If you put a managed PII detector in front of every chat prompt, the detector can easily cost more than the model reading the prompt. Amazon Comprehend's PII meter works out to $1.00 per million characters at list price, and more like $2.00 on short chat messages because of its per-request minimum. Claude Haiku 5.5 reads the same million characters of input for about $0.025. That is a 40x gap at list price and roughly 80x on chat traffic.
Our recommendation, prices checked on each vendor's live page or price API on October 13, 2026: for conversational prompts, run Comprehend in two stages or self-host Presidio; use Google Sensitive Data Protection where the meter matters most and your labelled sample shows it catches what you need; skip Azure's Text PII for chat. Azure bills a 1,000-character record per message, which makes it the most expensive per real character on short text, and its F1 score on call transcripts was second-worst in a vendor-run four-way test.
What Each PII Meter Costs on the Same Chat Workload
The workload behind every number below: 10 million user messages a month, averaging 150 characters each (1.5 billion characters of user text), redacted before the prompt goes to the model. That is a mid-sized support assistant. Change the message length and the ranking changes, which is the point of the next section.
| Option | Published meter (checked Oct 13, 2026) | Billed minimum per call | 10M messages/month | Per 1M characters of real text | Free tier |
|---|---|---|---|---|---|
| Amazon Comprehend DetectPiiEntities | $0.0001 per 100-character unit | 3 units (300 characters) | ~$3,000 | ~$2.00 | 50K units/month for 12 months |
| Comprehend two-stage (ContainsPiiEntities on all, Detect on 10% flagged) | $0.000002 per unit, then $0.0001 | 3 units each | ~$360 | ~$0.24 | same |
| Azure AI Language, Text PII | $1.00 to $0.25 per 1,000 text records by volume band | 1 record (up to 1,000 characters) | ~$2,500 to ~$4,250 | $1.67 to $6.67 | 5,000 records/month (F0) |
| Amazon Bedrock Guardrails PII filter | $0.10 per 1,000 text units | 1 unit (up to 1,000 characters) | ~$1,000 | ~$0.67 | none listed |
| Google Sensitive Data Protection, content de-identify | $3/GiB inspect + $2/GiB transform (1 GiB to 1 TiB) | 1 KB | ~$40 | ~$0.03 | first 1 GiB |
| Microsoft Presidio, self-hosted | $0 licence (MIT) | none | your compute + your engineers | your compute | n/a |
| For scale: Claude Haiku 5.5 input on the same text | $0.10 per million tokens | ~$37.50 | ~$0.025 |
Sources for each row are linked in the sections that follow. The Haiku figure assumes about four characters per token, which is Google's rule of thumb for English; check your own tokenizer, since non-English text runs higher.
Why the Per-Request Minimum Sets Your Real Rate
On short messages, the minimum billable size sets your price far more than the list rate does. Every managed detector rounds a request up to some floor, and chat messages sit below every floor.
Amazon Comprehend's pricing page measures PII requests in units of 100 characters with a "3 unit (300 character) minimum charge per request." Its own worked example prices DetectPiiEntities at $0.0001 a unit. A 150-character message is billed as 300, so you pay twice the list rate per real character. A 60-character "yes, that's my account" pays five times. The same page shows volume discounts down to $0.000025 a unit, but in its worked example those tiers sit on toxicity detection, the PII examples use the flat $0.0001, and above 100 million units a month it says to contact AWS. Ask AWS in writing whether the PII meter discounts at your volume before you build a forecast on it.
Azure's floor is bigger. Azure AI Language's pricing page defines a text record as "up to 1,000 characters," and every message is at least one record. The page renders its rates with script, so we read them from Azure's public retail prices API: the Standard text record meter is $1.00 per 1,000 records, falling to $0.75 above 500,000, $0.30 above 2.5 million and $0.25 above 10 million (East US). A 150-character message pays for 1,000 characters. At the first band that is $6.67 per million real characters, the worst rate in the table.
Bedrock Guardrails uses the same 1,000-character unit at a tenth of Azure's first-band price: $0.10 per 1,000 text units for the sensitive information filter, with regex-only filters free.
Google's floor is the smallest. The Sensitive Data Protection pricing page bills content inspection at $3.00 per GiB from 1 GiB to 1 TiB and $2.00 above, transformation at $2.00 and $1.00, the first GiB free, and a 1 KB minimum per content request. A de-identify call is billed for both inspection and transformation. Even with every 150-character message rounded up to 1 KB, 10 million messages come to roughly 9.3 GiB, or about $40 a month.
