AI data loss prevention for Next.js

People often paste personal data into AI prompts – card numbers, phone numbers, home addresses, and whole résumés. Once that data reaches your AI provider, the provider’s logging and retention apply to it, not yours.

Arcjet sensitive info detection scans prompt content inside your application, before it reaches the AI provider. Detection runs locally in your own environment, so the raw text doesn’t leave your app. The SDK reports the decision to Arcjet with the type and position of each finding, but not the matched text. When Arcjet finds something, you decide what happens next: block the request, remove the data, or ask the user to edit their prompt.

Get started

In this example we use the Vercel AI SDK to create a simple AI chat endpoint with Next.js, and Arcjet to prevent sensitive information from being sent to the AI model. The same principles can be applied to any AI application, including those built with other frameworks.

We assume you already have a Next.js app set up.

Install the dependencies:

# Export your Arcjet API key from https://console.arcjet.com
export ARCJET_KEY="ajkey_..."

npm install @arcjet/next @arcjet/sensitive-info-rampart ai @ai-sdk/openai

Create an AI chat endpoint:

1
import { openai } from "@ai-sdk/openai";
2
import arcjet, { sensitiveInfo } from "@arcjet/next";
3
import { rampart } from "@arcjet/sensitive-info-rampart";
4
import type { UIMessage } from "ai";
5
import { convertToModelMessages, isTextUIPart, streamText } from "ai";
6

7
const aj = arcjet({
8
  key: process.env.ARCJET_KEY!, // Get your Arcjet key from https://console.arcjet.com
9
  rules: [
10
    sensitiveInfo({
11
      mode: "LIVE", // Blocks requests. Use "DRY_RUN" to log only
12
      // Block PII types that should never appear in AI prompts.
13
      // Remove types your app legitimately handles (for example, EMAIL for a support bot).
14
      deny: ["CREDIT_CARD_NUMBER", "EMAIL"],
15
      backend: rampart(),
16
    }),
17
  ],
18
});
19

20
export async function POST(req: Request) {
21
  const { messages }: { messages: UIMessage[] } = await req.json();
22

23
  // Check the most recent user message for sensitive information.
24
  // Pass the full conversation if you want to scan all messages.
25
  const lastMessage: string = (messages.at(-1)?.parts ?? [])
26
    .filter(isTextUIPart)
27
    .map((p) => p.text)
28
    .join(" ");
29

30
  const decision = await aj.protect(req, { sensitiveInfoValue: lastMessage });
31

32
  if (decision.isDenied() && decision.reason.isSensitiveInfo()) {
33
    console.warn("Request blocked due to sensitive information");
34
    return new Response(
35
      "Sensitive information detected – remove it from your prompt",
36
      { status: 400 },
37
    );
38
  }
39

40
  // Block other denials too, such as one from a remote rule.
41
  if (decision.isDenied()) {
42
    return new Response("Forbidden", { status: 403 });
43
  }
44

45
  // Fail closed when Arcjet couldn't complete the check.
46
  if (decision.isErrored()) {
47
    return new Response("Service unavailable", { status: 503 });
48
  }
49

50
  // Arcjet approved – call your AI provider
51
  const result = await streamText({
52
    model: openai("gpt-4o"),
53
    messages: await convertToModelMessages(messages),
54
  });
55

56
  return result.toUIMessageStreamResponse();
57
}

And hook it up to a chat UI:

1
"use client";
2

3
import { useChat } from "@ai-sdk/react";
4
import { useState } from "react";
5

6
export default function Chat() {
7
  const [input, setInput] = useState("");
8
  const [errorMessage, setErrorMessage] = useState<string | null>(null);
9
  const { messages, sendMessage } = useChat({
10
    onError: async (e) => setErrorMessage(e.message),
11
  });
12
  return (
13
    <div className="flex flex-col w-full max-w-md py-24 mx-auto stretch">
14
      {messages.map((message) => (
15
        <div key={message.id} className="whitespace-pre-wrap">
16
          {message.role === "user" ? "User: " : "AI: "}
17
          {message.parts.map((part, i) => {
18
            switch (part.type) {
19
              case "text":
20
                return <div key={`${message.id}-${i}`}>{part.text}</div>;
21
            }
22
          })}
23
        </div>
24
      ))}
25

26
      {errorMessage && (
27
        <div className="text-red-500 text-sm mb-4">{errorMessage}</div>
28
      )}
29

30
      <form
31
        onSubmit={(e) => {
32
          e.preventDefault();
33
          sendMessage({ text: input });
34
          setInput("");
35
          setErrorMessage(null);
36
        }}
37
      >
38
        <input
39
          className="fixed dark:bg-zinc-900 bottom-0 w-full max-w-md p-2 mb-8 border border-zinc-300 dark:border-zinc-800 rounded shadow-xl"
40
          value={input}
41
          placeholder="Say something..."
42
          onChange={(e) => setInput(e.currentTarget.value)}
43
        />
44
      </form>
45
    </div>
46
  );
47
}

Then run the server:

npm run dev

Requests appear in your Arcjet Console in real time.

