Data perimeter
Secrets and PII detected, classified and masked before storage and before inference.
Content passing into a memory is scanned before it is embedded or stored, and scanned again before it reaches a model. Masking happens at the level of the individual value, not the surrounding chunk.
Why value-level matters
The obvious implementation — drop any chunk containing a secret — destroys the knowledge along with the liability. A paragraph explaining how a system works, which happens to include an example key, becomes unavailable.
Value-level masking keeps the sentence and removes the secret:
Before: Connect with sk-proj-Xt7fQ2mLpR9vNa4KdW1zYb8H then call /v1/index
After: Connect with [REDACTED:API_KEY] then call /v1/indexThe citation still works, the explanation still reads, and the credential is gone before it reaches the vector store.
What is detected
| Category | Examples |
|---|---|
| API keys | Provider-prefixed and generic high-entropy tokens |
| Credentials | Passwords in configuration and connection strings |
| Payment data | Card numbers, validated by checksum so ordinary 16-digit numbers do not false-flag |
| Connection strings | Database URLs with embedded credentials |
| Cryptographic material | PEM private keys and certificates |
| Tokens | Signed web tokens |
| Personal identifiers | National identity numbers |
| Custom | Tenant-defined patterns |
Classification
Every value lands in one of four classes:
| Class | Handling |
|---|---|
PUBLIC | No restriction |
INTERNAL | Visible in the tenant |
CONFIDENTIAL | Masked before inference; role-gated in responses |
RESTRICTED | Never sent to a model, never returned to any role |
Three enforcement points
The pre-inference filter re-scans free text even though ingest already scanned it. That redundancy is intentional: it catches anything that entered through a path which bypassed the ingest scan.
Fail-closed
If the scanner cannot run, ingestion fails. Content is not stored unscanned.
The request returns 503 with CHORD_DLP_UNAVAILABLE and the task retries.
Failing open here would mean a scanner outage silently writing unscanned secrets
into the index — the one outcome the whole subsystem exists to prevent — so this
behaviour is not configurable.
The perimeter is feature-flagged. Confirm it is enabled in your environment before relying on it, and before repeating any claim about it externally.
What this is not
The perimeter prevents leaks. It does not detect attacks. There is no prompt-injection scanning, no jailbreak detection and no output moderation. If your users can put arbitrary text in front of a model through your application, that risk is yours to handle.