Agentic AI Wiki
AI Blog / Presidio vs Limina vs Skyflow vs Nightfall: you are choosing a boundary, not a detector
AI Blog

Presidio vs Limina vs Skyflow vs Nightfall: you are choosing a boundary, not a detector

These four are sold as four ways to keep personal data out of your model traffic, and they are actually three different boundaries — vault at collection, transform on the wire, find it after the fact — which is what decides your residual risk. Two of them are classifiers, so a miss is a leak nothing reports; and every redaction is a lossy transform applied to the same trace your incident response will need.

By Agentic AI Wiki 14 min read

Every evaluation of these four ends up comparing detection accuracy, which is the one axis on which they are not really competing: they sit at three different boundaries — a vault that substitutes the value at collection, a transform that rewrites text on its way to the model, a platform that finds exposures already sitting in your SaaS — and the boundary, not the recall number, is what decides the risk you are left holding. Two of the four are classifiers, so a miss is a leak that nothing in the pipeline reports; and all four leave you with the same under-discussed artefact, a redacted trace that your incident response will one day need and no longer contains the evidence.

At a glance

Four tools that appear on the same shortlist and answer different questions. Sorted by where in the data's life they act.

ToolShapeDeliveryWhere it acts
Skyflow Privacy vault — tokenise and store Managed service with a governance layer At collection, before the value reaches your systems
Presidio Detection and anonymisation framework Open source, MIT, self-hosted library or service On the wire, wherever you call it
Limina (formerly Private AI) De-identification models, packaged Containers you run in your own environment On the wire, with a commercial accuracy claim
Nightfall Cloud DLP across SaaS, browser and endpoint SaaS with policy and incident workflow After the fact, wherever data has landed
Four sensitive-data tools against four axes A matrix. Presidio is weak on giving a guarantee without detection, strong on self-hosting, medium on reversible re-identification, and weak on coverage beyond the model call. Limina is weak on guarantee without detection, medium on self-hosting, strong on reversible re-identification, and weak on coverage beyond the model call. Skyflow is strong on guarantee without detection, weak on self-hosting, strong on reversible re-identification, and medium on coverage beyond the model call. Nightfall is weak on guarantee without detection, weak on self-hosting, weak on reversible re-identification, and strong on coverage beyond the model call. What each one is actually good at Guarantee without detection Self-host or open source Reversible re-identification Coverage beyond the model call Presidio Weak Strong (MIT) Medium Weak Limina Weak Medium (container) Strong Weak Skyflow Strong Weak Strong Medium Nightfall Weak Weak Weak Strong Weak Medium Strong
No row is strong across the board, and the gaps are structural — a guarantee at collection and coverage of data you never collected are opposite designs.

Presidio — deep dive

A framework, and the tuning is yours

Presidio is the open-source default, MIT-licensed, and in 2026 it moved out of Microsoft into the independent, community-governed Data Privacy Stack organisation — a transition worth knowing about if your procurement paperwork names the old owner, and a mild positive for anyone who worried about a single vendor's roadmap. Architecturally it is a set of recognisers feeding a set of operators: regular expressions, deny lists, checksums, context words and named-entity recognition decide what is sensitive; replace, redact, hash and encrypt decide what happens to it.

What free actually costs

The honest framing is that Presidio ships you the plumbing and leaves the accuracy to you. Out of the box it finds the obvious entity types in English; the customer reference format your billing team invented, the local identity-number scheme, the free-text field where agents type things they should not — those are recognisers you write, tune and regression-test. That is a real engineering commitment and it is also the only one of the four where you can inspect exactly why something was or was not caught, which for a regulated deployment is worth more than a few points of benchmark recall.

Limina — deep dive

The same boundary, bought instead of built

Limina is Private AI under a new name — the company rebranded in March 2026 — and it occupies the same position in the pipeline as Presidio with the trade reversed: you pay, and in exchange the entity coverage, the language coverage and the accuracy on messy real-world text arrive already tuned. It runs as containers in your own environment, which is the property that matters for buyers who cannot send raw text to a third party at all, and it is aimed squarely at healthcare, insurance and financial-services workloads where the entity list includes PHI and the tolerance for a miss is close to zero.

