Gusto protects sensitive data from external LLM provider with Formal

Gusto deployed the Formal HTTP Connector between its Salesforce system and an external LLM provider's API to stop customer support ticket data containing personally identifiable information (PII) and protected health information (PHI) from reaching the third-party model. The Formal Connector uses machine learning with an Open-Policy-Agent-powered engine to identify and dynamically mask sensitive data in support tickets in real time, addressing the privacy and regulatory risk created when Gusto added an LLM-powered API to Salesforce for customer support.

Gusto sought to enhance customer support efficiency by integrating an LLM-powered API into their Salesforce system. However, this integration created significant security concerns since customer support tickets frequently contained sensitive personally identifiable information PII and protected health information PHI . The core risk was clear: sending unfiltered support ticket data to an external LLM provider could expose customer PII and PHI, violating data privacy obligations and regulatory requirements. Gusto adopted the Formal HTTP Connector as an intermediary between their Salesforce instance and the LLM provider’s API. The Formal Connector utilizes machine learning with an Open-Policy-Agent-powered engine to identify and dynamically mask sensitive data within customer support tickets in real-time, preventing data leakage.