Client data anonymized before it reaches ChatGPT
Staff paste emails and letters with names, IDs and phone numbers into AI. This tool turns that data into labels before anything leaves the company.
Industry: Offices, law firms, customer service
In short
- Names, IDs, phones, emails and account numbers turned into labels
- Anonymization runs locally, not in someone else's cloud
- Detects Polish data formats, not only English ones
- You see before and after before the text goes out
About the project
In many firms people already use ChatGPT to write emails and letters. The problem is they paste real client data, often unaware they are breaking GDPR.
The challenge
The leak had to be stopped without banning AI. Bans get bypassed anyway, so it is better to give a tool that cleans data on the way.
Goals
- Stop personal data before it leaves the company
- Do not block AI work, just make it tighter
- Recognize local formats: national ID, phone, account number
- Show the result so it is clear what was hidden
Technical challenges
Local formats, not only English
Off-the-shelf models miss national IDs or local phone numbers. Rules were added for specific formats so nothing leaks.
Local, so it makes sense
Anonymization that sends data to the cloud defeats the purpose. It all runs on the spot.
Solution and implementation
Paste text, see the result
In the panel you paste a fragment with data and immediately see the labelled version.
Close to where you paste
A browser extension cleans data where staff would paste it anyway, so habits do not have to change.
Results
Less GDPR risk
Personal data is replaced before it reaches an external model.
AI still in use
The team uses AI as before, only more safely. Nothing has to be banned.
Takeaways
Bans do not work, tools do
People use AI anyway. It is safer to give them something that guards data than to pretend the problem is gone.
Scope
- PII detection
- Replacement with labels
- Local processing
- Test panel
Technologies
- Presidio
- Python
- Browser extension
Frequently asked questions
Why anonymize before AI?
Pasting a client email with a name, ID or phone into ChatGPT is processing personal data. Anonymization removes it before it leaves the company.
Does it block AI use?
No. The team keeps using AI, only personal data is turned into labels on the way.
Does it recognize local data?
Yes. Rules were added for national IDs, local phone numbers and account numbers that off-the-shelf models often miss.
Where does anonymization run?
Locally. The whole point is that data is not sent to anyone's cloud.
Can data be recovered after anonymization?
The version sent to AI has only labels. The employee sees the original locally, the model on the other side does not.