Where the money goes

The value is concentrated in two places that are easy to under-rate. The first is breadth: many entity types across many languages, maintained by someone else, which is the difference between a project that ships and a backlog of recogniser tickets. The second is reversibility — a de-identification pipeline built to put the values back is a different product from one built to destroy them, and the restore path is where home-grown implementations usually break.

Skyflow — deep dive

Not a better detector — a different claim

Skyflow is the odd one out and the most interesting of the four, because it is not trying to detect anything. A privacy vault holds sensitive values in an isolated store and hands your systems a token; your application, your logs, your analytics and your model prompts contain the token, and the real value is fetched only by a caller with an explicit policy grant. The security property does not depend on a classifier being right. It depends on the value never having been in your systems to leak, which is a categorically stronger statement than "our model has high recall".

The catch is architectural, not technical

You only get that guarantee for data you control the collection of. A vault does excellent work on the account numbers, card details and identity documents your product asks users for. It does nothing about the transcript of a support call, the contents of a customer's uploaded PDF, or the free text an employee pastes into an agent — data that arrives already mixed, which is precisely the data agentic workloads live on. Skyflow's 2026 direction acknowledges this, extending into enterprise AI search and runtime data controls for agent platforms, but the fundamental asymmetry stands: vaults are for data you asked for, detectors are for data that showed up.

Nightfall — deep dive

The unit of work is an incident, not a request

Nightfall is DLP in the classical sense, extended to the places work now happens: SaaS applications, the browser, the endpoint, with a single policy framework and — as of its 2026 direction — an autonomous triage layer for the alert queue. It is the only one of the four whose output is a workflow rather than a transformed string, and that is the tell for where it belongs. You do not put Nightfall in the path of a model call; you put it where you need to know that a payroll export is sitting in a shared drive, or that someone pasted a customer list into a chat.

What after-the-fact buys, honestly stated

Detection after landing cannot prevent an exposure, and a vendor who implies otherwise should be pushed on it. What it bounds is duration — how long sensitive data sits somewhere it should not — and duration is a legitimate control objective, particularly for the enormous surface of employee behaviour that no inline transform will ever see. Judge it on time-to-detection and on false-positive load on whoever works the queue, not on catch rate.

Cross-cutting comparison

Three boundaries, four products

Three boundaries where sensitive data can be stopped Three columns. At collection, a vault such as Skyflow substitutes a token before the value ever enters your systems, which is a guarantee rather than a detection, but requires control over the point of entry. On the wire, a detector such as Presidio or Limina transforms the text on its way to the model, which works on data you did not collect but is a classifier and therefore misses some of it. After the fact, a DLP platform such as Nightfall finds sensitive data already sitting in SaaS, browsers and endpoints, which bounds how long an exposure lasts rather than whether it happens. Where the sensitive value is stopped At collection — the vault Skyflow. The value never enters your systems; a token does. Buys: a guarantee, not a detection. Needs control of the entry point. On the wire — the detector Presidio, Limina. Text is transformed on its way to the model. Buys: coverage of data you did not collect. It is a classifier. It misses some. After the fact — DLP Nightfall. Finds sensitive data already sitting in SaaS, browser, endpoint. Buys: a bound on how long exposure lasts. Not on whether it happens. The three are stackable and priced independently. Picking two is common; picking by benchmark recall is the mistake.
Stack them if the budget allows; the mistake is picking two that sit at the same boundary and believing you have defence in depth.

Framed this way, most shortlist arguments dissolve. Comparing Skyflow's guarantee with Presidio's recall is comparing a structural property with a statistical one. Comparing Nightfall's coverage with Limina's accuracy is comparing an exposure-duration control with an exposure-prevention control. The genuine decision is which boundary carries most of your risk: if your sensitive data mostly arrives through forms you own, the vault is the strongest single move; if it mostly arrives inside unstructured content you did not author, you are buying a classifier whether you like it or not; if your problem is people rather than pipelines, neither helps and DLP does.

Two of them are classifiers, and the error that costs you is the quiet one

Presidio and Limina are detectors, which means the arithmetic that governs every detector governs them — and with the asymmetry pointing the opposite way from an injection classifier. There, a false positive is the expensive error, because blocking legitimate traffic is visible. Here the expensive error is the false negative: the identifier that was not recognised is forwarded verbatim to the model, written into the provider's logs and possibly into somebody's training corpus, and nothing in the pipeline emits a signal. A redaction system fails silently by construction, so a dashboard showing entities redacted per hour is a picture of what it caught and tells you nothing about what it missed. The only honest measurement is a blind, uniformly sampled human review of the post-redaction stream, priced and scheduled like any other recurring cost. This is the same discipline as evaluating guardrails and detectors, applied to the error that does not page anyone.

