Industry
Finance
An IBAN mentioned in a customer conversation and a sentence that reads as investment advice can sit in the same prompt. Both are problems, for different reasons.
What is at stake here.
Customer data ends up inside the prompt
National IDs, IBANs, card numbers and contact details travel to the model inside whatever the employee pasted.
The wrong sentence is a regulatory exposure
Phrases like guaranteed return bind the institution if a model produces them. The preset blocks them as keywords.
Who asked what has to be provable
In an audit, saying it was blocked is not enough; which rule fired and when has to be in the record.
Why it is not optional
Once customer data leaves the institution, there is no recall.
Where a legal duty is the reason, the article is named. No penalty figures and no circular numbers — those change, and a marketing page is the wrong place to be wrong about them.
A prompt is a transfer abroad
A prompt sent to a provider abroad is a transfer under KVKK art. 9 when it carries personal data. Masking removes that data before the prompt is sent.
Taking measures is an obligation
KVKK art. 12 obliges the controller to take technical and administrative measures appropriate to the risk. Telling staff not to paste is not a technical measure.
A control you cannot evidence is not a control
An institution that cannot show a request was blocked is treated, in an audit, as not having blocked it. The record is as necessary as the control.
Use cases
What actually happens in the day's work.
These are mechanisms, not case studies. Each one is a concrete thing somebody does, and what the chain does about it.
Summarising a call note
Situation
An agent pastes a call note into the chat and asks for a summary. The note contains a national ID, an IBAN and a phone number.
What happens
All three are replaced with synthetic tokens before the model sees them. The summary still reads correctly; the real values never leave the institution.
A product question drifting into advice
Situation
A customer asks whether they should buy a fund. A fluent model answer slides easily into implying a guaranteed return.
What happens
The policy layer catches the blocked phrasing at the prompt, and the request stops before it reaches the model.
Internal audit asking after the fact
Situation
Audit asks which rules fired on the requests that went to the model last quarter.
What happens
Every decision is written as an event: who asked, which rule fired, what was masked, and when.
The answer
Which part of the product responds.
Configuration
Recommended starting posture.
These are starting recommendations; the final policy is written with you during setup.
- Priority entity types
- TR_TCKNTR_VKNTR_IBANCARD_PAN
- If the policy cannot be read
- stop
- Deployment
- SaaS, your own VPC, or on-premise
A preset exists
A ready policy file for this sector exists in the product repository. Setup starts from it and extends it for your organisation.
policies/finance-default.yml
Other industries
Let's talk through your own scenario.
In a 30-minute technical session we run your prompts and your policy through it live.