Honestly at this point did they actually bother to make something specifically built and trained to remove sensitive data or did they just modify a system promp

Honestly at this point did they actually bother to make something specifically built and trained to remove sensitive data or did they just modify a system prompt to "Don't save possibly sensitive data like credit card numbers" and hope that an LLM could magically handle this properly? Why do I have a feeling its the later given all of the other issues around this entire thing.