AI Gateway1 / 5
What if an ID splits
right at the
chunk boundary?
This is the silent trap of
PII masking in streaming.
PII masking in streaming.
apinizer.Even a half token stays safeAI Gateway2 / 5
Naive masking
leaks.
First 6 digits in this packet → “no full ID” → passes
Remaining 5 in the next packet → passes again
Each packet is “clean”; the whole leaks
apinizer.Even a half token stays safeAI Gateway3 / 5
The fix:
a sliding window.
01
Carry the half pattern
The incomplete tail merges with the next packet
02
No buffer
Without holding the whole response — low latency stays
03
Locale-aware
TCKN · IBAN · phone — validates, not just digits
apinizer.Even a half token stays safeAI Gateway4 / 5
Not one-way only.
Runs on the request
Runs on the response
Runs on every streaming chunk — even a half token is safe
apinizer.Even a half token stays safeAI Gateway5 / 5
Streaming makes privacy harder —
data is no longer atomic.
Masking that ignores the chunk boundary fails at the worst moment.
Does your masking account for
the chunk boundary?
the chunk boundary?
apinizer.Even a half token stays safe← → to navigate