From 635ad6d8989a2d472365f2129e9f86502a06b532 Mon Sep 17 00:00:00 2001 From: Krrish Dholakia Date: Thu, 5 Mar 2026 19:32:26 -0800 Subject: [PATCH] feat: Add Canadian PII protection patterns and PIPEDA-compliant policy template Adds 6 new Canadian PII regex pattern detectors to patterns.json: - ca_sin: Social Insurance Number (PIPEDA Privacy Act, Income Tax Act) - ca_ohip: Ontario Health Insurance Plan Number (PHIPA) - ca_on_drivers_licence: Ontario driver's licence (HTA, PIPEDA) - ca_immigration_doc: IRCC immigration docs (UCI, work/study permits, IMM refs) - ca_bank_account: Canadian bank account routing (transit-institution-account) - ca_postal_code: Canadian postal code (Canada Post spec) Adds comprehensive policy template 'canadian-pii-protection' (id: canadian-pii-protection) with 5 sub-guardrails grouping patterns by data type. All patterns include contextual keyword matching (English + French keywords where applicable) to reduce false positives. Complements existing passport_canada pattern. Co-Authored-By: Claude Haiku 4.5 --- .../litellm_content_filter/patterns.json | 54 ++++++ policy_templates.json | 170 ++++++++++++++++++ 2 files changed, 224 insertions(+) diff --git a/litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/patterns.json b/litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/patterns.json index 422c0b640f0..0dc4eda8b5f 100644 --- a/litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/patterns.json +++ b/litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/patterns.json @@ -543,6 +543,60 @@ "description": "Detects Singapore bank account numbers (XXX-XXXXX(X)-X(XX) format for DBS/POSB/OCBC/UOB)", "keyword_pattern": "\\b(?:bank\\s*account|account\\s*number|DBS|OCBC|UOB|POSB|savings|current\\s*account|bank\\s*statement)\\b", "allow_word_numbers": false + }, + { + "name": "ca_sin", + "display_name": "SIN (Canadian Social Insurance Number)", + "pattern": "\\b\\d{3}[\\-\\s]\\d{3}[\\-\\s]\\d{3}\\b", + "category": "Canadian PII Patterns", + "description": "Detects Canadian Social Insurance Numbers (9-digit federal identifier, dashed or spaced format)", + "keyword_pattern": "\\b(?:SIN|social\\s*insurance|social\\s*insurance\\s*number|numéro\\s*d'assurance\\s*sociale|NAS)\\b", + "allow_word_numbers": true + }, + { + "name": "ca_ohip", + "display_name": "OHIP (Ontario Health Insurance Plan Number)", + "pattern": "\\b\\d{4}[\\-\\s]?\\d{3}[\\-\\s]?\\d{3}[\\-\\s]?[A-Z]{2}\\b", + "category": "Canadian PII Patterns", + "description": "Detects Ontario Health Insurance Plan numbers (10 digits + 2-letter version code)", + "keyword_pattern": "\\b(?:OHIP|health\\s*card|health\\s*insurance|ontario\\s*health|health\\s*number|carte\\s*santé)\\b", + "allow_word_numbers": false + }, + { + "name": "ca_on_drivers_licence", + "display_name": "Driver's Licence (Ontario)", + "pattern": "\\b[A-Z]\\d{4}[\\-\\s]\\d{5}[\\-\\s]\\d{5}\\b", + "category": "Canadian PII Patterns", + "description": "Detects Ontario driver's licence numbers (1 letter + 14 digits, dashed format)", + "keyword_pattern": "\\b(?:driver'?s?\\s*licen[cs]e|licen[cs]e\\s*number|DL\\s*number|ontario\\s*licen[cs]e|permis\\s*de\\s*conduire|numéro\\s*de\\s*permis)\\b", + "allow_word_numbers": false + }, + { + "name": "ca_immigration_doc", + "display_name": "Immigration Document (Canada IRCC)", + "pattern": "\\b(?:\\d{4}[\\-\\s]?\\d{4}[\\-\\s]?\\d{2}|[TUFW]\\d{8,10}|IMM[\\-\\s]?\\d{4,5})\\b", + "category": "Canadian PII Patterns", + "description": "Detects Canadian immigration document numbers including UCI (10-digit), work/study permits, and IMM document references", + "keyword_pattern": "\\b(?:UCI|unique\\s*client\\s*identifier|study\\s*permit|work\\s*permit|immigration|IRCC|permanent\\s*resident|PR\\s*card|permis\\s*d'études|permis\\s*de\\s*travail|landed\\s*immigrant|temporary\\s*resident)\\b", + "allow_word_numbers": false + }, + { + "name": "ca_bank_account", + "display_name": "Bank Account (Canada)", + "pattern": "\\b\\d{5}[\\-\\s]\\d{3}[\\-\\s]\\d{7,12}\\b", + "category": "Canadian PII Patterns", + "description": "Detects Canadian bank account routing information (transit-institution-account format)", + "keyword_pattern": "\\b(?:bank\\s*account|account\\s*number|transit\\s*number|institution\\s*number|branch\\s*number|routing\\s*number|direct\\s*deposit|void\\s*cheque|chequing|savings\\s*account|numéro\\s*de\\s*compte|dépôt\\s*direct)\\b", + "allow_word_numbers": false + }, + { + "name": "ca_postal_code", + "display_name": "Postal Code (Canada)", + "pattern": "\\b[ABCEGHJ-NPRSTVXY]\\d[ABCEGHJ-NPRSTV-Z][\\-\\s]?