P-1 masks personal data before model calls

Respan is deploying P-1 to detect and mask personal data in requests sent to AI models, with claimed performance results based on 20,000 samples.

A name, email address, or phone number can now be removed from a request before it continues through an AI application. Respan has introduced P-1, its new model for detecting and masking personally identifiable information, which now powers the platform’s PII Redaction feature.

The goal is to intercept sensitive data without significantly slowing model calls or unnecessarily removing useful information. The feature can be enabled with a single toggle in Respan, eliminating the need for each application to integrate its own detection system.

P-1 is not presented as a conversational model. It analyzes a request to identify segments containing information that could identify an individual, then masks them before the request moves to the next processing stage. This can reduce the amount of personal data transmitted to the provider generating the response.

Respan places this protection at the gateway level. Its gateway already provides a shared interface for more than 1,000 models, along with routing, retries, fallbacks, caching, and spending limits. The company can therefore apply the same control to requests sent to multiple providers instead of relying on each provider’s own privacy features.

The announcement does not explain exactly what replaces the detected information. A value could be deleted, replaced with a generic category, or converted into a temporary identifier that allows it to be restored later. Each approach has different consequences for response quality and the ability to recover the original value.

An assistant drafting an email may work perfectly well with placeholders such as `[NAME]` and `[EMAIL]`. An agent updating a customer record, however, may need consistent references across several messages or tool calls. Simply removing a value is not always enough: the system may need to preserve useful relationships without exposing the person’s identity.

Respan says it compared P-1 with several PII redaction providers using 20,000 samples drawn from four established public datasets. According to the company, the model achieved the highest overall F1 score.

F1 combines precision and recall. Precision measures how many detected items are actually personal information, while recall measures how much of the personal information present in the text the system successfully identifies. A strong result therefore requires the model to catch sensitive data without routinely removing ordinary content.

The company places particular emphasis on documents containing no personal information. P-1 reportedly produced the lowest clean-document false-alarm rate on all four datasets. This matters in production: an overly aggressive filter can remove company names, necessary dates, product references, or numbers that are not private.

For now, these results remain company claims. The launch post does not name the four datasets, identify the competing providers, or publish detailed scores. It also does not explain how Respan mapped categories that may differ from one service to another.

An overall average can conceal substantial weaknesses. A system may perform well on email addresses and phone numbers while struggling with postal addresses, dates associated with individuals, government identifiers, or indirect references. Category-level results would be needed to determine where P-1 provides a measurable improvement.

Language coverage is another unknown. Card numbers follow relatively stable patterns, while names, addresses, and medical details depend more heavily on language and context. Respan has not published a list of supported languages or separate results for each one.

The total of 20,000 samples does not reveal how diverse the evaluation was. Results depend on the balance between documents containing personal information and clean documents, the number of entities per text, document length, and the presence of expressions that resemble sensitive data without actually being sensitive.

The use of public datasets should theoretically make the benchmark reproducible. That would still require access to the evaluation protocol, dataset splits, normalization rules, detection thresholds, and the version of every competing service. The announcement is not currently accompanied by a repository, evaluation script, or full technical report.

The description of P-1 as “the world’s best privacy model” should therefore be understood as Respan’s conclusion from its own comparison. It is not yet an independently reproduced result or an evaluation covering every aspect of data protection.

Privacy also extends beyond PII detection. A document can reveal a medical condition, political opinion, business strategy, or internal secret without containing a name, phone number, or direct identifier. Some information only becomes identifying when combined with other details.

The NIST definition includes information that can distinguish or trace an individual’s identity, whether used alone or in combination with other data. European personal-data rules similarly cover indirect identification. A filter based on predefined categories therefore cannot guarantee that a document has been anonymized.

Masking is often closer to pseudonymization than permanent anonymization. A person may still be identifiable from the remaining context or through a table linking placeholders to the removed values. The UK data protection authority notes that pseudonymized information remains personal data.

P-1 must also be distinguished from a technical-secret detector. An API key, password, or access token may not identify an individual, but exposing it can create a more immediate security risk. The announcement does not provide a complete list of supported categories or confirm whether credentials fall within its scope.

Speed is the other part of the promise. Respan says P-1 is fast enough to run on every request, but it has not published median latency, higher-percentile measurements, throughput, or a reference document length. The additional delay between