Comparison · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
RedactSure vs OpenAI Privacy Filter: 2026 Comparison & Alternative
OpenAI Privacy Filter labels PII spans in text a pipeline sends it; RedactSure, an OpenAI Privacy Filter alternative built for AI agents, tokenizes the screen before the agent's model reads it. RedactSure is an alternative way to think about agent browsing security, because it protects sensitive data as it is rendered on a screen, before an agent uses it.
Security teams looking for an OpenAI Privacy Filter alternative for AI agents share one goal, keeping personal data away from a model, and find that the two products act at different points. Privacy Filter is a model a team runs on text its own code sends it, returning labeled spans for that code to mask or replace. RedactSure replaces identifiers with tokens on the screen an agent is about to read, so the model never receives the real value.
One example runs throughout: a patient record in a bought billing platform, holding a name, a date of birth, a home address, a phone number and an account number, worked by an agent as a billing specialist would. What Is Render-Layer Tokenization? defines the approach, and Runtime Tokenization vs Redaction for AI Agents separates the two.
Key findings
- As an OpenAI Privacy Filter alternative for agent work, RedactSure replaces values on the rendered page before any model reads it, so the agent handles the patient as PATIENT_001 and the real account number is released only at an approved destination (What Is Render-Layer Tokenization?).
- Tokens substituted before any model reads the screen, with real values released only at the approved destination, remove the exposure OWASP names: "Personal identifiable information (PII) may be disclosed during interactions with the LLM" (OWASP, LLM02, 2025).
- None of the three OpenAI pages describes a rendered screen, a screenshot or an agent; the model card states that "Privacy Filter is intended for PII span detection in raw text and for passing detected spans to downstream redaction workflows" (OpenAI, Model Card for OpenAI Privacy Filter, 2026).
- Privacy Filter ships under a "Permissive Apache 2.0 license: ideal for experimentation, customization, and commercial deployment," and protects only text a team's code passes to it (OpenAI, Hugging Face, 2026).
- The model "labels an input sequence in a single forward pass" for "Sanitizing text at ingestion time before storage, indexing, analytics, or retrieval" (OpenAI, Model Card for OpenAI Privacy Filter, 2026).
- OpenAI calls it "a redaction and data minimization aid, not an anonymization, compliance, or a safety guarantee" (OpenAI, Hugging Face, 2026).
How do the two compare side by side?
The table sets OpenAI's own wording beside what a governed environment does on the same point, and names the check a buyer can run.
| Dimension | OpenAI Privacy Filter, per its pages | RedactSure | What to verify |
|---|---|---|---|
| Where the control sits | Inside a text pipeline, for "PII span detection in raw text" (OpenAI, Model Card for OpenAI Privacy Filter, 2026) | On the screen, before any model reads it | Where, in one workflow, a value is replaced |
| How coverage starts | A team wires the model into its own code, to "operate the model in their own environment" (OpenAI, GitHub, 2026) | The agent works inside the governed environment; the application is unchanged | How many of the agent's applications feed that code |
| What the model receives | Raw text; it "labels an input sequence in a single forward pass" and returns spans (OpenAI, Model Card for OpenAI Privacy Filter, 2026) | The screen with tokens, PATIENT_001 and ACCT_001, consistent for the run | One screen exactly as the model saw it |
| How real values are restored | Left to the calling code: "the surrounding system decides whether to mask, remove, replace, pseudonymize, alert, or route them for review" (OpenAI, Model Card for OpenAI Privacy Filter, 2026) | At an approved destination, when a named person approves the action | Who authorizes it, and where |
| Who approves an action | The model takes no action; "High-sensitivity workflows should also retain human review paths" (OpenAI, Model Card for OpenAI Privacy Filter, 2026) | A named person, for every payment, submission and record change | A person's name, not a review queue |
| The audit record | The repository holds "the local code, CLI, and example assets"; a log of what was labeled is the team's to build (OpenAI, GitHub, 2026) | Every screen as tokens, every action and approval, exported to the customer's SIEM | Whether the record shows what the model saw |
| Which model the control depends on | The control is itself "a bidirectional token-classification model" (OpenAI, Hugging Face, 2026) | The same tokens, approvals and record whichever model the agent runs on (Can AI Models Change Without Changing Their Controls?) | What changes when the agent's model changes |
Privacy Filter governs spans in text a team's code sends it, so its answer to what the model saw covers that pipeline and nothing an agent opens on its own; RedactSure governs what an agent reads, and its answer is one record of the screen the model was given. They also differ on who turns a token back into a real value: code around the model on OpenAI's pages, a named person in RedactSure's design (What Is Supervised Delegation?).
