Seu agente IA expõe CPF/cartão cliente (sem PII detection automático)

Seu agente IA expõe CPF/cartão cliente (sem PII detection automático)

Você é founder/CEO de SaaS.

Seu SaaS: agente IA no WhatsApp (atendimento, vendas, suporte).

Seu agente: Conversa com clientes (eles mandam dados sensíveis).

Ontem: Amazon lançou PII detection automático (Bedrock, model-agnostic).

What customer sends to your agente (typical day):

• "Meu CPF é 123.456.789-00"
• "Meu cartão é 4111 1111 1111 1111"
• "Meu número de telefone é 11 98765-4321"
• "Meu email é cliente@empresa.com"
• "Quero resolver este problema: [sensitive context]"

Your agente's response (probably):

• ✅ Stores conversation (log database)
• ✅ Sends to LLM (CloudFlare, OpenAI, AWS)
• ✅ Logs response (compliance audit trail)
• ❌ Does NOT detect it's PII (treats it like normal text)
• ❌ Does NOT mask it (raw data in transit)
• ❌ Does NOT alert you (silent data leak)

Your assumption (WRONG):

• "Customer knows not to send sensitive data (that's their fault)"
• "If data leaks, LLM vendor is responsible (they have contracts)"
• "My agente isn't storing sensitive data (I think)"
• "LGPD fines only apply to big companies (I'm small)"
• "If customer never complained, probably no leak (no news is good news)"

Your reality (Amazon Bedrock just proved otherwise):

• PII detection now automatic (Sept 2026, Amazon Bedrock release)
  • What it means: LLMs can NOW reliably detect CPF, cartão, phone, email, home address
  • Timeline: This wasn't possible before (now it is)
  • Coverage: Works with ANY LLM (OpenAI, Claude, Bedrock, open-source)
  • Accuracy: Tested on 5 public PII corpora, 9 LLM detectors (industry standard)
  • Signal: If Amazon is releasing it, other vendors will too (table-stakes)
  • Implication: Not having PII detection = negligent (when it's available)
  • LGPD risk: Regulator will ask "Why didn't you use PII detection?" (you have no answer)
  • Customer trust: If PII leaked and you didn't detect it, liability is HIGHER

---

What is PII (and why your agente is leaking it)

PII categories (what counts as sensitive data)

PII = Personally Identifiable Information

Category 1: Government IDs ├─ CPF (Cadastro de Pessoa Física) = Social Security equivalent ├─ CNPJ (Company ID) = Tax ID ├─ RG (Regional ID) = Government ID ├─ CNH (Driver's License) = Driving license ├─ Passport = Travel document ├─ Voter registration = Voting ID └─ Risk: If leaked, identity theft is easy (government ID = complete access)

Category 2: Financial info ├─ Credit card number (16 digits) ├─ Debit card number (16 digits) ├─ Bank account number ├─ Routing number ├─ Bank balance ├─ Credit score └─ Risk: If leaked, money stolen (fraud, unauthorized charges)

Category 3: Contact info ├─ Email address (personal) ├─ Phone number (mobile) ├─ Home address (street, city, zip) ├─ Business address ├─ Workplace phone └─ Risk: If leaked, targeted attacks (spam, phishing, harassment)

Category 4: Biometric data ├─ Fingerprint ├─ Face recognition data ├─ Iris scan ├─ Voice biometric └─ Risk: If leaked, can't change (unlike password)

Category 5: Health/sensitive info ├─ Medical records ├─ Diagnoses ├─ Medications ├─ Mental health info ├─ Sexual orientation ├─ Genetic info └─ Risk: If leaked, discrimination (employment, insurance, social)

Your agente probably leaks: ├─ CPF (customers give it for identity verification) ├─ Phone/email (for contact callback) ├─ Partial credit card (for payment verification) ├─ Home address (for delivery confirmation) ├─ Medical symptoms (for health-related support) └─ Financial status (for credit assessment)

Key insight: ├─ You're NOT intentionally collecting PII ├─ Customer is VOLUNTARILY sending it (in conversation) ├─ Your agente is NOT FILTERING it (just logs as-is) ├─ Your database is STORING it (unmasked, unencrypted) ├─ Your logs are EXPOSED (anyone with access sees PII) └─ Liability is YOURS (not customer's, not LLM vendor's)

How your agente leaks PII (data flow)

Typical agente conversation flow (with PII exposure):

Step 1: Customer sends message to your WhatsApp agente ├─ Message: "Oi, tenho problema. Meu CPF é 123.456.789-00. Ajuda?" ├─ Transport: WhatsApp → Your servers (encrypted in transit) └─ Problem: Message contains PII (CPF is exposed)

Step 2: Your agente logs the message ├─ Storage: Saves to database (message table) ├─ Format: Raw text, unmasked ├─ Access: Anyone with database access sees CPF ├─ Backup: CPF is backed up (in case of restore) └─ Problem: PII is stored as-is (no masking)

Step 3: Your agente sends to LLM (for processing) ├─ API call: "Claude, analyze this customer issue" ├─ Payload: Full message (including CPF) ├─ Transport: Your API → LLM provider (encrypted) ├─ LLM logs: LLM provider logs your API call (with CPF) └─ Problem: LLM vendor now has PII (part of training data?)

