Measured October 21, 2026 · promptShield 1.4.1 · Presidio 2.2.364
Microsoft Presidio vs promptShield
Re-run on 48 new documents in 8 languages, with every piece of personal data in them labelled word by word. Both tools read the same extracted text, and we count every sensitive word each one leaves readable. The documents, the labels, the scorer and every raw result are published, so you can check it yourself.
About the name: Presidio was built at Microsoft and has since become an independent, community-governed project under the Data Privacy Stack organisation. It is still MIT-licensed and Microsoft supported the move. We keep "Microsoft Presidio" in the title because that is what most people search for. Read the project's transition notice
TL;DR
Presidio 2.2.364, default install, large spaCy models
1,327
sensitive words left readable, out of 4,489 · 70% caught
promptShield 1.4.1
92
sensitive words left readable, out of 4,489 · 98% caught
promptShield also highlighted less that was not personal data: 1.9 wrong highlights per document to remove, against 9.8 for Presidio. 24 of the 48 documents came out with nothing sensitive left readable, against 0 for Presidio. With the small spaCy models most quickstarts install, Presidio left 1,583 words readable.
How promptShield's detection changed, release by release
The first version of this page measured promptShield 1.0.14. We ran 7 releases, from that one to today's, over the same documents, each from its own source code and through its own Detect button. Polish arrived in 1.4.0, so these charts count the seven languages every release supports.
Show the numbers
| Release | Date | Caught | Words left readable | Wrong highlights per document | Documents with nothing left readable |
|---|---|---|---|---|---|
| promptShield 1.0.14 | Jun 16, 2026 | 74.3% | 999 | 4.5 | 0 / 42 |
| promptShield 1.1.3 | Aug 6, 2026 | 74.3% | 999 | 4.5 | 0 / 42 |
| promptShield 1.2.0 | Aug 22, 2026 | 74.6% | 987 | 4.5 | 0 / 42 |
| promptShield 1.2.5 | Sep 28, 2026 | 76.5% | 915 | 4.5 | 0 / 42 |
| promptShield 1.3.4 | Oct 5, 2026 | 98.1% | 73 | 2.0 | 22 / 42 |
| promptShield 1.3.8 | Oct 15, 2026 | 98.1% | 73 | 2.0 | 22 / 42 |
| promptShield 1.4.1 | Oct 21, 2026 | 98.1% | 73 | 2.0 | 22 / 42 |
| Presidio 2.2.364 | – | 71.4% | 1,120 | 10.3 | 0 / 42 |
Through September, promptShield caught about as much as Presidio, with less noise: 74% of sensitive words in 1.0.14, with 4.5 wrong highlights per document. The jump that follows is four rounds of detection work between 30 September and 2 October, each scored on documents the engine had never seen. They went after ID numbers, addresses, phone numbers and names written in capitals, and cut false positives at the same time. Since then the seven languages have held steady, and the work went into Polish: promptShield 1.4.1 catches 97% of sensitive words in the Polish documents, Presidio 64%.
Feature comparison
| Feature | promptShield | Presidio |
|---|---|---|
Multi-language regex recognizer (60+ types) Presidio: EN-primary by default | ◦ | |
Multilingual entity model (Davlan) Presidio: requires custom HuggingFace entity recognizer | ◦ | |
Optional LLM layer for contextual PII | ||
US NPI / ABA / DEA checksum validation Presidio: NPI and MBI included, ABA/DEA partial | ◦ | |
AU TFN / ABN / ACN / Medicare checksum validation | ||
BR CPF / CNPJ checksum validation | ||
CH AHV checksum validation | ||
MX CLABE checksum validation | ||
NL BSN / RSIN checksum validation | ||
French NIR (social security) validation | ||
Jurisdiction-boilerplate filter "governed by the laws of X" → X not flagged | ||
Intra-page PERSON span coalescence "Pierre Dubois" kept, bare "Pierre" dropped | ||
Generic-department ORG filter | ||
Role-title PERSON filter | ||
Finished desktop application with review GUI | ||
Reversible tokenization (encode / decode) Presidio: separate anonymizer layer | ◦ | |
100% offline processing (no cloud dependency) | ||
Custom recognizers via API | ||
Python library for custom integration | ||
Azure AI Language integration |
✓ = included by default · ◦ = available via custom configuration · ✗ = not present
Noise categories Presidio (default install) emits and promptShield suppresses
URLs in contract footers
Privacy policy link, support page URL, generic legal contact. ~8–10 spans per contract, virtually none of which is PII the reviewer wants to redact.
UrlRecognizerStandalone country / city mentions in jurisdictional prose
"governed by the laws of France", "registered office in Paris", "company incorporated in Germany". In a French financial statement, Presidio emits 73 LOCATION spans; almost all are contract chrome.
filter_jurisdiction_boilerplate + filter_standalone_countryPERSON fragments
The same name appears as three separate spans: "Pierre", "Dubois", "Pierre Dubois". On an Italian contract, Presidio emits 26 PERSON spans, the same names repeated and split into first-name, last-name, and full-name fragments.
filter_span_coalescenceGeneric department names tagged as ORG
"Marketing", "Vorstand", "Direction Générale", "Board of Directors", "Comitato di Direzione". These aren't organisations the reviewer wants to redact.
filter_generic_org (90-entry stoplist × 7 languages)Role titles tagged as PERSON
"CEO", "Directeur", "Geschäftsführer" capitalised at line start, sometimes mis-tagged as PERSON by the entity model.
filter_role_titlesWhen to choose Presidio instead
Presidio is the right choice when:
- You're building a custom Python-based DLP pipeline and want library-level control.
