote URLs must use HTTPS.

Step 1 | Redact

Mask the original text before the LLM sees it.

Add a PII Redactor node before your LLM and select the Redact operation. Pass the exact string that may contain supported PII.

Parameter	Purpose
Operation	Select `Redact`.
Text	The original text from the previous node.
Default Phone Country	Two-letter phone region code from the current phone-number metadata for local phone numbers.
Credential	Your `PII Redactor API` credential.

Pass a string directly

Common expressions include:

{{$json.text}}
{{$json.body.text}}

Do not wrap a string expression in JSON.stringify(). The added quotes and escapes become part of the text.

Set the phone country

Local phone numbers are supported for the countries and territories recognized by the current phone-number metadata. Set Default Phone Country to the region where the local number is valid.

International numbers beginning with + are interpreted from their calling code and normally do not depend on the selected default country.

Idempotency: use a stable, non-PII execution or correlation identifier when n8n may retry Redact. It must contain 1-128 letters, numbers, ., _, :, or -. Never reuse it with different text or a different phone country.

Supported two-letter phone region codes

The current beta accepts 245 two-letter metadata region codes. These include countries, territories, and special regional codes recognized by the phone-number library, so they should not be described as ISO 3166-1 countries.

AC AD AE AF AG AI AL AM AO AR AS AT AU AW AX AZ
BA BB BD BE BF BG BH BI BJ BL BM BN BO BQ BR BS BT BW BY BZ
CA CC CD CF CG CH CI CK CL CM CN CO CR CU CV CW CX CY CZ
DE DJ DK DM DO DZ
EC EE EG EH ER ES ET
FI FJ FK FM FO FR
GA GB GD GE GF GG GH GI GL GM GN GP GQ GR GT GU GW GY
HK HN HR HT HU
ID IE IL IM IN IO IQ IR IS IT JE JM JO JP
KE KG KH KI KM KN KP KR KW KY KZ
LA LB LC LI LK LR LS LT LU LV LY
MA MC MD ME MF MG MH MK ML MM MN MO MP MQ MR MS MT MU MV MW MX MY MZ
NA NC NE NF NG NI NL NO NP NR NU NZ OM
PA PE PF PG PH PK PL PM PR PS PT PW PY QA
RE RO RS RU RW SA SB SC SD SE SG SH SI SJ SK SL SM SN SO SR SS ST SV SX SY SZ
TA TC TD TG TH TJ TK TL TM TN TO TR TT TV TW TZ UA UG US UY UZ VA VC VE VG VI VN VU
WF WS XK YE YT ZA ZM ZW

Phone detection validates number structure, not ownership, assignment, availability, or whether the number is currently active. To reduce false positives, phone-like numbers following labels such as order, invoice, tracking, booking, reference, document ID, SSN, DNI, CPF, CURP, or similar contexts may be excluded.

Redact output

{
  "requestId": "550e8400-e29b-41d4-a716-446655440000",
  "maskedText": "Contact {{EMAIL_1}} at {{PHONE_1}}",
  "entitiesFound": { "EMAIL": 1, "PHONE": 1 },
  "phoneCountry": "US",
  "expiresIn": 900
}

Field	Meaning
`requestId`	Required by the matching Restore operation.
`maskedText`	The only version of the input to send to the LLM.
`entitiesFound`	Counts by type, never detected values.
`phoneCountry`	Country used for local phone parsing.
`expiresIn`	Lifetime assigned when the original Redact request was created.

The API never returns the PII mapping to n8n. It returns only the masked text, metadata, and request identifier.

Step 2 | LLM

Give the model placeholders, never the original field.

Use `maskedText`

Configure the LLM user message with the Redact output:

{{$json.maskedText}}

Never use the original webhook body, the original text field, or another upstream field that still contains the unmasked input.

Recommended system instruction

The text may contain privacy placeholders such as {{EMAIL_1}} or {{PHONE_1}}. Preserve every placeholder exactly. Do not translate, rename, split, combine, duplicate, or invent placeholders.