Redaction is lossy on purpose, and the loss lands somewhere

The redact-and-restore round trip, and the three places it leaks value A pipeline. A source record containing real identifiers passes through a transform that replaces them with placeholders and stores a mapping. The placeholder text goes to the model, the model's answer comes back referring to placeholders, and a restore step puts the real values back before the user sees them. Below the pipeline, three annotations: a miss in the transform sends the real value onward and nothing reports it; the trace store keeps the redacted copy, so incident response reads the version with the evidence removed; and the placeholder map becomes the most sensitive store in the system. The round trip nobody scores Source record Jane Alvarez acct 8842 Transform vault, or detect and replace Model sees PERSON_1 ACCT_1 Answer returns "PERSON_1 owes on ACCT_1" Restore user sees the real values 1 · A miss goes straight through A detector is a classifier. The identifier it did not recognise is forwarded verbatim, and nothing in the pipeline reports it. 2 · The trace keeps the redacted copy Incident response, debugging and evaluation all read the version with the evidence removed. That loss is permanent. 3 · The placeholder map is now your most sensitive store Restoring the answer requires a durable mapping from token to value. It is a re-identification key for every conversation that used it, it needs its own access policy and retention rule, and it is the artefact most redaction evaluations never mention.
The restore path is where home-grown redaction breaks, and the mapping it depends on is rarely on anyone's asset inventory.

Three costs come with the transform and none of them appear in a vendor comparison. The first is task quality: an agent that receives PERSON_1 cannot address the customer by name, and if the same person is tokenised inconsistently across two documents it cannot tell they are the same person — a support agent quietly loses the ability to say "this is the third time you've written to us". The second is your own forensics: the trace store keeps the redacted copy, so when you investigate an incident six weeks later, the evidence was removed by a control you deployed on purpose, and PII redaction in agent traces is precisely the trade-off to make deliberately rather than by default. The third is the placeholder map, which is a re-identification key for every conversation that used it, needs its own access policy and retention rule, and is the artefact that turns a redaction project into a data-governance project.

When to pick which

SituationPickBecause
You control the forms the sensitive data arrives through Skyflow A guarantee beats a classifier, and it is the only one offering one.
Unstructured text you did not author, budget is tight, engineers available Presidio MIT-licensed, fully inspectable, and the tuning is work you would do anyway.
Regulated data, many languages, and a miss is a reportable event Limina Coverage and a maintained restore path are the two things hardest to build.
The exposure is employees and SaaS, not your model calls Nightfall Nothing inline sees that surface; duration is the control you can actually get.
Regulated data that must never leave your jurisdiction at all Presidio or Limina, self-hosted The transform has to run where the data already is — see data residency.

FAQ

Can I just prompt the model to ignore personal data?

No. The data has already left your network by the time the model reads the instruction, so the prompt does nothing about the provider's logs, your own trace store, or a subprocessor. Redaction is a control on the wire or it is not a control.

Is Presidio good enough for production?

It is good enough to build on, and thousands of deployments do. What it is not is good enough untuned: budget for writing recognisers for your own identifier formats and for a regression set that keeps them honest, and treat any published accuracy figure as a statement about someone else's data.

Does a vault remove the need for a detector?

Only for the fields it holds. The moment your agent reads a support transcript, a scanned document or a free-text note, you are back to detection — which is why the two are usually deployed together rather than chosen between.

How should I measure a redaction pipeline?

On the miss rate, estimated from a blind sample of real post-redaction traffic, not from a benchmark; on the false-positive damage, which shows up as agents that cannot do their job; and on restore correctness, which nobody tests until a customer is shown someone else's name.

Does redaction satisfy a regulator?

It depends entirely on whether the result is anonymous or merely pseudonymous, and a reversible placeholder map means pseudonymous — the data is still personal data and the obligations still apply. Treat redaction as risk reduction and defence in depth, and settle the legal question with counsel against your actual configuration.

Further reading

On this wiki:

Project sources: