--- name: mistral-data-handling-4a1f3359406e description: | Implement Mistral AI PII handling, data retention, and GDPR/CCPA compliance patterns. Use when handling sensitive data, implementing data redaction, configuring retention policies, or ensuring compliance with privacy regulations for Mistral AI integrations. Trigger with phrases like "mistral data", "mistral PII", "mistral GDPR", "mistral data retention", "mistral privacy", "mistral CCPA". allowed-tools: Read, Write, Edit version: 1.0.0 license: MIT author: Jeremy Longshore --- # Mistral AI Data Handling ## Overview Handle sensitive data correctly when integrating with Mistral AI, ensuring privacy compliance. ## Prerequisites - Understanding of GDPR/CCPA requirements - Mistral AI SDK installed - Database for audit logging - Understanding of Mistral's data handling policies ## Mistral AI Data Policies **Key Points:** - Mistral AI does NOT use customer data for training (by default) - API data is retained for 30 days for abuse monitoring - Enterprise plans offer data processing agreements (DPAs) - Check current policies at docs.mistral.ai ## Instructions ### Step 1: Data Classification | Category | Examples | Handling | |----------|----------|----------| | PII | Email, name, phone, SSN | Redact before sending | | Sensitive | Medical, financial | Anonymize or don't send | | Credentials | API keys, passwords | NEVER send | | Business | Internal data | Consider anonymization | | Public | Product names, general info | Safe to send | ### Step 2: PII Detection ```typescript interface PIIMatch { type: string; match: string; start: number; end: number; } const PII_PATTERNS: Array<{ type: string; regex: RegExp }> = [ { type: 'email', regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g }, { type: 'phone', regex: /\b(\+?1[-.]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g }, { type: 'ssn', regex: /\b\d{3}-\d{2}-\d{4}\b/g }, { type: 'credit_card', regex: /\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b/g }, { type: 'ip_address', regex: /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g }, { type: 'date_of_birth', regex: /\b(0[1-9]|1[0-2])[\/\-](0[1-9]|[12]\d|3[01])[\/\-](19|20)\d{2}\b/g }, ]; function detectPII(text: string): PIIMatch[] { const findings: PIIMatch[] = []; for (const { type, regex } of PII_PATTERNS) { // Reset regex state regex.lastIndex = 0; let match; while ((match = regex.exec(text)) !== null) { findings.push({ type, match: match[0], start: match.index, end: match.index + match[0].length, }); } } return findings; } // Usage const text = 'Contact John at john@example.com or 555-123-4567'; const pii = detectPII(text); console.log(pii); // [{ type: 'email', match: 'john@example.com', ... }, { type: 'phone', match: '555-123-4567', ... }] ``` ### Step 3: Data Redaction ```typescript function redactPII(text: string, replacement = '[REDACTED]'): string { let redacted = text; for (const { regex } of PII_PATTERNS) { regex.lastIndex = 0; redacted = redacted.replace(regex, replacement); } return redacted; } function redactWithPlaceholders(text: string): { redacted: string; mapping: Map } { const mapping = new Map(); let redacted = text; let counter = 0; for (const { type, regex } of PII_PATTERNS) { regex.lastIndex = 0; redacted = redacted.replace(regex, (match) => { const placeholder = `[${type.toUpperCase()}_${++counter}]`; mapping.set(placeholder, match); return placeholder; }); } return { redacted, mapping }; } // Usage const input = 'Send report to john@example.com and jane@company.org'; const { redacted, mapping } = redactWithPlaceholders(input); console.log(redacted); // 'Send report to [EMAIL_1] and [EMAIL_2]' ``` ### Step 4: Pre-Request Validation ```typescript interface ValidationResult { safe: boolean; warnings: string[]; piiFound: PIIMatch[]; } function validateBeforeSending(messages: Array<{ role: string; content: string }>): ValidationResult { const warnings: string[] = []; const allPII: PIIMatch[] = []; for (const message of messages) { const pii = detectPII(message.content); allPII.push(...pii); } // Group by type const piiByType = allPII.reduce((acc, p) => { acc[p.type] = (acc[p.type] || 0) + 1; return acc; }, {} as Record); if (allPII.length > 0) { const typeList = Object.entries(piiByType) .map(([type, count]) => `${count} ${type}(s)`) .join(', '); warnings.push(`PII detected: ${typeList}`); } return { safe: allPII.length === 0, warnings, piiFound: allPII, }; } // Middleware async function safeChat( client: Mistral, messages: Array<{ role: string; content: string }>, options?: { allowPII?: boolean; autoRedact?: boolean } ): Promise { const validation = validateBeforeSending(messages); if (!validation.safe) { if (options?.autoRedact) { // Auto-redact PII messages = messages.map(m => ({ ...m, content: redactPII(m.content), })); } else if (!options?.allowPII) { throw new Error(`PII detected in request: ${validation.warnings.join(', ')}`); } } const response = await client.chat.complete({ model: 'mistral-small-latest', messages, }); return response.choices?.[0]?.message?.content ?? ''; } ``` ### Step 5: Audit Logging ```typescript interface AuditLog { timestamp: Date; requestId: string; userId?: string; operation: string; model: string; inputTokens: number; outputTokens: number; piiDetected: boolean; piiTypes: string[]; redacted: boolean; } class MistralAuditLogger { private logs: AuditLog[] = []; async log(entry: Omit): Promise { const log: AuditLog = { ...entry, timestamp: new Date(), }; // Store in database await db.auditLogs.insert(log); // Console log for immediate visibility console.log('[AUDIT]', JSON.stringify(log)); } async getLogsForUser(userId: string, days = 30): Promise { const cutoff = new Date(); cutoff.setDate(cutoff.getDate() - days); return db.auditLogs.find({ userId, timestamp: { $gte: cutoff }, }); } } ``` ### Step 6: GDPR Data Subject Requests ```typescript // Right to Access (DSAR) async function exportUserData(userId: string): Promise<{ auditLogs: AuditLog[]; exportedAt: string; }> { const auditLogs = await auditLogger.getLogsForUser(userId); return { auditLogs: auditLogs.map(log => ({ ...log, // Don't include actual content, just metadata })), exportedAt: new Date().toISOString(), }; } // Right to Erasure async function deleteUserData(userId: string): Promise<{ success: boolean; deletedCount: number; }> { // 1. Delete audit logs older than legal retention period const result = await db.auditLogs.deleteMany({ userId, timestamp: { $lt: new Date(Date.now() - 7 * 365 * 24 * 60 * 60 * 1000) }, // Keep 7 years for compliance }); // 2. Anonymize remaining logs await db.auditLogs.updateMany( { userId }, { $set: { userId: '[DELETED]' } } ); // 3. Record deletion for compliance await db.deletionLog.insert({ userId, deletedAt: new Date(), recordsAffected: result.deletedCount, }); return { success: true, deletedCount: result.deletedCount, }; } ``` ### Step 7: Data Retention Policy ```typescript interface RetentionPolicy { dataType: string; retentionDays: number; reason: string; } const RETENTION_POLICIES: RetentionPolicy[] = [ { dataType: 'audit_logs', retentionDays: 90, reason: 'Operational debugging' }, { dataType: 'error_logs', retentionDays: 30, reason: 'Error tracking' }, { dataType: 'compliance_logs', retentionDays: 2555, reason: 'Legal requirement (7 years)' }, ]; async function enforceRetention(): Promise { for (const policy of RETENTION_POLICIES) { const cutoff = new Date(); cutoff.setDate(cutoff.getDate() - policy.retentionDays); const result = await db.collection(policy.dataType).deleteMany({ createdAt: { $lt: cutoff }, }); console.log(`Cleaned ${result.deletedCount} records from ${policy.dataType}`); } } // Run daily // cron.schedule('0 3 * * *', enforceRetention); ``` ## Output - PII detection implemented - Data redaction active - Audit logging enabled - GDPR compliance procedures in place ## Error Handling | Issue | Cause | Solution | |-------|-------|----------| | PII in logs | Missing redaction | Apply logging middleware | | Deletion failed | Locked records | Check foreign key constraints | | False positives | Overly broad regex | Tune PII patterns | | Audit gaps | Async failures | Add retry logic | ## Examples ### Safe Chat Wrapper ```typescript const response = await safeChat(client, messages, { autoRedact: true }); ``` ### Quick PII Check ```typescript const hasPII = detectPII(userInput).length > 0; if (hasPII) { console.warn('PII detected