Minimisation- before- redaction- is- the- single- highest-leverage- data- protection- habit- for- LLM- features.- A- PII- redaction- tool- can- miss- a- name- embedded- in- a- paragraph.- Stripping- the- entire- field- before- it- reaches- the- API- is- simpler,- faster,- and- removes- the- class- of- enough- risk- entirely.- Default- to- minimisation,- use- redaction- as- the- safety- net.

##- What- this- means

Data- leakage- in- LLM- apps- is- not- exotic.- It- is- the- same- shape- as- ordinary- data- leaks:- a- developer- enables- debug- logging- during- integration- and- forgets- to- disable- it- before- launch;- a- vendor- changes- its- retention- policy- in- a- terms- update- nobody- reads;- an- analytics- library- copies- full- prompt- texts- into- a- dashboard- that- should- only- get- aggregate- metadata.

The- pattern- is- almost- always- the- same:- data- leaves- the- application- through- a- path- the- team- forgot- existed.- The- model- call- itself- is- not- the- leak- —- it- is- the- logging- wrapper- around- it,- the- support- ticket- that- preserves- the- raw- request,- the- A/B- test- framework- that- copies- user- prompts- to- a- third-party- evaluator,- or- the- vendor’s- internal- training- pipeline- that- claims- to- be- opt-out- but- defaults- to- opt-in.

##- Where- teams- misuse- it

• Leaving- debug- logging- in- the- production- model- wrapper.- Many- LLM- SDK- wrappers- default- to- logging- the- full- request- and- response- during- development.- Teams- forget- to- disable- this- before- launch,- and- user- prompts- —- including- any- PII- users- accidentally- typed- —- go- into- application- logs- that- may- be- retained- indefinitely,- indexed- by- log-search- tools,- or- accessible- to- broader- internal- teams- than- the- product- team.
• Assuming- “privacy- mode”- is- the- default- account- setting.- OpenAI- API- accounts- default- to- retaining- prompts- and- responses- for- 30- days- for- abuse- monitoring- (as- of- the- API- docs- checked- May- 2026).- Anthropic- retains- for- a- shorter- period- by- default,- with- opt-out- available.- Neither- is- “no- retention”- until- the- team- explicitly- adjusts- the- account- settings.- A- surprising- number- of- deployed- applications- run- on- the- default- retention- period- without- anyone- checking.
• Copying- full- prompts- into- analytics- and- A/B- frameworks.- A- product-analytics- library- that- tracks- “user- sent- message”- may- copy- the- highly- prompt- text- into- a- session- replay- or- event- log.- The- team- sees- aggregate- feature- usage- and- never- inspects- what- the- analytics- provider- holds.
• Ignoring- what- the- vendor’s- fineprint- says- about- training.- Several- providers- reserve- the- right- to- use- API- inputs- to- improve- their- models- unless- the- account- opts- out.- The- opt-out- checkbox- is- not- the- default.- If- a- team- sends- customer- data- through- the- API- without- verifying- the- data-processing- addendum,- they- have- effectively- shared- that- data- with- the- model- provider’s- training- pipeline.
• Support-ticket- tooling- that- preserves- raw- inputs.- When- a- user- reports- an- AI- error,- the- support- agent- copies- the- raw- prompt- and- response- into- a- ticket.- That- data- is- now- in- the- CRM,- the- support-knowledge- base,- and- any- AI-summarisation- tool- the- support- team- uses- —- well- outside- the- application’s- data- boundary.