PII Detector Model

This SageMaker model package detects and anonymizes personally identifiable information (PII) in text. Built on Microsoft Presidio (Analyzer + Anonymizer) with spaCy en_core_web_lg, it identifies around 18 entity types by default - person names, email addresses, phone numbers, US Social Security numbers, credit card numbers, IBAN codes, IP addresses, URLs, crypto wallet addresses, and more - and lets you choose a different action for each: replace with a placeholder, mask with asterisks, redact entirely, hash (one-way, optionally with a caller-supplied salt for a stable join key), or encrypt (reversible, with a caller-supplied key that is never stored server-side).

Unlike a hosted PII API, this model runs entirely inside your own AWS account and VPC - the text you send it is never transmitted to an external service. That in-VPC data residency is the reason to run it here. GPU is not used; deploy on a CPU instance.

This listing is the SageMaker path (API only). For a self-hosted HTTP API, a point-and-click portal, CSV upload, an S3 batch queue, and POST /decrypt, use the PII Detector Server AMI.

Supports real-time inference and SageMaker batch transform, with JSON and CSV input/output. Common uses include redacting PII from support tickets, logs, and data exports before they reach a data warehouse or an LLM, and compliance workflows where sending customer text to a third-party PII API is not an option.

We welcome your feedback at aws-support@sigmodata.com .

Model and training data

Stock Presidio Analyzer + Anonymizer (MIT) with spaCy en_core_web_lg. Sigmodata did not fine-tune a detector for this version. The spaCy model is the public English large pipeline; regex and checksum recognizers (email, SSN, credit card, IBAN, IP, URL) are Presidio's defaults. The image runs in network isolation on SageMaker, so no data leaves your account.

Known limitations

• English only. Other languages are not supported.
• Organization, location, and date/time detection use general-purpose spaCy NER and are noisier than the checksum-backed types.
• Full postal-address detection is not a built-in capability.
• Phone recall on mixed international formats is weaker than on US-format numbers.
• Encrypt is supported, but this endpoint does not decrypt. Keep the caller-supplied key and the rewrites array and run Presidio's DeanonymizeEngine yourself, or use the PII Detector Server AMI (POST /decrypt).

Measured performance

• Evaluated on 1,505 held-out synthetic texts generated with presidio-evaluator (PresidioSentenceFaker). A prediction counts as correct when its character span overlaps the gold span of the same type (not an exact-span match).
• Strongest types (F1): EMAIL_ADDRESS 1.00, IBAN_CODE 1.00, US_SSN 0.97, IP_ADDRESS 0.94, URL 0.91, CREDIT_CARD 0.86, PERSON 0.81.
• Weaker types, not gated for this release: ORGANIZATION 0.52, LOCATION 0.48, DATE_TIME 0.37.
• Local CPU container of this image: about 180 texts per second at a batch size of 25 (6 ms median for a single short sentence).
• Live SageMaker realtime on ml.m5.large (single instance, sequential client, us-east-2): median 226 ms per short text (p90 234 ms); about 51 texts per second at a batch size of 25. Confirm on your endpoint if latency is tight.