PII and PCI Redaction

Redaction allows you to identify and mask sensitive information from transcriptions to protect privacy and comply with data protection regulations. The Pulse STT API supports two types of redaction: PII (Personally Identifiable Information) and PCI (Payment Card Information), on both pre-recorded and real-time transcription.

Enabling Redaction

Add redact_pii and/or redact_pci as query parameters. Both default to false. Options: true, false. The parameters are the same on both surfaces.

Pre-Recorded API

Add the parameters to the POST /waves/v1/stt/ query string.

curl -sL "https://github.com/smallest-inc/cookbook/raw/main/speech-to-text/getting-started/samples/audio.wav" | \
  curl -X POST "https://api.smallest.ai/waves/v1/stt/?model=pulse&language=en&redact_pii=true&redact_pci=true" \
    -H "Authorization: Bearer $SMALLEST_API_KEY" \
    -H "Content-Type: application/octet-stream" \
    --data-binary @-

Real-Time WebSocket API

Add the parameters to the WebSocket connection URL.

const url = new URL("wss://api.smallest.ai/waves/v1/stt/live?model=pulse");
url.searchParams.append("language", "en");
url.searchParams.append("encoding", "linear16");
url.searchParams.append("sample_rate", "16000");
url.searchParams.append("redact_pii", "true");
url.searchParams.append("redact_pci", "true");
const ws = new WebSocket(url.toString(), {
  headers: {
    Authorization: `Bearer ${API_KEY}`,
  },
});

Redaction Types

PII Redaction (redact_pii)

When redact_pii=true is enabled, the following types of personally identifiable information are automatically identified and redacted:

• Names: First names and surnames
• Addresses: Street addresses and locations
• Phone numbers: Various phone number formats
• Email addresses

Redacted PII items are replaced with placeholder tokens like [FIRSTNAME_1], [FIRSTNAME_2], [PHONENUMBER_1], etc.

PCI Redaction (redact_pci)

When redact_pci=true is enabled, the following types of payment card information are automatically identified and redacted:

• Credit card numbers: 16-digit credit/debit card numbers
• CVV codes: Card verification values
• ZIP codes: Postal/ZIP codes
• Account numbers: Bank account numbers
• Cardholder names: The name on the card

Redacted PCI items are replaced with placeholder tokens like [CREDITCARDNUMBER_1], [CREDITCARDCVV_1], [ZIPCODE_1], [ACCOUNTNUMBER_1], [ACCOUNTNAME_1], etc.

Output Format

When redaction is enabled, the transcription text contains placeholder tokens instead of the original sensitive information.

Pre-Recorded Response

The tokens appear in transcription. A response for redact_pci=true:

{
  "status": "success",
  "transcription": "Hi, my name is [ACCOUNTNAME_1]. Please charge my card [CREDITCARDNUMBER_1]. CVV [CREDITCARDCVV_1]."
}

Real-Time Response

Each message’s transcript carries the tokens.

{
  "session_id": "sess_12345abcde",
  "transcript": "[CREDITCARDCVV_1] and expiry [TIME_2] slash 34.",
  "is_final": true,
  "is_last": true,
  "language": "en",
  "languages": ["en"]
}

Redaction Placeholder Format

Redacted entities are replaced with placeholder tokens following the pattern:

• [ENTITYTYPE_N] where ENTITYTYPE indicates the type of information (e.g., FIRSTNAME, PHONENUMBER, CREDITCARDNUMBER, CREDITCARDCVV, ZIPCODE, ACCOUNTNUMBER, ACCOUNTNAME)
• N is a sequential number starting from 1 to uniquely identify each instance

Examples:

• [FIRSTNAME_1], [FIRSTNAME_2] - First names
• [PHONENUMBER_1] - Phone numbers
• [CREDITCARDNUMBER_1] - Credit card numbers
• [CREDITCARDCVV_1] - Credit card CVV codes
• [ZIPCODE_1] - ZIP/Postal codes
• [ACCOUNTNUMBER_1] - Account numbers
• [ACCOUNTNAME_1] - Cardholder names (PCI)

Compliance and Privacy

Redaction helps with compliance requirements for:

• HIPAA: Health Insurance Portability and Accountability Act (healthcare data)
• GDPR: General Data Protection Regulation (EU data protection)
• CCPA: California Consumer Privacy Act (California data protection)
• PCI DSS: Payment Card Industry Data Security Standard (payment card data)
• SOC 2: System and Organization Controls (security and privacy)