in user input'); } ``` ## Resources - [GDPR Developer Guide](https://gdpr.eu/developers/) - [CCPA Compliance Guide](https://oag.ca.gov/privacy/ccpa) - [Mistral AI Privacy Policy](https://mistral.ai/privacy/) ## Next Steps For enterprise access control, see `mistral-enterprise-rbac`. --- Source attribution: Dicklesworthstone Original project: https://github.com/Dicklesworthstone/pi_agent_rust/blob/f28fc46ee0db8e710d95b8b55592cd38d60f2b26/tests/ext_conformance/artifacts/plugins-community/plugins/saas-packs/mistral-pack/skills/mistral-data-handling/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License (with OpenAI/Anthropic Rider) Copyright (c) 2026 Jeffrey Emanuel Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: ADDITIONAL RIDER / RESTRICTION (OpenAI / Anthropic): This rider is part of the "conditions" of this License. In the event of any conflict between this rider and any other portion of this License, this rider controls. "Restricted Parties" means OpenAI, L.L.C.; Anthropic, PBC; any of their respective Affiliates; and any person or entity acting directly or indirectly on behalf of, for the benefit of, or under the direction of any of the foregoing (including any officer, director, employee, contractor, agent, consultant, service provider, or representative). Notwithstanding any other provision of this License, no rights are granted to any Restricted Party. Any purported license, sublicense, assignment, transfer, or other permission to any Restricted Party is null and void absent the express prior written permission of Jeffrey Emanuel. You may not provide, disclose, distribute, sublicense, sell, lease, lend, host, make available, or otherwise permit access to the Software or any derivative work of the Software (as defined in applicable copyright law) (collectively, "Derivative Works") to or for any Restricted Party. For purposes of this rider, "use" includes, without limitation: copying, modifying, merging, publishing, distributing, sublicensing, selling, transferring, making available, hosting, deploying, executing, benchmarking, testing, analyzing, indexing, or incorporating the Software or any Derivative Works into any dataset, training corpus, evaluation harness, or pipeline for machine learning or other automated systems. This rider applies to the Software and all Derivative Works. As a condition of use, you agree that this rider is a precondition to exercising any rights under this License, and you agree that any distribution of the Software or any Derivative Works must include this rider provision unmodified. Any breach of this rider automatically and immediately terminates the permissions granted by this License. Upon termination, you must immediately cease all use and distribution of the Software and any Derivative Works and destroy all copies under your control. You agree that a breach of this rider would cause irreparable harm and that Jeffrey Emanuel may seek injunctive or other equitable relief to enforce this rider, in addition to any other remedies available at law. To the maximum extent permitted by applicable law, the prevailing party in any action to enforce this rider shall be entitled to recover reasonable attorneys' fees and costs. For purposes of this rider, "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the specified party. "Control" means ownership of more than 50% of the voting securities or other ownership interest, or the power to direct management or policies by contract or otherwise. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: Dicklesworthstone Original project: https://github.com/Dicklesworthstone/pi_agent_rust/blob/f28fc46ee0db8e710d95b8b55592cd38d60f2b26/tests/ext_conformance/artifacts/plugins-community/plugins/saas-packs/mistral-pack/skills/mistral-data-handling/SKILL.md Attribution basis: Source repository record Fields of work: Content & Media, Data & Analytics, Development & Engineering, Legal, Product Management Roles: Compliance Officer, Data Analyst, ML / AI Engineer, Product Manager, Technical Writer Specialties: API, Backend Tools: Mistral Ai Sdk Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 3fc167b8cc2d72fc270a8bd2a52e21c17f11efb1ea2f33736781693bf92d4836