Allow image attachments in chat (PII switch)

Admin

Administration → System settings → Presidio (PII Detection), switch “Allow image attachments in chat (bypasses the PII scan)”, key SystemSettings:Presidio:AllowImageAttachments. Default: off.

This switch is not a convenience setting. It decides whether an entire category of data bypasses the PII shield completely.

The core, in one sentence

PII detection analyses text. It cannot analyse an image.

With the switch on, image content leaves the deployment entirely unscanned — including any text visible inside it. A photo or screenshot of a personnel file, an ID card, an invoice or a contract therefore reaches the model provider in clear text. No other setting changes that — neither threshold, entity types and languages under Set up Presidio, nor the list of trusted targets.

The hint text next to the switch says exactly that, and it is to be taken literally:

PII detection analyses text. It cannot analyse an image. When this is enabled, images attached in chat are sent to the model provider completely unscanned — including any text visible inside them. A screenshot or photo of a document (personnel file, ID card, invoice, contract) therefore leaves this deployment in full, and no setting on this page changes that. Off by default; enable only if that egress is acceptable for your organisation.

Once enabled, the “Presidio (PII Detection)” section additionally shows a permanent warning:

Image attachments are enabled: image content reaches the model provider unscanned and is not covered by any PII protection in this system.

With the switch off: discarded server-side

The gate is not a UI detail. With the switch off, an image is discarded server-side before it reaches the model — not merely hidden in the interface. A tampered or outdated client cannot get around it.

Every discarded image attachment is logged as a warning (session + file name). If those entries pile up, that is your evidence of demand: users are trying, and the gate holds.

The user bypass does not override it

Chat offers users the option “Skip the PII check for this message”. It has no effect on the image switch.

	User bypass	Image switch
Who decides	the user	the administration
About what	their own message	what may leave the deployment at all
Reach	the text of that one message	all image attachments, all users

With the gate closed, the image is discarded on both paths — with and without the bypass set. Filtering runs before the branch into the bypass path; there is no ordering in which a user can open the gate.

The rule of thumb, the other way round: the bypass decides about scanning, the image switch decides about egress. Only the second is a boundary decision.

When is enabling defensible?

The question is not “do I trust the provider?” but “has this egress been signed off organisationally?”. The switch creates exactly one new fact: uncontrolled clear-text egress of anything anyone can photograph or screenshot.

Defensible when all three hold:

The egress is documented and signed off — for personal data that means covered in the record of processing activities and in the DPA with the model provider.
The model provider fits contractually — ideally the EU data-residency route or a local model, where the data never leave your area of responsibility anyway.
The users know about it — “do not photograph ID cards, personnel files or contracts” only works once it has been said out loud.

When in doubt, off. Off costs you a feature; on may cost you personal data — and the most sensitive kind at that, because a photographed document is rarely harmless.

Limits & notes

One global switch. There is no per-user, per-role or per-vault grant — on means on for everyone.
No image in the history. Even with the gate open, image data is not stored in the conversation history; all it holds is [Bild: filename.png]. That limits the egress to the individual turn, but does not change the fact that it happens.
Model capability is a separate question. Whether a model can read images is decided by the model catalog (the “Vision” badge under AI models / providers), not by this switch. With Managed AI there is nothing to configure — image turns never end up on a tier that cannot see.
Do not confuse it with “trusted target”. A trusted target receives detected PII in clear text. This page is about content that cannot be detected in the first place. → Trusted targets (PII egress)