Step 4: LLM processes and responds ├─ Processing: Claude reads message (sees CPF) ├─ Response: "I see you're having issue with account XXX, let me help" ├─ Log: LLM provider logs the conversation (CPF visible) ├─ Risk: If LLM provider has breach, CPF is exposed └─ Problem: PII is now in LLM vendor's logs

Step 5: Your agente logs the LLM response ├─ Storage: Saves response to database ├─ Format: Full response, context including customer CPF ├─ Access: Your team can see customer PII when reviewing logs ├─ Backup: Backup includes PII └─ Problem: PII is stored in your database (permanently)

Step 6: Compliance audit ├─ Regulator: "Show me your data security practices" ├─ You: "We use encryption, backups, access control" ├─ Regulator: "Do you detect PII automatically?" ├─ You: "Uh... no, we just store it as-is" ├─ Regulator: "Why not? Amazon Bedrock has PII detection (since Sept 2026)" ├─ You: "I didn't know..." ├─ Regulator: "That's negligence. Fine: R$ 100-500K" └─ Problem: LGPD violation (you SHOULD detect PII)

Data exposure points: ├─ Your database (raw PII logged) ├─ Your backups (PII in backups) ├─ Your logs (any team member can see) ├─ LLM vendor (PII in their logs) ├─ LLM vendor backup (if they have breach) ├─ Third-party integrations (if you forward data) ├─ Team members with database access (can see PII) └─ Hacker with database breach (can steal all PII)

Liability chain: ├─ Customer gave you CPF (trusting you'd protect it) ├─ You logged it (without masking) ├─ You sent to LLM vendor (without notifying) ├─ Breach happened (hacker got your database) ├─ CPF stolen (identity theft occurs) ├─ Customer sues (you're responsible) ├─ LGPD regulator fines (you failed to protect) └─ Reputation damaged (customers lose trust)

---

Amazon's PII detection (how it works, why you need it)

PII detection layer (new capability)

Traditional approach (before Amazon Bedrock PII detection):

├─ Customer sends PII to agente ├─ Your agente logs it (as-is) ├─ Your team reviews it (can see PII) ├─ No automatic detection (you rely on manual review) ├─ Risk: Someone forgets to redact PII (human error) ├─ LGPD compliance: Partial (you tried, but not automated) └─ Fine if caught: R$ 50-200K (failed to implement protection)

Amazon Bedrock PII detection approach (NEW):

├─ Customer sends PII to agente ├─ Detection layer scans message (BEFORE storing) ├─ Classification: "This message contains CPF (PII)" ├─ Automatic masking: Stores as "CPF" instead of actual number ├─ LLM processing: LLM processes masked version ├─ Team review: Team sees masked version (can't see actual CPF) ├─ Audit: Flagged as "PII detected, masked" (compliance proof) └─ LGPD compliance: Full (automated, auditable protection)

Key capabilities (Amazon Bedrock):

1. Detection accuracy ├─ Tested on 5 public PII corpora (industry standard benchmarks) ├─ 9 LLM-based detectors (compared against best-in-class) ├─ Works across languages (English, Portuguese, Spanish, etc) ├─ Works with ANY LLM (OpenAI, Claude, Bedrock, open-source) └─ Accuracy: 95-99% on known PII types

2. Masking strategies ├─ Full mask: "123.456.789-00" → "CPF" ├─ Partial mask: "123.456.789-00" → "123..-00" ├─ Redact: Remove PII entirely (don't send to LLM) ├─ Hash: Convert to hash (irreversible, for audit trail) └─ Custom: Your own masking logic

3. Configurable detection ├─ Instruction-driven: Tell system what to detect ├─ Custom models: Train on your PII patterns (if generic doesn't work) ├─ False positive handling: What to do if unsure (mask or allow?) ├─ Confidence thresholds: Only mask if >95% certain it's PII └─ Contextual detection: "123456789" might be CPF (context-dependent)

4. Integration with LLM processing ├─ Pre-processing: Mask PII BEFORE sending to LLM ├─ In-processing: LLM processes masked version ├─ Post-processing: Un-mask in response (if needed) ├─ Audit trail: Log what was masked, why └─ Compliance proof: Demonstrate LGPD compliance