Check the whole LLM node. Review optional fields, tools, memory, tracing, prompts, and logging. None of them should receive the original text by accident.

Workflow metadata

Preserve the matching `requestId`

Some LLM nodes replace their input JSON with a new output structure. Do not assume the Redact metadata remains available automatically.

Edit Fields

Copy requestId into a field that travels with the LLM item.

Merge

Merge Redact metadata with the LLM response before Restore.

Reference Redact

Reference the Redact node directly when the item relationship is preserved.

{{$('PII Redactor - Redact').item.json.requestId}}

Adjust the node name if necessary. Test with synthetic data and confirm the value belongs to the same item and Redact operation.

Step 3 | Restore

Restore only after the model has finished.

Add a second PII Redactor node after the LLM. Select Restore, provide the model's response as a string, and pass the matching requestId.

Parameter	Purpose	Examples
Operation	Select `Restore`.	-
Text	The textual response produced by the LLM.	`{{$json.text}}`, `{{$json.output}}`
Request ID	The ID returned by the matching Redact operation.	`{{$json.requestId}}`
Credential	The same client credential used for Redact.	`PII Redactor API`

Other LLM nodes may use fields such as {{$json.message.content}}. Choose the field containing the actual response string, not the complete response object.

Restore output

{
  "requestId": "550e8400-e29b-41d4-a716-446655440000",
  "restoredText": "Contact user@example.com at +1 415 555 0132"
}

Return only what your application needs. Usually that means restoredText and selected application fields. Do not return credentials, internal configuration, or complete execution data.

Important lifecycle rules

Mappings expire and Restore is one-time

900s

The default mapping lifetime is 900 seconds. expiresIn reports the lifetime assigned when the original Redact request was created. Replaying an idempotent request does not renew or restart that lifetime.

Verify the LLM output before calling Restore. Every successful Restore request consumes the mapping, even when the submitted text contains none of its known placeholders.

404

A second Restore, an expired mapping, or a mapping removed during maintenance returns not found.

Restart

If Restore returns 404, restart the complete cycle from Redact. The mapping cannot be reconstructed.

Do not blindly retry Restore after a timeout. The first request may have succeeded and consumed the mapping even if n8n did not receive the response. Missing or modified placeholders are not API errors: they remain missing or unchanged, and a successful Restore still consumes the mapping.

Placeholder contract

What happens when the model changes a token?

Placeholders are deliberately readable and exact. They let the model work with the structure of a message without exposing the underlying value.

{{EMAIL_1}}{{PHONE_1}}{{CREDIT_CARD_1}} {{IP_ADDRESS_1}}{{IBAN_1}}{{NATIONAL_ID_1}}

Restored

Exact known placeholders are restored.

Unchanged

Modified placeholders remain unchanged.

Allowed

Missing placeholders reveal no original value. Restore does not treat a missing placeholder as an API error.

Rejected

Duplicated restorable placeholders are rejected before the mapping is consumed.

Ignored

Unknown placeholders are not replaced with PII.

Placeholder counters are independent for each entity type. Repeated occurrences receive separate placeholders. Placeholders may be reordered by the LLM and still be restored if each known placeholder remains exact and appears no more than once. All supported national identifiers use the generic NATIONAL_ID placeholder; the public Redact response reports the entity count but does not expose the country or document type.

Protect the exact spelling and braces. If the LLM changes or duplicates placeholders, discard that response and restart from Redact when necessary.

Failure handling

Know when to correct, retry, or restart.

Use the HTTP status and sanitized node output to decide what happens next. Do not retry unchanged invalid input.

