Runs locally, masks personal data, lets ChatGPT, Claude, Gemini or Grok process the rest — built for GDPR, FERPA and CCPA.
Self-hosted on your server. Works with the LLM you already use. Scoped in one call.
Sending your emails, contracts and other confidential information to an LLM, especially on a private subscription, is a violation of multiple data privacy laws. However, LLM-processing is involved in every process that undergoes AI automation.
Sarah Weber at 12 Oak Lane disputes invoice #4417 for $1,280 — her son Tomas in grade 4 left in March
PII Redactor swaps every sensitive detail for a placeholder on your own computer, before Claude or ChatGPT reads a word. When the reply returns, the real data goes back in.
You and your clients get the result. Confidentially.
rules 12 ms · model G 410 ms · model F 380 ms · total 802 ms
Processed in memory on one machine. Nothing stored.
Live redaction is unavailable right now. Showing the built-in sample.
Built to keep personal data out of the model call under these regimes.
No processor contract, no consent, no safeguards? Then:
Made an unlawful transfer (Art. 28, Ch. V)
Disclosed an education record without consent
Shared a child's data with no consent
Disclosed personal information outside any contract
Emails, DMs, tickets, chat exports — same rule.
A deployment is documented against these regimes.
400 real support threads · one client · hand-arbitrated key
A redaction layer, not legal advice. Compliance depends on your contracts and process.
Any text with people in it.
Order numbers, cards, addresses.
Account numbers, amounts, arrears.
The parties, addresses, the matter.
Students, grades, parent emails. FERPA.
Whole conversations, pasted wholesale.
Customer details in every thread.
Salary history, home addresses, ID numbers.
Birth dates, policy numbers, injuries.
Unit numbers, arrears, repair notes.
Under-13s, allergies, pickup adults. COPPA.
Names and numbers said out loud.
Free text with people in it.
Tell us what you'd run through it. We tell you what it takes and what it costs.
Where the text goes: your server, local weights, no outside call. Only tokens leave.
Names, addresses and account numbers become typed tokens. Local weights, no outside call.
Same name, same token. The registry stays on that machine and is the only way back.
ChatGPT, Claude, Gemini or Grok gets [PERSON_1] at [ADDRESS_1] asking about [REDACTED_1]. It drafts in tokens.
The reply returns. The registry puts the originals back. Unknown tokens are refused, not guessed.
Not a ban. A disclosure, allowed only under conditions.
Art. 28 processor contract; Chapter V safeguards outside the EU; stricter for health data.
Without it: An unlawful transfer.
Only to a vendor that qualifies as a “school official” under the school's direct control.
Without it: An unconsented disclosure.
Under-13 data needs verifiable parental consent that names the recipient.
Without it: No consent for that recipient.
Only to a service provider under a contract that restricts its use.
Without it: A disclosure outside the contract.
What reaches the model is not personal data.
Together they point at one household. That list is the redactor's list of kinds.
Tell us what you'd run through it. We tell you what it takes and what it costs.
Your message is in Oleg's inbox, he will reply shortly.