Local PII Redaction with Presidio Before Embedding: SOC 2 & PCI-DSS RAG Pipeline
Redact card numbers, IBANs and names with Microsoft Presidio and a local LLM before anything is embedded. Keep cardholder data out of your RAG index.
AI Biz Gate Editorial · Local AI infrastructure, private RAG and compliance research
Published
Architecture
Recommended model
OpenAI gpt-oss-20b (Q8_0)
Parser / tooling
Microsoft Presidio Analyzer + spaCy NER
VRAM required
21.9 GB
Q8_0, 8k tokens
Compliance standard
SOC 2 & PCI-DSS
Customer documents pass through Microsoft Presidio before anything is embedded: pattern and NER recognizers detect card numbers, IBANs, account numbers and names, and the anonymizer replaces them with typed placeholders. A local gpt-oss-20b then reviews the redacted text for context-dependent identifiers that rules miss. Only redacted chunks reach the vector store, which keeps cardholder data out of the RAG index and out of your PCI DSS scope. Every redaction decision is logged.
01
Ingest
Statements, support tickets and emails are queued for processing.
02
Detect
Presidio Analyzer flags CREDIT_CARD, IBAN_CODE, PERSON, PHONE_NUMBER and custom account-number patterns.
03
Redact
Presidio Anonymizer replaces entities with typed placeholders such as <CREDIT_CARD>.
04
Review & embed
gpt-oss-20b flags residual identifiers; only clean chunks are embedded and indexed.
Performance & privacy profile
| Metric | Value | Basis |
|---|---|---|
| VRAM required | 21.9 GB | Weights + FP16 KV cache + 1 GB runtime overhead |
| Decode speed | ~66–101 tok/s | Memory-bandwidth estimate on RTX 4090 24GB, single user |
| Table extraction accuracy | N/A (text redaction workload) | Not applicable to this workload |
| Privacy score | 9/10 | Editorial rubric, see breakdown below |
- On-prem inference, no third-party AI processor(implemented)+3
- No outbound network route from AI hosts(implemented)+2
- Encryption at rest for documents and indexes(not included)+1
- Per-request audit logging(implemented)+2
- Role- or matter-based access control(implemented)+1
- Data minimization before storage (redaction or hashing)(implemented)+1
Deployment config
Starting point only. Pin image versions and review network policy before production.
# docker-compose.yml: redact PII before it reaches the vector store.
services:
presidio-analyzer:
image: mcr.microsoft.com/presidio-analyzer:latest
networks: [pii-internal] # serves on port 3000
presidio-anonymizer:
image: mcr.microsoft.com/presidio-anonymizer:latest
networks: [pii-internal] # serves on port 3000
ollama:
image: ollama/ollama:latest # pin a specific tag in production
volumes:
- ollama:/root/.ollama # pre-pulled: gpt-oss:20b (Q8_0 build)
networks: [pii-internal]
deploy:
resources:
reservations:
devices:
- driver: nvidia
count: all
capabilities: [gpu]
# Your ingestion worker joins pii-internal and calls
# http://presidio-analyzer:3000/analyze, then
# http://presidio-anonymizer:3000/anonymize, before embedding.
networks:
pii-internal:
internal: true
volumes:
ollama:Size it for your hardware
Local LLM VRAM Calculator
Total VRAM required
21.9GB
- Weights
- 20.7 GB
- KV cache
- 0.2 GB
- Overhead
- 1.0 GB
Recommended local hardware
- RTX 4090 24GB~66–101 tok/s
- Mac mini M4 Pro 64GB~18–27 tok/s
Estimated single-user decode speed from memory bandwidth. Real throughput depends on runtime, drivers and prompt length.
Frequently asked questions
Why redact before embedding instead of after retrieval?
Embeddings and the text chunks stored alongside them are persistent copies of your data. If card numbers or account details are embedded, the vector store becomes a system that stores cardholder data, falls inside PCI DSS scope and can surface that data in answers. Redacting first keeps sensitive values out of the index entirely.
Is Presidio accurate enough on its own?
Presidio's pattern recognizers are reliable for structured identifiers, and some add checksum validation (the credit card recognizer uses the Luhn check). NER-based detection of names and addresses is less consistent. That is why this blueprint adds a local LLM review pass and a sample-based human QA step. Measure recall on your own documents before relying on it in production.
Does this make our RAG system SOC 2 compliant?
SOC 2 is an independent auditor's attestation of your controls, not a property of a tool. This pipeline provides evidence for the confidentiality and privacy criteria (documented redaction, logs of what was processed and restricted access), but you will still need policies, monitoring and an audit to obtain a SOC 2 report.