Niucore

Documentation

Incognito mode

What the `anonymization` field means and how it affects an API turn.

NiuCore can substitute personal data with placeholders before the text leaves toward the model provider, and restore them in the answer. That is incognito mode, and from the API it shows in exactly one place: a message's anonymization field.

It is not toggled from the API

The company decides, not the integrator. A turn body does not accept an anonymize field: sending it returns 422. Making an organization's privacy depend on whether the client remembered to ask for it would be bad design.

What you see from the API

The text you send and the text you receive are in the clear. The substitution happens internally, between NiuCore and the model provider, and is undone before answering you.

When the company has it enabled, the message also carries what was substituted:

JSON
{
  "id": 90213,
  "content": "Le escribimos a María Rossi a maria@example.com.",
  "anonymization": {
    "enabled": true,
    "replacements": [
      { "original": "María Rossi", "placeholder": "⟦Nombre#a91f3c⟧", "category": "Nombre" },
      { "original": "maria@example.com", "placeholder": "⟦Correo#7d20be⟧", "category": "Correo" }
    ]
  }
}
`anonymization` valueMeans
nullThe turn did not go through incognito mode.
{ "enabled": true, "replacements": [] }The mode was active and nothing was found to substitute.
{ "enabled": true, "replacements": [ … ] }What it lists was substituted. Placeholders have the form ⟦Category#hash⟧.

Heads up

replacements contains the original values: precisely the data incognito mode exists to protect. If you store the full response, you are storing those values. Treat that field with the same care your organization gives personal data.

Tools and connectors

External tools — Gmail, Drive, Calendar — receive de-anonymized arguments: an email has to reach the real address, not a placeholder. What you see in a tool_approval interaction payload is what the tool will actually receive.

NiuCore's internal tools keep operating in the anonymized space, by design: they never need the real value to do their job.

Documents and search

Indexed library content is not anonymized: search has to work over the real text to find what the user is looking for. What is protected is the egress toward the model provider, which is where the data would leave the organization.

What to do in your integration

  • Treat anonymization as informational. It does not change the response shape or force anything on you.
  • If your system keeps its own record of personal data, replacements tells you what NiuCore detected in that turn — it can serve as a signal.
  • Do not depend on it being present: a company may have the mode off, and then the field is always null.
  • If you are going to persist responses, decide explicitly whether you keep replacements or drop it. It is a privacy decision, not a serialization detail.