Your own kinds of data
Teach Intertrace the data only your company knows is sensitive: an employee ID shape, project codenames, an account number with a check digit. It is found wherever cards and email addresses are.
What it does
Intertrace already finds credentials, card numbers, national IDs, email addresses, phone numbers and other personal data. Your own kinds of data add to that list. Each one is a few patterns, a list of exact terms, or both, and the action you choose for it:
| Action | What happens |
|---|---|
| Stop it | The request or reply is refused; a tool call carrying the value is blocked. |
| Strip it | The value becomes a label like [EMPLOYEE_ID_REDACTED] before the model sees it. |
| Hide it | The value becomes •••••• plus its last 4 characters (a listed term becomes •••). |
| Record it | It goes through unchanged and is written down for review. |
| Swap for a token | The model sees a token like [[itr:employee_id:…]]; the value comes back where Intertrace sits between the model and whoever acts on it (see below). |
They are checked in prompts, tool-call arguments, tool results the agent hands back to its model, model replies, the screening API and replies from MCP servers (tool results, resources and prompts). Your kinds add to the built-in ones and never change them; when a message holds several kinds, the strictest stop wins and each value is rewritten by its own kind. An agent's own data settings can tighten the built-in kinds but can't remove or loosen yours.
Set one up
- 1
Open Data & attacks
Open Policies → Data & attacks, then Advanced, and find Your own kinds of data. - 2
Add a kind of data
Name it, choose what to do, and add patterns, exact terms or both. - 3
Try it
Paste a sample to see what is found and what the model would see. The sample stays in your browser. - 4
Save
Saving goes through the change log like every organization setting, so it is recorded and can be undone. The gateway applies it within 30 seconds.
Patterns, terms and check digits
A pattern is a short regular expression in a safe subset: letters and digits, ., \d \w \s \b and their capitals, character classes like [A-Z], groups, |, and repeats like {6} or +. It is matched with the letter case you wrote. Lookaround, backreferences, flags and repeating a group that already repeats ((a+)+) are refused, and so is a pattern that matches empty text. Patterns run on an engine that never backtracks, so a pattern can't slow the gateway down.
| Example | Finds |
|---|---|
EMP-\d{6} | EMP-123456 |
(?:EMP|CTR)-\d{6} | EMP-123456 and CTR-654321 |
ACC-\d{11} | ACC-79927398713, with the Luhn check digit chosen |
Exact terms are whole words or phrases in any letter case: Project Falcon finds "project falcon" but not "Falconry". A check digit (Luhn, or ISO 7064 mod 97 as IBANs use) makes a pattern match count only when its check digit is right, so look-alike numbers aren't caught.
Limits: 20 kinds, 5 patterns of up to 200 characters each, 200 terms per kind and 1,000 terms in all.
Swap for a token
With Swap for a token, each value is replaced before the model sees it by a token that carries the value sealed with a key only the gateway holds. The same value gets the same token throughout a conversation, so the model can refer to it. The value comes back:
| Where | What happens |
|---|---|
| The model's reply to your app (not streamed) | Every token of this conversation is replaced by its value before your app reads the reply. |
| A tool call through Intertrace's /mcp | A token in the arguments reaches the MCP server as its value. The call is decided and recorded as the model wrote it, with the token. |
| A tool call your own app runs (function calling) | Not restored: the model's tool-call arguments keep the token. Look the value up yourself or use /mcp. |
| A streamed reply | A stream can't be rewritten, so a request that asks for a streamed reply is hidden (masked) instead of tokenized. |
A token opens only in the organization and conversation it was made in: send the same X-Intertrace-Session-Id on your model requests and /mcp calls. A request that names no conversation is hidden instead. A token that doesn't open (another conversation, or the model changed it) is left as it is and counted on the record (ORG_TOKENS_UNRESOLVED). Records say how many values were swapped and restored per kind (ORG_TOKENIZED, ORG_TOKENS_RESTORED), never the values.
Where a value can't be rewritten
Tool-call arguments run as the agent sent them, so a kind you hide or strip is recorded there, not rewritten; a kind you stop blocks the call. A streamed reply can be stopped but not rewritten, so a kind you hide stops a stream. While sensitive data is in monitor mode, Stop it is recorded instead, as for every kind that isn't a credential, card number or national ID.