Cost: ├─ Amazon Bedrock: Included (no extra charge for detection) ├─ Implementation: R$ 10-30K (engineering, testing, deployment) ├─ Maintenance: Minimal (updates, monitoring) └─ ROI: Infinite (prevents R$ 100K-1M fine if caught without protection)

Why Amazon released this NOW (market signal)

Why now? (Sept 2026)

1. LGPD enforcement is increasing ├─ Regulator: ANPD is now actively fining companies ├─ Trend: Number of LGPD fines increasing 300% YoY ├─ Average fine: R$ 100-500K per incident ├─ Signal: Amazon knows market will demand PII detection └─ Action: Release it now, before competitors

2. LLM agentes are problematic ├─ Problem: Customers send PII to agentes (natural behavior) ├─ Risk: Agentes log/process/expose PII (not designed to protect) ├─ Trend: More companies using agentes (WhatsApp, support, etc) ├─ Demand: Market needs PII protection for agentes └─ Action: Amazon releases capability (meets demand)

3. Regulatory pressure ├─ LGPD: Requires protection of personal data (automatically) ├─ GDPR: Similar requirements in Europe (already enforced) ├─ Expected: LGPD will follow GDPR (strict enforcement) ├─ Vendors: Amazon needs to show they can help with compliance └─ Action: Release PII detection (demonstrates responsibility)

4. Competitive differentiation ├─ OpenAI: Has basic PII detection (private, limited) ├─ Anthropic: Probably working on it (hasn't announced) ├─ Bedrock: First to release production-ready version ├─ Market: Companies will choose vendors with PII detection └─ Action: Amazon races to market (first-mover advantage)

What this means for you: ├─ Amazon is signaling: PII detection is now table-stakes ├─ Regulators are watching: LGPD enforcement is coming ├─ Competitors will copy: Other vendors will release similar features ├─ Your agente MUST have: PII detection (or be non-compliant) └─ Timeline: 6-12 months before regulators expect this (start NOW)

---

How to implement PII detection (action plan)

Week 1: Audit current agente (what PII are you logging?)

• Query your database: "Show me last 100 customer messages"
• Scan manually: Are there CPF, cartões, phones, emails, addresses?
• Document findings: "We found 47 CPFs, 23 cartões, 156 phones in 100 messages"
• Estimate scale: If 100 messages = 47 CPFs, then 1M messages = 470K CPFs exposed
• Calculate liability: If LGPD fine is R$ 100 per PII exposed, 470K CPFs = R$ 47M (ouch)

Week 2: Choose implementation (which platform?)

Option A: Amazon Bedrock PII detection (recommended)

• Cost: R$ 10-30K (implementation)
• Timeline: 2-4 weeks (relatively simple)
• Accuracy: 95-99% (industry-leading)
• Coverage: Any LLM (OpenAI, Claude, Bedrock, open-source)
• Compliance proof: Full LGPD documentation
• Recommendation: Best option (AWS ecosystem, production-ready)

Option B: OpenAI PrivacyFilter (if using ChatGPT)

• Cost: R$ 5-15K (implementation)
• Timeline: 1-2 weeks (simple)
• Accuracy: ~90% (good, but less than Bedrock)
• Coverage: OpenAI only (can't use with Claude, Bedrock, open-source)
• Compliance proof: Limited (OpenAI handles it, you just use it)
• Recommendation: Good if you only use OpenAI

Option C: Open-source PII detector (if budget-constrained)

• Cost: R$ 50-150K (development, training, maintenance)
• Timeline: 4-8 weeks (more complex)
• Accuracy: ~85% (good, but requires tuning)
• Coverage: Any LLM (your code runs locally)
• Compliance proof: You control it completely
• Recommendation: Only if you have engineering resources

Option D: Manual review layer (if no budget)

• Cost: R$ 0 upfront (but ongoing labor)
• Timeline: Immediate (add human filter)
• Accuracy: ~95% (humans are good at this)
• Coverage: Any LLM (humans review before processing)
• Compliance proof: Manual review log
• Recommendation: Short-term band-aid (not scalable)

Week 3-4: Implement & test

• Set up PII detection (Bedrock, OpenAI, or custom)
• Configure masking rules (which PII types? how to mask?)
• Test on sample data (1000 messages with known PII)
• Measure accuracy (precision, recall)
• Iterate on false positives/negatives
• Document process (for compliance audit)

Week 5: Deploy to production

• Enable PII detection for new messages (BEFORE they're stored)
• Backfill old messages (retrospectively mask existing PII)
• Monitor false positives (PII wrongly detected)
• Monitor false negatives (PII missed)
• Alert on high-risk PII (CPF, cartão)
• Weekly audits (sample flagged messages)

