ForHosting KIT · Text & AI

Find personal data

Personal data hides in places nobody thinks to check — a pasted support ticket, a scanned form transcript, a chat log exported for analytics. This PII detection API reads the text and reports exactly where names, emails, phone numbers, government IDs and card numbers appear, so nothing sensitive slips past unnoticed.

● StablePer request + per 1,000 words$0.003

Run — $0.003 + $0.0135/1,000 words How it works & API

Use it from WebAPIEmailApp soonTelegram soon

Run it online

Run this on our servers with your account. Free tools run in your browser; this one bills your KIT balance per the price above.

The moment this becomes urgent

Most teams don't think about personal data exposure until a compliance review, a customer complaint, or a near-miss forces the question: what personal information is actually sitting in our logs, tickets, transcripts and exports? By then it's often thousands of documents deep. text.detect-pii is built for that exact audit — point it at a body of text and get back a precise map of what personal data lives inside it, without changing a single character.

Detection, not alteration

This endpoint only finds and reports — it doesn't touch the source text. You submit content to POST /text/detect-pii, the task runs asynchronously, and the result lists each detected entity with its type, its position in the text and a confidence indicator. That separation matters: detection lets you decide case by case whether to redact, anonymize, quarantine or simply log the finding, instead of an automated tool making that call for you.

What counts as personal data

The categories go well beyond the obvious. Names and emails are the easy cases; phone numbers, national ID and passport numbers, bank and card numbers, physical addresses and dates of birth are just as sensitive and just as often overlooked in free-text fields where no schema forces a strict format. Detection reads the surrounding context, not just pattern-matching digits, which is why a ten-digit number in a sentence about a phone gets classified differently than the same digits in a sentence about an order total.

Where it slots into a bigger workflow

In practice, detection is step one of a pipeline: scan first, then decide. Some teams route flagged documents straight to text.redact-pii or text.anonymize for automatic handling; others use the report purely for visibility, feeding it into a dashboard that tracks where personal data accumulates across a data lake or a support system. Either way, the async model means you can run detection across an entire archive without a workflow ever blocking on it — submit the batch, keep working, and let the webhook tell you when the map is ready.

Cost and access

Pricing is $0.003 per request plus $0.0135 per 1000 words scanned, so a short support ticket costs a fraction of a cent while a full document batch scales predictably with volume. Access requires prepaid balance — there is no free tier — and a task that fails after three automatic retries is never billed, so you only pay for detection that actually completed.

What you can do with it

Pre-migration data audits

Scan an old support archive before moving it to a new system, so you know exactly what personal data is riding along.

Compliance spot-checks

Run detection across a sample of chat transcripts or forms to verify that a data-handling policy is actually being followed.

Upstream of redaction pipelines

Use detection results to decide which documents need masking through text.redact-pii and which are already clean.

Incident response

After a suspected leak, scan the affected dataset quickly to scope exactly which records contain exposed personal data.

FAQ

What does a PII detection API actually return?

For each submitted text, POST /text/detect-pii returns a list of detected entities with their type, location in the text and a confidence indicator, without modifying the original content.

Does it redact or remove the personal data?

No, detection only finds and reports; if you need masking, pair it with text.redact-pii or text.anonymize, which handle the removal step.

What types of personal data does it detect?

Names, emails, phone numbers, national ID and passport numbers, bank and card numbers, physical addresses and dates of birth, read in context rather than by pattern alone.

Is there a free tier to test PII detection?

There's no free tier — free tiers get abused and slow everyone down. Access runs on a prepaid ForHosting KIT balance: top up from $10.00 (it never expires) and each request is charged at its published price, so a call with no balance returns HTTP 402. No subscription, no tokens, no invented credits, and a failed task is never charged.

How is PII detection priced?

It's $0.003 per request plus $0.0135 per 1000 words scanned, and failed tasks are never charged after their automatic retries.

Can I scan large volumes of text or many documents at once?

Yes, submissions are processed asynchronously, so batches of any practical size run in the background while you keep working.

How do I get the detection results?

Via a signed webhook, which is recommended for automated pipelines, or through a signed link valid for 24 hours.

Does it work across languages?

The detection reads context and structure rather than a fixed list of English-only patterns, which lets it recognize personal data across languages.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/text/detect-pii

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/text/detect-pii \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"text":"…"}'

const res = await fetch("https://api.kit.forhosting.com/text/detect-pii", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "text": "…"
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/text/detect-pii",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "text": "…"
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/text/detect-pii", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"text":"…"}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"text":"…"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/text/detect-pii", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "text": "…"
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "text.detect_pii",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.003

Per 1,000 words$0.0135

Published price — no tokens, no invented credits. A failed task is never charged.

Limits

max_tokens 20000

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.
`422`	`task_failed`	The task failed after 3 retries. You are never charged for it.

Read the full KIT documentation →