Most teams building LLM applications think about prompt injection. Far fewer think about what happens when their users send sensitive personal data to their model. It's happening right now. Users paste credit card numbers into chatbots to ask billing questions. They share SSNs in healthcare chat interfaces. They drop email addresses and phone numbers into support bots without a second thought. That data hits your LLM, gets logged, potentially ends up in fine-tuning datasets, and almost certainly violates whatever compliance framework your enterprise customers are bound by. PII filtering at the application layer is the fix — and it's simpler to implement than most teams expect. The Problem With Naive Regex The obvious approach is regex. Match a credit card pattern, block it. Simple enough — until you realize that naive regex produces so many false positives it becomes useless in production. A 16-digit number like 1234567890123456 matches every credit card regex pattern. But it's not a valid credit card.…