How detection works

Sensitive info detection runs on-device with Rampart, a named-entity-recognition (NER) model paired with deterministic recognizers:

Deterministic recognizers match structured types with validated patterns – card numbers, email addresses, IP addresses, URLs, and Social Security numbers.
The NER model detects the free-form PII that people paste into prompts – names, street addresses, phone numbers, and government or financial identifiers. These don’t follow a fixed pattern, so a model finds them where pattern matching can’t.

The SDK rule runs detection on your own infrastructure, so the text isn’t sent to Arcjet or a third party for analysis. That makes it a good fit in front of an AI provider. The server-side sensitive information detector in an agent guard policy and coding agent hooks screen text on Arcjet’s side instead. Use the server-side detector for text longer than the SDK scans, and to detect protected health information (PHI) and secrets such as API keys, which on-device detection doesn’t cover.

Configure detection

Choose which PII to block

Use deny to list the entity types to block, or allow to block everything except the types you list (the two are mutually exclusive). Tune the list to your app – for a support bot that legitimately collects phone numbers, leave PHONE_NUMBER out of deny:

1
sensitiveInfo({
2
  mode: "LIVE", // Blocks requests. Use "DRY_RUN" to log only
3
  deny: ["CREDIT_CARD_NUMBER", "EMAIL"],
4
  backend: rampart(),
5
});

For every entity type and where Arcjet detects it, see Entity types.

Detect names, addresses, and IDs

AI prompts are full of free-form PII – a pasted résumé, a shipping address, and someone’s full name. The Rampart NER model detects these, plus government and financial identifiers (SSNs, tax IDs, passports, driver’s licenses, bank and routing numbers). Add them to deny:

1
import arcjet, { sensitiveInfo } from "@arcjet/next";
2
import { rampart } from "@arcjet/sensitive-info-rampart";
3

4
// The Rampart backend loads a native ONNX runtime, so this route must run on
5
// the Node.js runtime, not the Edge runtime.
6
export const runtime = "nodejs";
7

8
const aj = arcjet({
9
  key: process.env.ARCJET_KEY!,
10
  rules: [
11
    sensitiveInfo({
12
      mode: "LIVE",
13
      // Names and addresses are common in pasted résumés and personal messages.
14
      deny: [
15
        "CREDIT_CARD_NUMBER",
16
        "EMAIL",
17
        "GIVEN_NAME",
18
        "SURNAME",
19
        "STREET_NAME",
20
      ],
21
      backend: rampart(),
22
    }),
23
  ],
24
});

The model ships with the package (about 14.7 MB, quantized), so nothing is fetched at runtime, and inference is fast enough to run inline on each request (about 6.6 ms median on Node.js). It recalls about 98% of private terms across seven Latin-script languages. Because it loads a native ONNX runtime, it needs a server runtime – Node.js, Bun, or Deno, not edge – and on Next.js you mark it as a server external package. For the bundler configuration, options, and the full accuracy and latency breakdown, see the Rampart reference.

Choose what text to scan

Pass the text to scan as sensitiveInfoValue in JavaScript, sensitive_info_value in Python, or WithSensitiveInfoValue in Go. For a chat endpoint, this is usually the user’s most recent message. To scan every message, pass the full conversation history instead – PII can appear earlier in the exchange.

Test before you block

Set mode to "DRY_RUN" in JavaScript, Mode.DRY_RUN in Python, or ModeDryRun in Go to log detections without blocking requests. Run it in production to see which PII appears in your prompts, then switch to live mode when the entity list matches what you want to block.

Combine with other protections

Sensitive info detection controls what data reaches your AI provider. Pair it with the other AI protection layers, each of which covers a different risk:

Prompt injection detection blocks hostile instructions and jailbreak attempts.
AI abuse protection and AI budget control block automated clients and enforce per-user token budgets.
Agent guards apply PII detection directly inside agent tool handlers and pipelines that don’t route through HTTP. A local policy input keeps the raw string in the SDK while reporting policy evidence to Arcjet.
Protected health information (PHI) detection finds medical record numbers, health plan member IDs, and vehicle and device identifiers with the server-side detector in an agent guard policy.