How are you handling GDPR/HIPPA when sending customer data to OpenAI/Claude APIs?

Questions
1

Building automations for EU/US clients and curious how others approach this. We’ve been working on a middleware solution that redacts PII before API calls. What’s your current approach - just avoiding sensitive data, self-hosting, or something else?

2

Hello @Matthew_Snyder, welcome!

I think this is what the Guardrails node is solving,

Check it out:

3

Hi @Matthew_Snyder,

If you have sensitive data you do NOT want to leak to OpenAI, then your best options are to:

  1. Get an Enterprise license with OpenAI for them to host an isolated instance for you. Corporates generally use this (https://openai.com/index/introducing-chatgpt-enterprise/)
  2. Setup and Host one of the open source models on your client’s infrastructure like Llama etc