How to Protect Sensitive User Data in Prompts Passed Through n8n

Start a new workflow and add a Webhook node. Set the HTTP Method to POST and the Path to /pii-safe-chat. In the Response section, set Response Mode to 'Using Respond to Webhook Node' so the workflow can process the message and return a cleaned response. This webhook will accept a JSON body with a 'message' field containing the user's text and an optional 'userId' field.

1// Expected incoming payload:
2// POST /webhook/pii-safe-chat
3// { "message": "My email is john@example.com and SSN is 123-45-6789", "userId": "user_42" }

Add a Code node after the Webhook. Name it 'Mask PII'. This node scans the user message with regex patterns for common PII types, replaces each match with a numbered placeholder like [EMAIL_1] or [SSN_1], and stores the original-to-placeholder mapping in the output so you can reverse it later. The mapping travels alongside the masked message through the rest of the workflow.

1const input = $input.first().json;
2const message = input.message || '';
3
4const patterns = [
5  { type: 'EMAIL', regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g },
6  { type: 'SSN', regex: /\b\d{3}-\d{2}-\d{4}\b/g },
7  { type: 'PHONE', regex: /\b(?:\+1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g },
8  { type: 'CREDIT_CARD', regex: /\b\d{4}[-.\s]?\d{4}[-.\s]?\d{4}[-.\s]?\d{4}\b/g }
9];
10
11const mapping = {};
12let masked = message;
13let counter = 0;
14
15for (const p of patterns) {
16  masked = masked.replace(p.regex, (match) => {
17    counter++;
18    const placeholder = `[${p.type}_${counter}]`;
19    mapping[placeholder] = match;
20    return placeholder;
21  });
22}
23
24return [{ json: { maskedMessage: masked, piiMapping: mapping, userId: input.userId } }];

Add an OpenAI node (or any LLM node) after the Mask PII node. In the Prompt field, use the expression {{ $json.maskedMessage }} so only the sanitized text reaches the model. Set the System Message to instruct the model to preserve any bracketed placeholders in its response. This ensures the LLM never sees real PII and keeps placeholders intact for later restoration.

1// System Message for the LLM node:
2// "You are a helpful assistant. When you see placeholders like [EMAIL_1] or [SSN_1], keep them exactly as-is in your response. Never attempt to guess the real values behind placeholders."

Add another Code node after the LLM node. Name it 'Unmask PII'. This node takes the LLM response and replaces every placeholder back with the original value from the mapping table. The result is a fully personalized response that never exposed real PII to the language model.

1const llmResponse = $input.first().json.text || $input.first().json.message?.content || '';
2const mapping = $('Mask PII').first().json.piiMapping;
3
4let restored = llmResponse;
5for (const [placeholder, original] of Object.entries(mapping)) {
6  restored = restored.replaceAll(placeholder, original);
7}
8
9return [{ json: { response: restored, userId: $('Mask PII').first().json.userId } }];

Add a Respond to Webhook node at the end of the workflow. Set the Response Body to Expression and use {{ $json.response }} to send back the unmasked, personalized response to the calling application. This completes the round-trip: real data in, masked data to LLM, real data out.

For additional safety, add a Guardrails node between the Mask PII node and the LLM node. Enable the PII Sanitization check. This acts as a second layer: if the regex in your Code node misses something, the Guardrails node catches it. Also enable Prompt Injection Detection to block adversarial inputs that try to trick the LLM into revealing system instructions or bypassing the masking.