Before you believe any quote, pull a week of production prompts and compute two numbers: the median user-message length and the share of messages under 300 characters. If most of your traffic is under the floor, the list rate tells you very little about your bill.
Does Redaction Cost More Than Inference?
For the user's own text, yes, often by more than an order of magnitude. No vendor publishes this comparison, so here it is.
Per million characters of user text (roughly 250,000 tokens):
- Claude Haiku 5.5 input at $0.10 per million tokens: about $0.025.
- Gemini 2.5 Flash-Lite at $0.10 per million input tokens: about $0.025. See our Gemini Flash page.
- Claude Haiku 4.5 at $1 per million: about $0.25.
- Claude Sonnet 5.5 at $2 per million: about $0.50.
- Comprehend DetectPiiEntities: $1.00 at list, about $2.00 on 150-character messages.
The model reads more than the new message, though. It reads the system prompt, retrieved context and the conversation history on every turn, while redaction only needs to scan the new user text. Take one turn with a 4,000-token prompt on Haiku 5.5: $0.0004 of input. The Comprehend call on the 150-character message is $0.0003. Per turn the two are close, and that is the honest comparison.
It still lands against the detector. Most of that 4,000-token prompt is a stable prefix, and Haiku 5.5 bills cache hits at $0.01 per million tokens. Once caching works, the model's input cost per turn falls well below the Comprehend call. A redaction meter that costs about the same as the model on day one becomes the larger line item after you do the usual cost work on the model. We covered that pricing in Claude Haiku 5.5's 100K-token tier and what inference costs per million tokens.
The Cheapest Fix Is a Two-Stage Comprehend Call
If you want Comprehend's recall, screen every message with ContainsPiiEntities and only run DetectPiiEntities on the hits. AWS prices the two very differently. In the same pricing page's worked examples, ContainsPiiEntities is $0.000002 a unit, one fiftieth of DetectPiiEntities. Run the screen on all 10 million messages (about $60 with the minimum applied) and the full detector on, say, the 10% that come back positive ($300). The total is about $360 a month against $3,000.
Two caveats. The screen's own miss rate is now part of your leak rate, so measure it on your labelled sample before you rely on it. And the 10% hit rate is an assumption; a support desk where every user types an account number will flag far more.
Also know what the real-time call returns. Comprehend's documentation says real-time analysis returns entity types and character offsets; the redacted copy of the text comes from an asynchronous batch job. In a prompt path you mask the offsets yourself. The same page lists PII detection in English and Spanish only, which settles the question for a multilingual help desk.
Who should not pick Comprehend: anyone whose traffic is mostly outside English and Spanish, and anyone off AWS who would add a cross-cloud hop to every prompt.
When Does Self-Hosting Presidio Pay Off?
Self-hosting replaces the per-request meter with a fixed cost for compute and people, and the crossover is mostly about people. Microsoft Presidio is MIT-licensed. Its documentation describes recognizers built on named-entity recognition, regular expressions, rule-based logic and checksums, deployable from Python to Kubernetes. It also says Presidio "is transitioning to a community-owned project," which is worth reading before you make it a dependency for the next five years. A second option is OpenAI Privacy Filter, an open-weight detector released under Apache 2.0 that runs locally; we looked at it when it shipped.
You trade the meter for tuning and ownership. Presidio's README is blunt: "there is no guarantee that Presidio will find all sensitive information." Out of the box it scored lowest of every tool in the benchmark below. Most of that gap closes with custom recognizers and context words for your own identifiers (account formats, ticket IDs, member numbers), and that work is engineering time that never ends, because your identifiers change.
So work out the crossover from your own numbers. At 10 million short messages a month, the managed bill ranges from about $40 (Google) to about $3,000 (Comprehend Detect). Put your loaded cost for the share of an engineer who will own the recognizers next to that figure. If Google's meter passes your accuracy test, self-hosting will rarely beat it on cost alone. Against single-stage Comprehend, self-hosting starts paying once you are past tens of millions of messages, or once you need a language Comprehend does not cover.
Who should not self-host: teams without anyone to own detection quality. Untuned, it posted the lowest recall in the benchmark below.
Where Should Redaction Sit: Gateway, App or Provider?
Only redaction that runs before the request leaves your network keeps raw identifiers out of the provider's logs. Where you put the detector changes both the bill and what is exposed.
- At the gateway. One choke point, one policy, every app covered. It is the natural home for a self-hosted detector next to LiteLLM or Kong AI Gateway. The gateway sees only text, so it cannot tell a customer's name from a product called "Morgan." We compared gateways in Best LLM Gateways for Cost Control.
- Inside the application. The app knows which field is a name and which is free text, so it can mask structured fields deterministically and send only free text to a detector. That cuts both the detector bill and the false positives.
