Guide

Sending Only PBIP Files to AI? Here's Where Real Data Still Hides

Published 2026-09-25 · 6 min read

A comment in a Polish Power BI group, under a post about masking data before it goes to AI: "I only send PBIP files to AI." It's a sensible habit. A Power BI project saved as PBIP is a folder of text files, and most of what's in it is structure: which tables exist, how they relate, what each measure calculates. No invoices, no customer list. At least that's the assumption.

We wanted to know how far that assumption holds, so we ran the check on one of our own projects: the cash-flow report 4optima uses for its own finances.

What we found in our own cash-flow project

Most of the report's tables load from Power BI dataflows. Those were fine; the project stores a reference to the source, not the rows. Filters and slicers came out clean as well: the year 2026, category names like "Planned" and "Invoiced", a business line code. Nothing about customers or people.

Two other places were not clean. Five tables had been typed in with Enter data, and two of them held real records: a staff table with first names, surnames and employment dates, and a table of intercompany amounts by year. The folder also held cache.abf, around 600 KB, which is a full local copy of every imported table. And one query pointed at a file on our SharePoint whose name makes it obvious it holds salaries. The salaries weren't in the project. The address was.

Put plainly: if we had zipped that folder and dropped it into a chat, we'd have handed over employee names, internal amounts and the whole dataset in compressed form.

Four places where data hides in a PBIP folder

1. .pbi\cache.abf in the semantic model folder. Microsoft's documentation describes it as a local cached copy of the model and its data from the last edit. The default PBIP .gitignore excludes it, but that only helps when the project goes through Git. Zip the folder or share it from OneDrive and the cache goes along.
2. Tables created with Enter data. They're stored inside the table's Power Query as compressed Base64 text. It looks like noise, but one line of code decodes it, and an AI model reading your Power Query will decode it without being asked. Mapping tables, price lists, the "temporary" staff list someone pasted in two years ago: it all lives here.
3. Saved filter and slicer values. Every visual's JSON file stores the conditions it filters on. Ours were harmless. In a sales report with a slicer set to one key account, that customer's name sits in the file as plain text.
4. Connection details and parameters. Server names, database names, SharePoint addresses, file names. Passwords aren't in PBIP files, but the map of where your data lives is.

If you use DAX query view, glance at the DAXQueries folder too. Saved test queries often have a customer name or invoice number typed straight into them.

The one-minute cleanup

Copy the project folder, and in the copy delete .pbi\cache.abf and .pbi\localSettings.json. Power BI Desktop opens a project without the cache; it simply shows the model with no data. Then find the tables built with Enter data (search the definition folder for Binary.FromText) and either swap the rows for made-up ones or move the table to a proper source. Skim the filter values and parameters.

For work on measures, relationships or Power Query, that's all you need. The AI sees how the report is built, which is exactly what it's working on.

Where the definition alone stops being enough

The trouble starts when the question is about numbers. "Why does this measure show 1.2 million when finance says 1.4?" can't be answered from a definition file. Neither can "check that the totals on this page add up" or "the year-over-year measure breaks in January, find out why." Those need rows, and rows are exactly what you were trying to keep out.

That gap is what ShiftMask is for. It doesn't open PBIP files. It works one step earlier, on your Excel and CSV sources, locally. It builds a copy where names and IDs become consistent placeholders across every file at once, so relationships still join, and every date moves by the same offset, so year-over-year and running-total measures still behave. Point the project's source parameter at the masked folder, refresh, and the cache now holds masked data. The AI can look at real-shaped numbers, and when you switch the parameter back, the same measures run on the real data.

Two honest limits. ShiftMask works on Excel and CSV files, so a table that lives only in a dataflow has to be exported first, or handled with the cleanup above. And Enter data tables still need a manual step: copy the rows into Excel, mask them, paste them back.

If you are a consultant, the same masked copy also solves an older problem: pricing a project for a client who can't send you data. Here is the workflow.

FAQ

Does a PBIP file contain my data source passwords?

No. Power BI Desktop keeps credentials on your machine, outside the project files. Connection details such as server names, database names and file paths are stored, though.

Can I open a PBIP project without cache.abf?

Yes. Power BI Desktop opens the full model and report definition without data. The data comes back on the next refresh.

Is PBIP enough if I only want help with DAX?

Usually, after the cleanup. Writing or reviewing a measure depends on table and column names, relationships and filter context, not on the values. It stops being enough the moment you need the AI to check a result.