Estimated timeline: 4-6 weeks

Estimated cost: R$ 10-30K (implementation) + R$ 500-2K/month (ongoing processing)

Estimated ROI: Infinite (prevents R$ 100K-1M fine if caught without protection)

---

Compliance implications (why LGPD will care)

LGPD requirements for PII

LGPD (Lei Geral de Proteção de Dados):

Article 5: Basic principles ├─ Accountability: You must take action to protect personal data ├─ Security: "Take suitable security measures" (vague, but means reasonable effort) ├─ Transparency: Tell customer how you protect their data └─ Implication: If you DON'T use PII detection (when it's available), you're negligent

Article 46: Data security measures ├─ Requirement: "Technical and administrative measures to protect personal data" ├─ Examples: Encryption, access control, monitoring, audits ├─ New standard: PII detection (if available, should use it) ├─ ANPD guidance: "Use available tools to minimize PII exposure" └─ Implication: Amazon releases PII detection → You should use it

Article 50-55: Data breach notification ├─ Requirement: Notify ANPD within 30 days of breach ├─ Trigger: ANY leak of personal data (not just credit cards) ├─ Fine: R$ 100-500K per breach (or up to 2% revenue) ├─ Aggravating factor: You knew about risk but didn't mitigate (PII detection available, you didn't use it) └─ Implication: ANPD will ask "Why didn't you use PII detection?" (you have no good answer)

Prevention vs cure: ├─ Prevention: Use PII detection (R$ 10-30K) → AVOID R$ 100K-500K fine ├─ Cure: Get breached, notify ANPD, pay fine → R$ 100K-500K + reputational damage ├─ Math: Prevention is 10-50x cheaper than cure └─ Decision: Obvious (implement PII detection NOW)

Casino example (why you SHOULD care): ├─ Casino logs customer: CPF, phone, address, credit score ├─ Casino gets breached: Hacker steals 10,000 customer records ├─ ANPD investigation: "Why didn't you mask PII?" ├─ Casino response: "We didn't know we should" ├─ ANPD: "Amazon Bedrock has PII detection (since Sept 2026), should have used it" ├─ Fine: R$ 500K (negligence aggravation) ├─ Reputational: Customers sue (class action, settlement R$ 5-10M) └─ Lesson: Using PII detection is not optional (it's mandatory now)

---

Conclusion: PII detection is now table-stakes (not optional)

The reality:

• Amazon released PII detection (Sept 2026, production-ready)
• LGPD regulators will expect it (compliance standard is rising)
• Your agente is probably leaking PII (customers send it, you don't mask it)
• Liability is yours (not customer's, not LLM vendor's)
• Fines are real (R$ 100K-500K per incident)
• Implementation is simple (R$ 10-30K, 4-6 weeks)

Your choice (2 paths):

Path 1: Ignore PII risk (hope regulator doesn't find out)

• Cost: R$ 0 upfront
• Risk: ANPD breach investigation finds you don't detect PII (fine: R$ 100K-500K)
• Timeline: When breach happens (could be tomorrow, could be 5 years)
• Recommendation: Not recommended (legal liability, reputational risk)

Path 2: Implement PII detection (prove you're compliant)

• Cost: R$ 10-30K (implementation) + R$ 500-2K/month (processing)
• Benefit: Automatically mask PII (LGPD compliant, ANPD-proof)
• Timeline: 4-6 weeks to production
• Recommendation: Essential (future-proof your agente)

At OpenClaw, we help SaaS implement PII detection for agentes:

• PRIVACY AUDIT: What PII is your agente leaking right now?
• BEDROCK INTEGRATION: Set up Amazon Bedrock PII detection (or OpenAI PrivacyFilter)
• MASKING STRATEGY: Which PII types? How to mask? What goes to LLM?
• COMPLIANCE DOCUMENTATION: LGPD compliance proof (for regulators, customers)
• IMPLEMENTATION & TESTING: Deploy, test, monitor, iterate
• BACKFILL: Retrospectively mask existing PII in your database
• ONGOING MONITORING: Alert on high-risk PII, weekly audits

Result: Your agente is LGPD-compliant (masked PII automatically). If breach happens, you have proof you took reasonable precautions (lighter fine, better defense). Customer trust protected. Sleep better at night.

Seu agente expõe CPF/cartão cliente?

Você sabe quantas PII estão logadas no seu banco de dados agora?

Se ANPD vier pedir conformidade, você consegue responder "Sim, usamos PII detection automático"?

Se quer expert guidance (privacy audit, Bedrock integration, masking strategy, compliance documentation, backfill, ongoing monitoring):

PII Detection | Agente IA | LGPD Compliance | Bedrock Integration | Masking Strategy | Privacy Audit →