Turkish NLP
PII Detection
Token Vault
Human-in-the-loop
PostgreSQL
AI Security
Local secure MVP · Synthetic data
Turkish PII-Protected Secure AI Chat
In AI chat systems, personal data users type into messages — national ID numbers,
IBANs, phone numbers, addresses, emails and order references — can flow
uncontrolled to model, log or browser layers. The security boundary is not just
masking visible fields; it also includes where token mappings are stored,
what the frontend can access, and whether high-risk actions require explicit
human confirmation.
I built a local AI chat MVP with Turkish PII detection using
tr_core_news_trf and structural rules, two protection modes
(PLACEHOLDER and TOKENIZED), an encrypted PostgreSQL Token Vault, and a
second-confirmation mechanism for order cancellation and email simulations.
I verified the system not just through successful API responses but by
inspecting the DOM, console, storage layers, and browser network traffic
separately. No sensitive data leakage was observed on tested surfaces.
No real LLM, ERP or email service connected. Synthetic test data. No full KVKK compliance claimed. Local deployment only.
- PROBLEM
- Personal data typed into AI chat flowed uncontrolled to model and browser layers — with no detection, protection or human confirmation before action.
- APPROACH
- Detected Turkish PII before model calls using a hybrid NER + rule approach; protected it with placeholder or encrypted token by scenario; stored mappings in an encrypted Vault; gated destructive actions behind explicit user confirmation.
- OUTCOME
- Tokenization, order lookup, confirmed cancellation and email simulation all ran end-to-end. No sensitive data leakage observed on tested browser surfaces. No horizontal overflow across four screen sizes.