# FAQ ## How to protect PII and customer data from LLMs and AI > **Summary:** Barndoor's Data Control Center inspects prompts, responses, and MCP tool calls, and its policies can block, redact, mask, or tokenize PII before it reaches a model. Every prompt sent to an LLM, every response returned, and every MCP tool call, input and output, flows through Barndoor's inspection layer while the Data Control Center runtime is enabled. In the Data Control Center you define three things: what data is sensitive, where to enforce protection, and what to do when a detection fires. **What it detects.** Built-in Protection Profiles cover Sensitive Identifiers (Social Security numbers, credit cards, emails, phone numbers, passports, dates of birth), Names & Locations, Secrets (cloud keys, API tokens, database credentials), Prompt Injection, and Custom Detections you define with regex or literal rules. **What it can do.** To protect data, a policy can Block the request or response, Redact the value with a typed placeholder, Mask it (for example `XXX-XX-6789`), or Tokenize it with a reversible token. Two other actions do not change the data: Alert Only records the detection and passes the payload through, and Bypass exempts matching traffic from further enforcement. **Where it applies.** Policies run at four stages: the request to the LLM, the LLM response, tool input, and tool output. **How to roll it out safely.** Any policy can be toggled into dry run, which logs detections without enforcing them, so you can validate a new policy before making it active. --- **Sources:** - [Data Control Center overview](https://docs.barndoor.ai/how-tos/data-control-center/overview) - [Masking & Partial Redaction](https://docs.barndoor.ai/how-tos/data-control-center/masking)