HTTP	Meaning	Recommended action
400	Invalid input, country, request ID, or duplicated placeholder.	Correct the workflow input. Do not retry unchanged data.
401	Missing, invalid, or revoked API key.	Check the n8n credential and contact the PII Redactor beta team.
404	Mapping expired, consumed, unavailable, or owned by another credential.	Restart the complete cycle from Redact.
409	Idempotency request still in progress.	Retry with backoff using the same key and exactly the same payload.
409	The idempotency key was already used with different text or a different phone country.	Do not retry with that key. Correct the workflow and use a new stable key.
413	Payload exceeds the service limit.	Reduce the input size.
429	Client rate limit reached.	Retry with exponential backoff and jitter.
500	Internal service error.	Use a limited retry; contact the PII Redactor beta team if it continues.
503	The service readiness endpoint reports a dependency as unavailable.	Wait and contact the beta provider if availability does not recover.

With Continue On Fail: the node returns a sanitized error output. Treat it as an error, not as a successful Redact or Restore result.

Current coverage

Structured data, with clear boundaries.

Detection is deterministic and best effort. The service processes only the text explicitly passed to the Redact operation. It does not inspect attachments, binary files, images, PDFs, audio, workflow metadata, credentials, headers, or other n8n fields automatically.

Email addresses

ASCII email local parts with valid registrable public domains. Internationalized and punycode domains are supported. SMTPUTF8 local parts, quoted local parts, address literals, local-only domains, and malformed or non-public domains are not supported.

Supported: ana@example.comSupported: user@xn--bcher-kva.exampleNot supported: josé@example.comNot supported: "john.doe"@example.comNot supported: user@localhost

A valid domain does not prove that the mailbox exists.

Phone numbers

Valid international and local phone numbers, including extensions, for the countries and territories recognized by the current phone-number metadata. International numbers beginning with + are interpreted from their calling code.

Phone detection validates structure, not ownership, assignment, availability, or whether a number is currently active.

Credit-card candidates

Candidates containing 13-19 digits, optionally separated by spaces or hyphens, that pass the Luhn checksum.

The detector does not verify network, issuer, account existence, ownership, status, expiry date, or CVV. An unrelated number that passes Luhn may be a false positive.

IP addresses

Syntactically valid IPv4 and IPv6 addresses, including compressed IPv6, IPv4-mapped IPv6, zone identifiers, private ranges, special ranges, loopback addresses, and valid CIDR notation.

Syntax validation does not determine whether an address is public, active, reachable, assigned, or associated with a person.

IBANs

IBAN candidates must use a country or territory supported by the current IBAN registry, match the expected country length, and pass structural and checksum validation. Spaces and hyphens are accepted as separators.

A valid checksum does not prove that the account exists, is active, or belongs to a specific person.

Selected national IDs

Only the specific contextual identifier types listed below are supported. A bare number is intentionally not classified as a national identifier.

Support for a country does not mean every identity, tax, passport, residence, or driving document from that country is supported.

Detection principles

Checksums validate format plausibility, not existence or ownership.
National identifiers require a supported contextual label such as SSN, CPF, CURP, DNI, NIE, Aadhaar, or Steuer-ID.
Colombian and Argentinian identifiers receive format and length validation but no checksum validation in the current version.
False positives and false negatives are possible.

Not currently supported

Personal names, geographic locations, and postal addresses.
Organization names and free-form or inferred sensitive information.
Dates of birth, passport numbers, driver's licence numbers, and residence permits.
Generic tax identifiers outside the explicitly listed types.
Non-IBAN bank account numbers.
Usernames, social-media handles, passwords, access tokens, API keys, and arbitrary secrets.
Medical record numbers and biometric information.
PII in images, PDFs, audio, scans, attachments, metadata, or fields not passed to Redact.

Contextual national identifiers

National identifiers are detected only when accompanied by a supported contextual label. Support for a country does not mean that every identity, tax, passport, residence, or driving document from that country is supported.

Country	Supported identifier
Argentina	DNI
Australia	TFN
Brazil	CPF
Canada	SIN / NAS
Chile	RUN and personal RUT context
China	Resident Identity Number
Colombia	Cédula de ciudadanía
France	NIR
Germany	Steuer-ID
India	Aadhaar
Italy	Codice Fiscale
Japan	My Number
Mexico	CURP
Poland	PESEL
South Africa	South African ID
Spain	DNI / NIE
United Kingdom	NINO
United States	SSN

All supported national identifiers use the generic {{NATIONAL_ID_1}} placeholder. The public Redact response reports the entity count but does not expose the country or document type. The current beta does not announce every class of Spanish NIF; use the listed DNI / NIE scope.

Supported two-letter IBAN registry codes

The current version of the IBAN registry contains 124 supported country or territory codes.

AD AE AL AO AT AX AZ BA BE BF BG BH BI BJ BL BR BY
CF CG CH CI CM CR CV CY CZ DE DJ DK DO DZ EE EG ES
FI FK FO FR GA GB GE GF GI GL GP GQ GR GT GW HN HR HU
IE IL IQ IR IS IT JO KM KW KZ LB LC LI LT LU LV LY MA MC MD ME MF MG MK ML MN MQ MR MT MU MZ NC NE NI
NL NO OM PF PK PL PM PS PT QA RE RO RS RU SA SC SD SE SI SK SM SN SO ST SV TD TF TG TL TN TR UA VA VG WF XK YE YT

Important limitations: false positives and false negatives are possible. Local phone detection depends on the selected country, and synthetic test results do not guarantee identical accuracy on real data.

Privacy and operations

Reduce exposure across the whole workflow.

PII Redactor reduces the structured PII sent in the selected LLM text field. It does not protect unsupported entities, missed detections, other node fields, attachments, memory, tools, traces, logs, execution history, error workflows, or external observability systems.

Short-lived maps

The service temporarily stores the server-side mapping and metadata required to complete the matching Restore operation. The default mapping lifetime is 900 seconds.

No PII mapping in n8n

The API does not return the mapping or detected values to the node. It returns counts and the masked text.

Redis storage

Pending mappings are stored in Redis and are not encrypted at the application layer. Access is protected through infrastructure controls, tenant-scoped keys, HTTPS, and network restrictions.

Client isolation

Each beta client receives a separate API key. Mappings and idempotency records are scoped to that client credential, with rate limiting per client.

Technical control, not legal compliance: this service does not by itself establish GDPR, HIPAA, CCPA, or other legal compliance. It does not replace access control, retention, consent, incident response, or data-governance obligations.

Review n8n retention: n8n receives the original input before Redact and may retain it in execution history. Review credential encryption, successful and failed execution retention, pruning, error workflows, manual execution history, and external logging, tracing, or APM integrations. Avoid saving complete inputs or restored responses unless operations require them.

Current beta limits

Plan around the current deployment.

These operational limits describe the current beta deployment and may change after the beta. Confirm current limits with the beta team before production planning.

250,000

Maximum text length

Maximum JavaScript characters passed as Redact text.

256 KB

Maximum request body

Maximum complete JSON request body.

900s

Default mapping lifetime

Returned lifetime is assigned when the original Redact request is created.

120/min

Authenticated rate limit

Current limit per beta client.

One-time

Restore behavior

Restore is one-time and non-idempotent.

No scale-out

API deployment

The current beta does not support horizontal API scaling.

Redis

Pending mappings

Restarting or clearing Redis removes pending mappings.

Node 22+

Manual installation

Node.js 22 or later is required for manual installation.

Troubleshooting

Quick answers to common setup issues.

The node does not appear

Confirm the package appears under Settings > Community Nodes, restart n8n, and install it on every required process in queue mode. Confirm the runtime uses a supported Node.js version.

The credential returns unauthorized

Confirm the PII Redactor beta team supplied the Base URL and key. Remove accidental spaces or line breaks, check whether the key was rotated or revoked, and never post it in a support request.

The LLM sees quoted or escaped text

Pass the string field directly. Do not call JSON.stringify() around the n8n expression.

A local phone number is not masked

Set Default Phone Country to the country where the local format is valid. Use the international + form when possible.

Restore returns 404

The mapping expired, was consumed, was removed during maintenance, or belongs to another credential. Restart from Redact.

Placeholders remain in the final response

Confirm the LLM preserved exact spelling and braces, Restore received a string, the matching requestId was used, and the mapping had not expired.

Safe support requests

Share the problem, not the sensitive data.

Never send real PII, API keys, complete request bodies, mapping contents, or full execution logs.

Node package version
Operation: Redact or Restore
HTTP status or sanitized node error
Entity type and country
Synthetic or manually redacted example
Expected and actual behavior
requestId only when requested and permitted by your support policy

Safe example

Package version: 0.4.0-beta.1
Operation: Redact
Country: CO
Synthetic text: "Call [CO_LOCAL_PHONE]"
Expected: PHONE placeholder
Actual: No entity detected

idrobo.developer@gmail.com

FAQ

Before you use the node.

Does the LLM receive the original data?

It should receive only maskedText. The operator is responsible for ensuring optional LLM fields, memory, tools, traces, prompts, and logs do not receive the original input.

Does PII Redactor detect every kind of PII?

No. It covers specific structured entities. Names, postal addresses, organizations, OCR, and every possible format are outside the current scope.

What if the LLM changes a placeholder?

A modified placeholder cannot be restored. Use a system instruction that requires exact preservation and discard or restart the cycle if the response is unsafe.

Can I restore the same request twice?

No. A successful Restore consumes the mapping. A second request returns 404, so a new Redact cycle is required.

What happens if Restore times out?

Do not blindly retry. The first request may have succeeded and consumed the mapping. Check the workflow state and restart from Redact if the mapping is no longer available.

Can I use real data during the beta?

Build and test with synthetic or controlled data first. Review n8n execution retention and your internal privacy requirements before processing real information.

Private beta

Try PII Redactor with a workflow that matters.

We are looking for a small number of teams already using self-hosted n8n and LLMs for support, forms, tickets, or internal processes.

Estimated duration: 1-2 weeks
Free pilot with no commitment
Synthetic or controlled data at the start
Direct support during the trial
Focused workflows and known use cases

REQUEST ACCESS

Tell us which workflow you want to protect.

Include the automation type, entities you expect to detect, and whether your n8n instance is self-hosted.

Contact the beta team Do not send real PII or API keys by email. Use synthetic or manually redacted examples.

Protect supported structured data before it reaches your LLM.

Protect the prompt, not the workflow.

Readable placeholders

Temporary mapping

One-time restore

Client isolation

Install the node and connect your API.

What you need

Install from Settings

Create the PII Redactor API credential

Mask the original text before the LLM sees it.

Pass a string directly

Set the phone country

Supported two-letter phone region codes

Redact output

Give the model placeholders, never the original field.

Use maskedText

Preserve the matching requestId

Edit Fields

Merge

Reference Redact

Restore only after the model has finished.

Restore output

Mappings expire and Restore is one-time

What happens when the model changes a token?

Know when to correct, retry, or restart.

Structured data, with clear boundaries.

Email addresses

Phone numbers

Credit-card candidates

IP addresses

IBANs

Selected national IDs

Detection principles

Not currently supported

Contextual national identifiers

Supported two-letter IBAN registry codes

Reduce exposure across the whole workflow.

Short-lived maps

No PII mapping in n8n

Redis storage

Client isolation

Plan around the current deployment.

Maximum text length

Maximum request body

Default mapping lifetime

Authenticated rate limit

Restore behavior

API deployment

Pending mappings

Manual installation

Quick answers to common setup issues.

Share the problem, not the sensitive data.

Before you use the node.

Does the LLM receive the original data?

Does PII Redactor detect every kind of PII?

What if the LLM changes a placeholder?

Can I restore the same request twice?

What happens if Restore times out?

Can I use real data during the beta?

Try PII Redactor with a workflow that matters.

Tell us which workflow you want to protect.

Use `maskedText`

Preserve the matching `requestId`