What does OpenAI Privacy Filter protect, and where does it act?
OpenAI Privacy Filter is an open-weight model a team runs on its own text, "intended for high-throughput data sanitization workflows where teams need a model that they can run on-premises that is fast, context-aware, and tunable" (OpenAI, Hugging Face, 2026). The repository "contains the local code, CLI, and example assets used to run, evaluate, and finetune Privacy Filter checkpoints," so a team can read the implementation and tune it to its own policy (OpenAI, GitHub, 2026). On OpenAI's own benchmark, the card reports token precision 0.968, token recall 0.981 and span F1 0.942 across all labels on PII-Masking-300k (OpenAI, Model Card for OpenAI Privacy Filter, 2026).
Each benefit depends on one condition: code the team wrote has to hand the text to the model, and that code decides what to do with the labels. None of the three pages describes a rendered screen, a screenshot or an agent. This is a limit of the design rather than a defect, and it matters because an agent reaches a patient record through the billing platform's screen, not a pipeline. Of the 86 AI security and data protection products reviewed, 28 control what reaches a model or mask a browsing layer, and none of the 28 hands an agent a token it can use on a screen, on documentation read between October 22 and 27, 2026 (How Many AI Security Products Control What an AI Agent Sees?).
What does an agent read when it opens a patient record in a billing platform?
Consider the patient record. The organization may already run Privacy Filter on the text its code ingests, so the stored copy is masked. The agent never reads that copy; it opens the billing platform as a specialist does and reads the rendered screen, and nothing in a bought application calls the team's labeler. The model receives the name, date of birth, address, phone number and account number as the screen shows them, and an agent working from screenshots receives them as pixels, which a text labeler never sees.
A visual redaction model reported "more than doubling text-extraction baseline accuracy (0.753 vs 0.357 mAP@50)" on rendered pages, a different detection problem from extracted text (Zhao, 2026). Screenshot-driven GUI agents "may inadvertently expose sensitive information such as identities, accounts, locations, and behavioral traces" (Wang et al., 2026), and web agents "are prone to inadvertent use of unnecessary sensitive information" (Zharmagambetov et al., 2025). The agent also used the specialist's session, so the platform's log records the specialist (What Does an AI Agent See in a Screenshot?).
Which control fits which work?
Keep OpenAI Privacy Filter for
- Text a team's own code handles, "Sanitizing text at ingestion time before storage, indexing, analytics, or retrieval" (OpenAI, Model Card for OpenAI Privacy Filter, 2026).
- Bulk labeling on the team's own hardware, since the model is built for teams that need one "they can run on-premises that is fast, context-aware, and tunable" (OpenAI, Hugging Face, 2026).
- Teams that want to "inspect the implementation directly" and fine tune the checkpoints (OpenAI, GitHub, 2026).
Add RedactSure for
- Agents reading screens in bought applications, where the model receives PATIENT_001 and ACCT_001 instead of the real values (What Is Render-Layer Tokenization?).
- A named person who approves each payment, posting or record change before the agent makes it (What Is Supervised Delegation?).
- The record of what the model received on every screen, exported to the customer's SIEM (What Is an AI Control Record?).
A billing team running agents will usually keep both, and this block shows which product protects the screen.
How do you test it on one workflow?
Compare the two on one real billing workflow, over an afternoon, with both vendors present and the answers written down.
Step 1. Choose a workflow the agent will run, such as posting a payment to a patient account, and pick one screen from it, the patient record.
Step 2. Have each vendor hand over the patient record exactly as its model received it. For Privacy Filter the answer is the text the pipeline sent it, if the screen's text was ever sent; for the render-layer vendor, the screen with PATIENT_001 and ACCT_001 in place.
Step 3. List every application in the workflow and mark each one as feeding the code that calls Privacy Filter, or not. A bought billing platform rarely does, and that group is the exposure on the first day.
Step 4. Trace the account number from token back to its real value: what released it, when, and whose name appears in the record. On OpenAI's pages that step belongs to "the surrounding system," so ask the team that wrote it to show the log.
Step 5. Calculate coverage. If the task list touches five applications and one feeds the pipeline, first-day coverage is one of five. The weights are free to download, so the costs that differ are the engineering to route each application's text through the model and the agent work delayed until that is done.
What does a governed environment change?
A governed environment is a category of control rather than a product feature. The agent works under its own session and sees a different screen from the billing specialist, because values are replaced with consistent tokens before the model reads anything: PATIENT_001, DOB_001 and ACCT_001 on every screen of the run. Real values resolve only at approved destinations at the moment of an approved action, a named person approves every payment, submission and record change, and every screen, action and approval is written to a control record exported to the organization's SIEM.
