Turning the firewall on
Use the Enabled switch in the top right of the page. It takes effect immediately, with no separate save step. The firewall is on by default for new organisations: routing personal data to a model is treated as something you opt out of, not into.How pseudonymization works
When a request runs through the firewall, detected entities are replaced with tokens such as<PERSON_1> or <EMAIL_1>. The mapping from token to original value lives only for the duration of the request and is never sent to a provider. After the model responds, the tokens in the output are replaced with the original values before the response is returned to you.
Because the same value always maps to the same token within a request, the model can still reason about relationships: two mentions of the same person stay consistent.
What the firewall does when it finds something
A workspace picks one of three actions.- Log. Pseudonymize and carry on. The default, and the one that never interrupts anybody.
- Ask. Suspend the request and let a person decide, one value at a time.
- Block. Refuse the request outright.
/v1/chat/completions cannot, so a workspace set to Ask gets a typed refusal there rather than a silent downgrade to Log. That is deliberate: quietly weakening the action you chose is worse than telling you it does not apply.
The question names what was found, shows the value rather than the placeholder it would become, and says where in the conversation it came from, including which command printed it when a client tells us. A person cannot judge “PERSON detected” on a file listing; they can judge their own username appearing in a path.
Remembering what somebody allowed
Answering always allow records the value so it is never proposed again. Exactly that value, matched case-insensitively and never as a pattern: allowingjellespekken does not exempt jelle@customer.com.
Exemptions have two tiers.
- Personal. Applies only to messages attributable to the person who answered. Anyone may create one.
- Workspace-wide. Applies to everybody’s messages. Creating one needs the PII firewall permission.
<PERSON_1> is worth nothing: it cannot be matched against a later question, and a person asking what the assistant knows about them would be shown a placeholder. The store is Akumi’s own and EU-resident, and a stored fact is masked again every time it re-enters a prompt, because recalled facts are injected before the firewall and pseudonymised with everything else.
What it means in practice is that “allow once” is a decision about one request rather than about the record. Erase the fact if you want it gone: memory is readable and erasable per person, and erasing is the control for what the platform keeps.
An exemption reaches Guard as well as the firewall. Guard scores what the model writes against ten content categories, one of which is also called PII, and it can be set to refuse an answer outright. Without this, a value you had declared not personal would still get answers refused for containing it: you would have answered the question and been asked again, by something that does not take an answer.
So an allowed value is taken out of the text before Guard’s moderation detector reads it. Only that detector, and only that text. A term an admin blocked still blocks, because blocked terms are a different rule about different things, and none of the other nine categories change.
This is wider than “stop asking me about my own name”, which is what most people are answering when they allow a value. Read it as: the value is not personal data here, and in what the assistant writes back.
Be aware of what an exemption cannot do: it stops a value being detected, so it cannot distinguish two people who share a name. Exempting “Jan Jansen” means Jan Jansen is not masked in your messages, whichever Jan Jansen is meant.