1. How detection works

ReverseMask detects PII and prompt injection using automated regular expressions, character normalization, and heuristic scoring. It does not use a language model to make these decisions.

2. No 100% guarantee

No automated software can detect every PII format, every human name, or every novel or rephrased prompt-injection attack. ReverseMask is a defense-in-depth developer utility. It reduces risk. It is not a guarantee of data immunity, and it must not be relied on as your only security or privacy control.

3. Not a compliance certification

The /badge, /portal, and /compliance/report endpoints generate automated summaries of software counter activity. They are telemetry, not legal opinions, security audits, or regulatory certifications. ReverseMask is not SOC 2, ISO 27001, GDPR, PCI-DSS, or HIPAA certified, and these reports do not make it so.

4. Stateless and unrecoverable

Because the Service is stateless, a lost or expired vault bundle means the masked data cannot be recovered. Plan your retention accordingly.

5. Test before you trust it

Test the Service against your own data and workflows before putting it into production.