OWASP warns that "Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files" and advises teams to "Restrict the model's access privileges to the minimum necessary for its intended operations" (OWASP, LLM01, 2025). A model that only ever received PATIENT_001 cannot be made to disclose a number it never held. The principle is the one in What Is Least Exposure?: an agent receives the minimum for its task, wherever the data is stored.
What the record shows
The patient record this page follows sits in a bought billing platform and carries a name, a date of birth, a home address, a phone number and an account number. On that record a render-layer control replaces each of those values with tokens on the billing screen before the model reads it, and that is the job RedactSure, as the OpenAI Privacy Filter alternative for agent work, does for this record, with real values released only for approved actions and a record that separates the agent's actions from the specialist's. Privacy Filter's real coverage is the text a team's code sends it: a fast, tunable labeler whose output is spans, with replacement left to the code around it. The test is one billing task: run it with each vendor, compare the patient record each model was given, and check whose name the record carries for the release of the account number.
Methodology and limitations
This page draws on three OpenAI pages for Privacy Filter, two OWASP entries, three research papers and RedactSure research pages. Vendor pages were read between October 21, 2026 and October 23, 2026, and each Sources line carries the date for its page. Vendor statements are quoted in the vendor's own wording, and public documentation read in full gives a sound view of where each product applies its control; "not described" refers to the pages reviewed.
Both products are described from documentation; neither was tested for this page, both change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. The patient record is a record type, not an organization. Compliance determinations belong to the organization's counsel and assessors, and nothing here replaces a pilot of one workflow on its own screens.
Frequently asked questions
Does OpenAI Privacy Filter protect data an agent sends to an LLM?
Only where a team's own code sends the text through it first. The model card describes "PII span detection in raw text" with spans passed "to downstream redaction workflows," so a prompt is protected when the pipeline masks its text before the call. When an agent opens a screen in a bought billing platform, nothing in that path calls the model, and the prompt carries what the screen showed.
Does OpenAI Privacy Filter cover what an agent reads on a rendered screen?
Not from the pages reviewed. The three OpenAI pages describe a model that labels text a team passes to it and say nothing about screenshots, rendered pages, browsers or agents. An agent working a billing platform reads the rendered screen, as text or as an image, with no pipeline between that screen and the model, so those screens need a control that acts before the model reads them.
Who approves the agent's action, the model or a person?
Neither, on OpenAI's pages. Privacy Filter takes no action; it returns labeled spans, and "the surrounding system decides whether to mask, remove, replace, pseudonymize, alert, or route them for review." The pages advise human review for high-sensitivity workflows without saying who reviews or where that is recorded. In RedactSure's design a named person approves each payment, submission or record change, and the approval carries that name.
What record exists of what the model saw?
Not one the model keeps. Privacy Filter's repository holds "the local code, CLI, and example assets used to run, evaluate, and finetune Privacy Filter checkpoints"; a log of what was labeled, and of what then reached the LLM, is the team's to build. When an agent reads a screen under a specialist's session, the platform logs the specialist. RedactSure's AI Control Record holds every screen as tokens, every action and approval, exported to the SIEM.
Is span labeling the same as render-layer tokenization?
No. Span labeling marks where personal data sits in a text sequence and returns the class of each span; what replaces it is decided afterward by the calling code. Render-layer tokenization replaces the value on the screen with a consistent token such as PATIENT_001 before a model reads it, so the join across screens survives without the identifier, and a product can offer the first without the second.
Does the protection depend on which model the agent runs?
Only where the protection is itself a model. Privacy Filter's recall is a property of the model; the card notes that "Recall degrades as the relevant contextual cue becomes more distant from the sensitive span," and a team tunes it per deployment. A control in front of the agent's model does not depend on either model's behavior, so the same tokens, approvals and record apply whether the agent runs on a frontier or an open-weights model.
How RedactSure closes the gap between a text pipeline and the rendered screen
A text labeler covers only the text a pipeline sends it, so an agent in a bought billing platform reads the patient record as the screen shows it. OpenAI's own model card reports that "Recall degrades as the relevant contextual cue becomes more distant from the sensitive span."
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the billing platform under the specialist's session and the model receives the name, date of birth, address, phone number and account number as shown. Inside the governed environment: the same screen shows PATIENT_001, DOB_001 and ACCT_001, and the real account number reaches the payment posting only when the named specialist approves it.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
Protecting the sensitive data an agent could read on a screen is a needed part of any solution that includes OpenAI Privacy Filter. Bring one billing workflow and see, with test values, the screen the model reads and the posting awaiting approval. Book a demo