- At the provider. Bedrock Guardrails masks PII in prompts and responses, but its own documentation says that with invocation logging enabled, the logged input "always contains the original, unmodified request," and the trace output returns the original PII value. It also does not mask PII inside tool-call arguments or tool results. Provider-side filtering protects the model's output while the raw identifiers still reach the provider's infrastructure.
On the default API terms, OpenAI keeps inputs and outputs in abuse-monitoring logs "for up to 30 days"; zero data retention requires OpenAI's approval and covers only some endpoints. If the goal is to keep identifiers out of those logs, redact in your app or gateway, or get ZDR in writing.
Accuracy Is the Cost That Never Shows on the Invoice
A missed identifier leaks, and a false positive mangles the prompt and degrades the answer; neither shows up on the bill. Recall is the share of real identifiers the detector catches. Precision is the share of its flags that were real.
The most detailed public four-way comparison, with per-tool scores, is run by a vendor that sells a competing detector, so treat it as directional. Tonic's benchmark, run in October 2025 and scored per word, reported these results on customer-service call transcripts, the closest of its datasets to chat:
| Tool | Precision | Recall | F1 |
|---|---|---|---|
| AWS Comprehend | 0.83 | 0.90 | 0.86 |
| Google Cloud DLP | 0.57 | 0.52 | 0.54 |
| Azure AI Language | 0.43 | 0.65 | 0.52 |
| Microsoft Presidio | 0.40 | 0.46 | 0.43 |
Another vendor, Limina, reported in April 2026 aggregate recall between 57% and 73% for the same four tools on 45,000 words of enterprise data, with Comprehend at 73%, and says accuracy "degrades for non-English languages." The two vendors disagree on the absolute numbers. Both put Comprehend first among the four.
That is why Google wins on price in our table but not outright in our verdict. At 52% recall on transcripts, the cheapest meter would let about half the identifiers through. Your data may differ (structured identifiers such as card numbers are easier than names in free text), and the only way to know is a labelled sample: a few hundred real prompts per data type and per language, annotated by hand, run through each candidate with the same scoring.
Who should not pick Google SDP: teams that need names caught in free-form chat and have not yet measured its recall on their own transcripts.
What Redaction Does Not Fix
Redaction shrinks what the provider sees, and every obligation you had before still applies. Detector vendors tend to market it as if those obligations ended.
Under GDPR, Recital 26 treats pseudonymised data that can be attributed to a person with additional information as information on an identifiable person. Replacing "Maria Lopez" with {NAME} while the account history stays in the prompt often leaves the person identifiable. Your DPA with the model provider, its retention terms, and the question of what residual data sits in logs, caches and evals all still apply. A detector is one layer inside those controls. If you need data the model can learn from without real identifiers, synthetic data is a different tool; see Best Synthetic Data Platforms.
The Decision: What Actually Predicts Regret
Four inputs decide this. Gather them before you sign anything.
- Median message length and the share under 300 characters. This decides whether Comprehend's or Azure's floor dominates your bill.
- Recall on your own labelled sample, per data type and language. This decides whether Google's price advantage is usable.
- Your languages. Comprehend PII covers English and Spanish only.
- Where the raw text must not go. If the provider's logs are off-limits, provider-side filters are out and the detector runs in your network.
This Week: Export a week of user messages, compute the median length and the under-300 share, and redo the table above with your numbers.
This Month: Label 300 messages per language and run Comprehend (both stages), Google SDP and a tuned Presidio over them. Record recall and precision per entity type.
Before Renewal: Get the PII volume tiers from AWS in writing if you are above 10 million units a month, and confirm whether your provider has granted ZDR on the endpoints you use.
The Bottom Line
Managed PII detection was priced for documents. Chat messages are short, so minimums dominate, and small models are now cheap enough that the detector can be the bigger line item. Comprehend has the best published recall and the most punishing minimum, so run it in two stages. Google has the cheapest meter and recall you must verify yourself. Azure's 1,000-character record makes it the worst fit for chat. Presidio is free to license and costs engineering time to tune.
Compute your median message length before you compare any quote.
Continue Reading
- OpenAI Privacy Filter: The Free PII Detection Model That Runs On Your Laptop
- Best LLM Gateways for Cost Control: Self-Host First
- Inference Cost per Million Tokens: Price the Task, Not the Rate
- NeMo Guardrails vs Guardrails AI vs Lakera: Buy the Detector
- AI Gateway vs API Management: No Managed Gateway Caps Your Spend
- Claude Haiku 5.5 Charges 5x Once a Prompt Passes 100K Tokens