Document anonymization
We use artificial intelligence models trained to anonymize documents and reduce the exposure of personal data when they are shared or analyzed. They can run in the user's own browser, so the documents do not leave their computer.
REQUEST A DIAGNOSTICWhat anonymizing a document means
Anonymizing a document means removing or replacing the data that identify a person, so that the document can be shared or analyzed with less exposure. Covering the name is not enough: a combination of remaining data, such as a job title, a date and a place, can still point to someone. Under the GDPR, data is only anonymous when the person is no longer identifiable by any means someone could reasonably use to achieve it. That is why we keep the structure of the document when possible and each case requires checking whether the remaining information could identify a person.
Anonymizing is not the same as
Pseudonymizing
Replacing identifiers with codes that can be reversed using information kept separately. Under the GDPR, pseudonymized data is still personal data.
Redacting
Covering the text on screen. If the file is not cleaned, the original text, the metadata or the change history may still be inside.
Encrypting
Encryption protects the data, but it is reversed with the key. It is not anonymization.
Deleting the name
Removing direct identifiers is not enough if remaining data, combined, point to a person, such as age, postal code and profession.
Where documents are processed
In the user's browser
Optional. We use highly optimized models that run inside the browser itself. The documents do not leave the computer of the person processing them or reach an external server.
On our own infrastructure or in the cloud
When the case requires it, on Devontic infrastructure or in the cloud, with models that are valid under European law.
Examples of what we have already done
Medical reports
Removing patient data from reports to share them for research or training, with a later review.
Contracts and case files
Preparing documents to analyze them with external tools without exposing the personal data they contain.
Selection processes
Removing candidate data from selection documents and job offers before reviewing or publishing them.
Clinical records
Preparing records for studies without the data that identifies patients, with a later review.
Legal documents
Removing personal data from rulings or filings before analyzing or publishing them.
Support chats and emails
Cleaning customer conversations before using them to train or evaluate a model.
When it helps
When documents have to be shared with third parties, analyzed or used as working material, and they contain personal data that is not needed for that purpose.
What it does not guarantee
- Automatic detection can leave data unmarked. The result should be reviewed.
- Each case requires checking whether the information that remains could identify a person.
- Anonymizing a document does not, by itself, amount to complying with data protection rules.
- What slips through most are indirect references, such as "the head of the school". That is why several techniques are combined with human review.
- A model trained on one type of document performs worse on a different one.
- Besides the visible text, metadata, comments and change history have to be cleaned.
- Anonymization can stop being anonymization over time: new data sources or new techniques may make it possible to identify someone who could not be identified before.
- Removing too much also has a cost: the document loses usefulness for its purpose.
FREQUENTLY ASKED QUESTIONS
What does anonymizing a document mean?
It means removing or replacing the data that identify a person, so that the document can be shared or analyzed with less exposure.
Is an anonymized document completely safe?
Not necessarily. Automatic detection can leave data unmarked, and a combination of remaining data can still identify someone. Each case requires review.
Who checks whether an anonymized document still identifies someone?
The final review is done by the client who uses the service, who knows the context of their documents and decides whether they can be shared or analyzed.
Which data can be anonymized?
The personal data the client needs, with particular attention to medical data. It is configured for each case: which data is looked for and how it is replaced. Health data is a special category under the GDPR and requires additional safeguards.
Do documents leave my computer when they are anonymized?
It depends on the mode chosen. In the optional browser mode, the models run on the user's own computer and the documents do not leave it. In other cases they are processed on Devontic infrastructure or in the cloud, with models that are valid under European law.
Which types of document are anonymized?
Medical reports, medical records, contracts, invoices and documents from selection processes and public-sector job offers, among others. Each type is configured according to what it contains.
Does anonymizing documents guarantee GDPR compliance?
Not by itself. It reduces the exposure of personal data, but compliance depends on more factors and on reviewing each case.
What is the difference between anonymizing and pseudonymizing?
Anonymizing makes it impossible to identify the person, irreversibly. Pseudonymizing replaces identifiers with codes that can be reversed using information kept separately. Under the GDPR, pseudonymized data is still personal data.
Is deleting the name and the ID number enough?
No. The data that remain, such as age, postal code, a date or profession, can identify a person when combined with each other or with other sources.
Can anonymization be done with rules alone?
Rules work well with fixed-format data, such as an ID number, a phone number or an email. They fail with names, addresses and references that depend on context, where language models are needed. Combining both techniques is the usual approach.
What is needed to start anonymizing documents?
A sample of real documents, knowing what they will be used for once anonymized and who will receive them. The level of rigor changes with the recipient and what they can cross-reference with other data.
From your documents to a test
We start with a proof of concept on real data and only scale if the value is demonstrated.