Masked in chat, do national ID numbers still turn up in Excel?

#Guard only the answer, and data leaks through files and email

You ask the AI to analyze customer inquiry data, and its answer prints customer phone numbers verbatim. You add a safeguard that masks personal information, and the chat answers come back clean. Then you download the same result as an Excel file and find national ID numbers in plain text. The weekly report email a playbook sent through a mail tool (an automated task that runs set queries and reports on a schedule) lists customer email addresses line after line. Guard only the answer, and data leaks out through every other exit.

OwlAI closes those exits in three layers. It doesn't pull personal information it doesn't need, it masks what it does pull before the AI sees it, and it checks again wherever data leaves, whether as an answer, a file, or an email.

#Personal data the question doesn't need never gets pulled

The best defense is not pulling the data in the first place. The AI is instructed not to query columns such as national ID numbers, phone numbers, email addresses, or home addresses just because they exist. When a question genuinely needs them, it returns masked values or aggregates. This layer is an instruction the AI follows, though, so the guarantee comes from the next layer, which works mechanically.

#Masking happens by rule, before the AI sees anything

Personal information in query results and tool results is masked before it reaches the AI. This step follows fixed rules and never passes through the AI's judgment. It works from two signals. The first is column classification: when a database is analyzed, each column is judged to hold personal information or not, and administrators can correct that judgment. The second is the shape of the value. Values with a fixed format—national ID numbers, phone numbers, email addresses, account numbers, card numbers—are caught in whatever column they appear. A phone number sitting in a column that was never classified as personal information is still caught by its shape.

Within a conversation, a masked value is always replaced by the same placeholder. Customer A's phone number is [PHONE-1] every time it appears. That lets the AI count one customer's orders or link two results without ever knowing the number. Masking doesn't stop the analysis.

#Files, email, and comments cross the same boundary

Besides the answer, data has two more ways out. One is generated files: the Excel, Word, PowerPoint, and Hangul files the AI creates, and CSV exports. The other is tools that write to external services, such as sending email, filing issues and comments, and posting to messengers. When a playbook sends its results to other people, it uses these same write tools. All three exits are tied to a single output boundary, and personal information is checked once more as data crosses it.

That check looks at permission to view originals. Users with permission to view originals see them on screen, and exported files carry the original or the masked value depending on permissions. Tools that write outside, such as a mail tool, run only after approval. In chat, a prompt shows the recipients and the content; a playbook gets its tools approved up front when it is switched on (“Email can't be unsent. So can you let an AI hit send?”). The Excel file and the weekly report email from the opening scene have to cross this boundary before they leave.

#The audit log shows where data was masked and who saw the original

Masking at an exit, every view of an original, and every export that carried originals are all recorded in the audit log. Later, you can use it to check at which exit personal information was masked and who opened the original.

Before adoption, settle two things: whether the personal-information columns flagged during analysis match your company's standards, and who should get permission to view originals.