Skip to main content
OpenAI Privacy Filter is a token classifier, not a chat model. Tinfoil serves the upstream opf.redact(text) implementation without a system prompt or websearch-specific policy.

​
Endpoint

POST https://pii-filter.tinfoil.sh/redact requires Authorization: Bearer <TINFOIL_API_KEY> and Content-Type: application/json. Use a Tinfoil SDK verified HTTP client targeting enclave pii-filter.tinfoil.sh and configuration repository tinfoilsh/confidential-pii-cpu. Authentication is enforced by the enclave shim. This is a custom HTTP endpoint, not /v1/chat/completions or /v1/responses; the SDK’s chat methods do not apply. For direct HTTP access without an SDK, manual attestation verification is required for connection-time guarantees. Ordinary HTTPS alone does not verify the enclave’s code. Request:
The response contains schema_version, summary, the original text, detected_spans (with label, start, end, text, and placeholder), and redacted_text. It passes through the upstream library’s result. Treat the response as sensitive: it includes original text and detected values. Requests can contain up to 4 MiB of JSON. Enable pii_check_options to filter outgoing search queries. Websearch applies its own removal policy to detected spans rather than using the model’s placeholder-redacted text.

​
Limitations

The model is primarily English and can miss sensitive text or label public information as private. Neither a successful response nor an empty span list guarantees anonymization. See the model card for the taxonomy and limitations.