Privent icon

Privent

Privent DLP: session-scoped tokenization, detokenization, risk scoring, audit events and agent handoffs for AI agent workflows.

Actions6

Tokenize → Tokenize

AI-generated

Summary

Detects and replaces sensitive values in the configured text field with session-scoped tokens. Choose an authentication mode to use Privent Cloud services or local regex detection, then pass the resulting item to Detokenize with the same session ID if you need to restore the values.

Inputs

  • Authentication — Select API Key for full Privent services, Tokenless (Visitor) for backend tokenization without an API key, or Local (No Backend) for in-n8n regex tokenization. The UI defaults to Local; stored nodes may infer the mode from available credentials.
  • Session ID — Required in API Key and Tokenless modes; typically comes from an upstream Privent Session node. In Local mode it is optional: leave it empty to generate a fresh session ID in the output item. Use the same ID when detokenizing.
  • Detection Level — Local mode only. Standard detects structured PII and secrets; Aggressive adds measured detectors such as street addresses, wallet addresses, IP and MAC addresses, and selected IDs.
  • Trace ID — API Key and Tokenless modes only. Defaults to the upstream Privent Session trace ID; used to correlate the event.
  • Agent Name — Optional API Key or Tokenless metadata, defaulting to the upstream session's agent name.
  • Text Field (required) — Name of the incoming item property containing the text to tokenize. Defaults to text.
  • Detection Mode — API Key and Tokenless modes only: Auto uses local regex with Cloud ML when available, Local uses regex only, and Cloud requires the ML pass.
  • Flag for Review Above Risk Score — API Key and Tokenless modes only. Sets privent.flaggedForReview when the returned cloud risk score meets or exceeds the threshold; the workflow continues so you can route flagged items with an IF or Switch node.

Output shape

One output item per input item, with the input data and tokenization results added or updated.

Tokens are scoped to the session. API Key and Tokenless modes can use Cloud ML and risk scoring depending on Detection Mode; Local mode runs regex detection in n8n without backend calls. Local detection level does not enable name detection; the documented detectors focus on structured data and secrets.

Examples

Example 1: Mask sensitive values before sending text to another service, then restore them later in the workflow.

Set Text Field to the input property containing the text. Use Local mode for in-n8n regex detection, or API Key/Tokenless mode for backend features. Preserve the Session ID and use it with Detokenize.

Links

Discussion