\\d[ABCEGHJ-NPRSTV-Z]\\d\\b", + "category": "Canadian PII Patterns", + "description": "Detects Canadian postal codes (A1A 1A1 format, excludes invalid first-letter characters per Canada Post spec)", + "keyword_pattern": "\\b(?:postal\\s*code|zip\\s*code|mailing\\s*address|address|code\\s*postal|postcode)\\b", + "allow_word_numbers": false } ] } \ No newline at end of file diff --git a/policy_templates.json b/policy_templates.json index 8d2eee5ca62..44d574910f9 100644 --- a/policy_templates.json +++ b/policy_templates.json @@ -2506,5 +2506,175 @@ "Content Safety" ], "estimated_latency_ms": 1 + }, + { + "id": "canadian-pii-protection", + "title": "Canadian PII Protection (PIPEDA)", + "description": "Protects Canadian personal identifiers under PIPEDA and provincial privacy legislation. Masks Social Insurance Numbers (SIN), Ontario Health Insurance Plan (OHIP) numbers, Ontario driver's licence numbers, Canadian passport numbers, IRCC immigration documents, Canadian bank account routing information, postal codes, email addresses, and phone numbers.", + "icon": "ShieldCheckIcon", + "iconColor": "text-red-500", + "iconBg": "bg-red-50", + "guardrails": [ + "ca-pii-government-identifiers", + "ca-pii-health-drivers", + "ca-pii-immigration", + "ca-pii-financial", + "ca-pii-contact-information" + ], + "complexity": "Medium", + "guardrailDefinitions": [ + { + "guardrail_name": "ca-pii-government-identifiers", + "litellm_params": { + "guardrail": "litellm_content_filter", + "mode": "pre_call", + "patterns": [ + { + "pattern_type": "prebuilt", + "pattern_name": "ca_sin", + "action": "MASK" + }, + { + "pattern_type": "prebuilt", + "pattern_name": "passport_canada", + "action": "MASK" + } + ], + "pattern_redaction_format": "[{pattern_name}_REDACTED]" + }, + "guardrail_info": { + "description": "Masks Canadian Social Insurance Numbers (SIN) and Canadian passport numbers" + } + }, + { + "guardrail_name": "ca-pii-health-drivers", + "litellm_params": { + "guardrail": "litellm_content_filter", + "mode": "pre_call", + "patterns": [ + { + "pattern_type": "prebuilt", + "pattern_name": "ca_ohip", + "action": "MASK" + }, + { + "pattern_type": "prebuilt", + "pattern_name": "ca_on_drivers_licence", + "action": "MASK" + } + ], + "pattern_redaction_format": "[{pattern_name}_REDACTED]" + }, + "guardrail_info": { + "description": "Masks Ontario Health Insurance Plan (OHIP) numbers and Ontario driver's licence numbers" + } + }, + { + "guardrail_name": "ca-pii-immigration", + "litellm_params": { + "guardrail": "litellm_content_filter", + "mode": "pre_call", + "patterns": [ + { + "pattern_type": "prebuilt", + "pattern_name": "ca_immigration_doc", + "action": "MASK" + } + ], + "pattern_redaction_format": "[{pattern_name}_REDACTED]" + }, + "guardrail_info": { + "description": "Masks IRCC immigration document numbers including UCI, work/study permits, and IMM references" + } + }, + { + "guardrail_name": "ca-pii-financial", + "litellm_params": { + "guardrail": "litellm_content_filter", + "mode": "pre_call", + "patterns": [ + { + "pattern_type": "prebuilt", + "pattern_name": "ca_bank_account", + "action": "MASK" + }, + { + "pattern_type": "prebuilt", + "pattern_name": "credit_card", + "action": "MASK" + }, + { + "pattern_type": "prebuilt", + "pattern_name": "visa", + "action": "MASK" + }, + { + "pattern_type": "prebuilt", + "pattern_name": "mastercard", + "action": "MASK" + }, + { + "pattern_type": "prebuilt", + "pattern_name": "amex", + "action": "MASK" + }, + { + "pattern_type": "prebuilt", + "pattern_name": "iban", + "action": "MASK" + } + ], + "pattern_redaction_format": "[{pattern_name}_REDACTED]" + }, + "guardrail_info": { + "description": "Masks Canadian bank account routing information (transit-institution-account) and payment cards" + } + }, + { + "guardrail_name": "ca-pii-contact-information", + "litellm_params": { + "guardrail": "litellm_content_filter", + "mode": "pre_call", + "patterns": [ + { + "pattern_type": "prebuilt", + "pattern_name": "email", + "action": "MASK" + }, + { + "pattern_type": "prebuilt", + "pattern_name": "us_phone", + "action": "MASK" + }, + { + "pattern_type": "prebuilt", + "pattern_name": "ca_postal_code", + "action": "MASK" + } + ], + "pattern_redaction_format": "[{pattern_name}_REDACTED]" + }, + "guardrail_info": { + "description": "Masks email addresses, phone numbers (North American format), and Canadian postal codes" + } + } + ], + "templateData": { + "policy_name": "canadian-pii-protection", + "description": "Canadian PII protection policy under PIPEDA and provincial privacy legislation. Masks SIN, OHIP, Ontario driver's licence, passport, IRCC immigration documents, bank account routing info, postal codes, email, and phone numbers.", + "guardrails_add": [ + "ca-pii-government-identifiers", + "ca-pii-health-drivers", + "ca-pii-immigration", + "ca-pii-financial", + "ca-pii-contact-information" + ], + "guardrails_remove": [] + }, + "tags": [ + "PII Protection", + "Canada" + ], + "estimated_latency_ms": 1 } ]