Design a meeting summarizer for an enterprise whose transcripts routinely contain names, salaries, and health details. Customer contracts forbid sending raw PII to any external model provider. Walk through the pipeline from transcript to delivered summary, and where the sensitive data lives at each step.
Free · 2 AI evals / day
Meetings contain a lot of personal information: names, salary numbers, health details, internal project codenames. The contract with your customer says none of that can be sent to the external LLM provider. So you cannot just stream the transcript at GPT-5.5 and ask for a summary.
The pattern is **redact, summarize, rehydrate.** First, before anything leaves your network, scan the transcript and replace every sensitive entity with a placeholder like PERSON_1 or SALARY_2. The mapping from placeholder to real value gets stored in a secure database inside your network. Only the redacted text travels to the LLM.
The LLM produces a summary that still talks in placeholders. Back inside your network, you look up the placeholders in the mapping and substitute the real values, but only the values the person reading the summary is allowed to see.
For your most sensitive customers, you can offer an even stronger option: run an open-weight model inside their VPC, so the data never crosses your perimeter at all. Either way, the contract terms with the external provider become a backup safety net, not the primary control.
The architecture has four stages, with the trust boundary at the perimeter of your VPC.
**Stage one: detection inside the perimeter.** Run a multi-detector pass over the transcript: a fine-tuned NER model for people and organizations, regex and pattern detectors for emails, phone numbers, account IDs, dollar amounts, and dates. Combine detector outputs and resolve overlaps. Run it as a service, not embedded in the application, so you can version detectors and retrain them on missed cases.
**Stage two: reversible tokenization.** Replace each detected entity with a stable placeholder (PERSON_1, SALARY_3). Store the placeholder to value mapping in an access-controlled vault keyed by transcript ID. Never write the mapping to application logs, OTel traces, or analytics events.
**Stage three: external summarization on redacted text.** Send the redacted transcript to the hosted LLM. The provider sees text that talks about PERSON_1 and PERSON_2 negotiating SALARY_3 against PROJECT_4. Zero-retention and no-training contract terms are defense in depth.
**Stage four: rehydration with viewer permissions.** Back inside the perimeter, walk the summary's placeholders and substitute real values, but only those the requesting viewer is authorized to see. A summary delivered to HR fills in salary; the same summary delivered to a project lead leaves it as SALARY_3 or redacted.
**Plus a self-hosted path** for highest-sensitivity tenants, where a Llama 4 Maverick or Mistral Large class model runs in your VPC and no transcript leaves at all.
Quick reference
TL;DR
Redact inside your perimeter with reversible placeholders, send only placeholders to the LLM, rehydrate behind the wall with viewer permissions. Logs hold redacted text only.
Imagine you have to translate a confidential letter using a translator who is not allowed to read names or numbers. So before sending the letter, you cover every name with a sticky note that says PERSON_1, every salary with SALARY_2, and you keep the real values locked in a safe at home. The translator works on the version with sticky notes and sends back a translation that still says PERSON_1 and SALARY_2. Back home, you peel off the stickies and put the real names back, but only for readers who are allowed to see them. The translator never saw the secrets, your records do not store them in the wrong place, and the people who get the final letter see what they are supposed to see, no more.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.
Customer contract forbids any data leaving the perimeter, even redacted The redact and send pattern still ships bytes to the provider; some contracts disallow that regardless of content. A self-hosted model is the only compliant answer.
Transcripts are extremely free-form and detector recall stays below tolerance If you cannot get recall above the agreed bar on your traffic, the gate is a false-confidence layer. Either invest in better detectors or move the workload self-hosted.
Summaries must preserve exact quoted phrasing including names Reversible tokenization works for entities you can swap out, not for the case where the wording itself must be preserved verbatim. Use a different summarization shape.
The pipeline cannot guarantee mapping store availability If the vault is down at rehydration time, the summary cannot be reconstructed. Either harden the vault to the same SLO as the rest of the system or do not promise rehydration.
Quick scan · 2–4 min
Everything important, quickly.
8 min: the four-stage architecture, detector composition for recall, why the vault is separate from the transcript store, rehydration as a permissions decision, observability as a leak surface, the self-hosted tier as an architectural option.
Real-world examples
Real products, models, and research that use this idea.
1AWS Bedrock and Azure OpenAI offer regional endpoints plus zero-retention terms, used as the defense in depth layer behind a customer-side redaction gate at most enterprise shops.
2Microsoft Presidio is the most-cited open-source detector stack for the in-perimeter redaction service, often fine-tuned on the customer's own labeled traffic.
3Otter.ai and Read.ai expose enterprise tiers with explicit no PII to provider commitments, implemented as the same redact summarize rehydrate pattern at scale.
4Healthcare and legal SaaS vendors offer a self-hosted Llama 4 Maverick option for customers whose contracts forbid any cross-perimeter inference.
5Langfuse and Helicone both ship hooks for redacting payloads before they are stored in the trace store, recognizing that observability is a major PII surface.
Interviewer follow-ups
What an interviewer would ask next. Try answering before peeking at the approach.
QHow do you measure and report redaction recall to the customer?
Sign in or go Pro to see the approach for this follow-up.
QHow do you handle entities that span sentences or get referred to with pronouns?
Sign in or go Pro to see the approach for this follow-up.
QWhat changes when the customer wants the summary in real time during the meeting?
Sign in or go Pro to see the approach for this follow-up.
Don't say this
Red flags and common mistakes that signal junior thinking. Click to expand.
Most common mistake
Relying on a provider's zero-retention contract instead of redacting. Contracts reduce liability after a breach; they do not stop the bytes from crossing the wire.