- You need to integrate cloud services (Azure AI Language, AWS Comprehend) under one PII abstraction.
- You want to fine-tune your own recognizers for proprietary entity types.
- You're processing text streams (not bounded documents) and need a service-shaped library.
Presidio is open source under MIT and promptShield is a commercial product. Pick the one that fits the job.
When to choose promptShield
- You're anonymizing bounded PDF/DOCX/XLSX documents on the desktop.
- You need country-specific checksums out of the box (TFN, CPF, NPI, IBAN, etc.) without writing them yourself.
- You want a finished GUI workflow (review, redact, tokenize, export) rather than a library to integrate.
- Your customers can't send documents to a cloud service for compliance reasons.
Reproduce it yourself
Every number on this page comes from the files in the public repo: the 48 documents and their labels, each tool's raw output, and the scorer. No number comes from a run you cannot check.
git clone https://github.com/promptshield-Inc/pii-detection-benchmarks
cd pii-detection-benchmarks
pip install -r requirements.txt
python presidio_run.py lg
python score.pyThe first command re-runs Presidio on the published text; the second scores every result in the folder against the labels. Neither needs promptShield installed.
Frequently asked questions
Is Microsoft Presidio still a Microsoft project?
No. Presidio started at Microsoft and has completed its move to independent, community governance: it is maintained by contributors and volunteers under the Data Privacy Stack organisation and is not owned or operated by a commercial entity. Microsoft supported the transition. The licence stayed MIT and it is the same codebase, so nothing in this benchmark depends on who holds the repository. Older links to the microsoft.github.io documentation may break; the docs now live at presidio.dataprivacystack.org.
Is Microsoft Presidio free?
Yes. Presidio is released under an MIT licence and there is no fee at any volume. The cost is engineering time rather than money: Presidio gives you detection primitives, not a finished workflow, so a working deployment usually means building document parsing, a review interface and whatever storage your retention policy demands around it. Whether that is cheaper than a licence depends on how much of that scaffolding you already have.
Do I need to be a developer to use Microsoft Presidio?
In practice, yes. Presidio is a Python library driven from code or from a service you host yourself, and the project ships no desktop application and no end-user interface. That is a design decision rather than a gap: it is built to sit inside a pipeline someone else assembles. If the people handling the documents are lawyers, analysts or compliance staff rather than engineers, something has to be built in front of Presidio before it reaches them.
Is Microsoft Presidio a DLP tool?
Not on its own. Presidio detects and anonymizes personal data in content you pass to it, which is one component of data loss prevention, but it carries none of the surrounding machinery: no policy engine, no endpoint or network enforcement, no alerting, no audit trail. Plenty of teams use it as the detection layer inside a DLP system they build themselves. Bought as a finished DLP product, it is not one.
Who are Microsoft Presidio's main competitors?
It depends which part you are replacing. As a detection library the nearest comparisons are the cloud personal-data services (Azure AI Language, Google Cloud DLP, AWS Comprehend), which Presidio can call rather than compete with. As a way to actually get documents redacted, the comparison set is finished tools such as promptShield, Adobe Acrobat and the cloud redaction services, where the trade is licence cost against the engineering you would otherwise do yourself.
Is promptShield open source like Presidio?
No. Presidio is an open-source library under an MIT licence and promptShield is a commercial product, which is a real difference and worth stating plainly. What is public is the part that matters for trusting this page: the benchmark harness, the test documents and the raw result files are all published, and the Presidio side of the script runs standalone without promptShield installed. You do not have to take the numbers on faith.
Does promptShield use Presidio internally?
No. The detection engine is our own, and the choice was architectural rather than a judgement on Presidio's quality: promptShield processes bounded documents on a device that may have no network at all, where Presidio is shaped as a library for text streams in a server pipeline. The layer that decides which detections a reviewer would dismiss is where most of the work sits, and it needed to be ours.
Can I use both together?
They sit at different points and combine cleanly. Presidio is a good fit for high-volume scanning inside your own systems, where a library integrates into a pipeline. promptShield fits the smaller set of documents where a person has to review what was found and stand behind the result before the file goes anywhere. Broad automated coverage in the pipeline, careful human-checked handling for the documents that carry consequence.
Caveats
- Default install only. Presidio ran with its built-in recognizers, one spaCy model per language, no custom recognizers and no score threshold. For Polish we added the one label mapping Presidio needs to read Polish spaCy entities; without it, Presidio finds no Polish names at all. A tuned install with custom recognizers and a transformer model would do better than this.
- Invented documents. The 48 documents are realistic but fictional: contracts, invoices, bank statements, medical letters, HR letters and legal correspondence, as clean born-digital PDFs. Scans, OCR errors and messy layouts are not measured here.
- Who wrote the labels. The documents and their labels were written by AI agents following a published labelling spec, one language each, with no access to promptShield's detection code, and every label was checked against the extracted text by script. No human annotator reviewed them. The labels are public: if you find a wrong one, tell us and we will publish the correction.
- Past releases, run today. Each earlier release ran from its own source code on the same machine, with today's model files. Engines the installed app could not load in that release (they needed PyTorch, which the app does not ship) were blocked here too, so each release ran the engines its users actually had. Release 1.2.8 is left out for that reason: a build problem kept its installed app from loading the newer engines, so its source code would overstate what its users got.
Ranking
The 10 best offline anonymization tools in 2026
Ten desktop tools that remove personal data on your own machine, scored by the same published rules, ours included. Every fact links to its source.
See the rankingFound this useful? Let us know.