The problem with plain blocking
If you only block sensitive content you get two outcomes: no answer, or an answer to a mutilated prompt. Neither gets the work done, and staff then move to tools nobody can see.
How the way back works
- Substitute. Sensitive entities are replaced by stable tokens, not deleted.
- Process. The cloud model works with the context. It sees typed placeholders, never the original data.
- Resolve. On the response path the tokens are translated back to cleartext before the user sees the answer.
The key word is stable: within a conversation the same person stays the same token. Person, address and account are masked but coherent — the model still recognises that three mentions refer to the same person. It just does not know the name.
Where the mapping lives
The token-to-cleartext mapping stays inside your BRANE instance and never in the cloud. The vault is encrypted and EU-sovereign. This is the point where the whole construction holds or does not: if the mapping travels out, the masking is cosmetic.
And when a conversation turns sensitive
As soon as a chat contains PII, the entire conversation stays on local infrastructure. That is not a setting but an assurance that cannot be disabled: once sensitive means always local.
The limit. What is inspected and masked is what goes into the AI. What a human does with the resolved answer afterwards — copy, forward, print — is outside this layer.