The problem with plain blocking
If you only block sensitive content you get two outcomes: no answer, or an answer to a mutilated prompt. Neither gets the work done, and staff then move to tools nobody can see.
How the way back works
- Substitute. Sensitive entities are replaced by stable tokens, not deleted.
- Process. The cloud model works with the context. It sees typed placeholders instead of the detected original values.
- Resolve. On the response path the tokens are translated back to cleartext before the user sees the answer.
The key word is stable: within a conversation the same person stays the same token. Person, address and account are masked but coherent — the model still recognises that three mentions refer to the same person. It just does not know the name.
Where the mapping lives
The token-to-cleartext mapping stays inside your BRANE instance and never in the cloud. The vault is encrypted and EU-sovereign. This is the point where the whole construction holds or does not: if the mapping travels out, the masking is cosmetic.
And when a conversation turns sensitive
Once a chat collects personal data from several categories, the entire rest of the conversation stays on local infrastructure. How strict this is follows your policy: with "block", every request with detected personal data stays local.
The limit. What is inspected and masked is what goes into the AI. What a human does with the resolved answer afterwards — copy, forward, print — is outside this layer.