Privacy before the prompt: three of our own models for the GDPR.
Before a prompt reaches an external model, three of our own models check it in the privacy layer: names and addresses, people without a name, special categories under Art. 9 and 10. On our own hardware in Austria, in milliseconds.
Measured against large models and established tools
Art. 4 GDPR: people, companies, addresses
blind set: 120 texts, 695 values
The basic form of personal data: names of people and companies, and addresses. The hard cases are lower-case names in chats, initials, names in tables and names that are also ordinary words. Measured: how many marked values are found and how many hits are correct.
Clearly ahead of GLiNER on both values; the intervals do not overlap. GLiNER configured as it ran live with us until 1 Nov 2026: urchade/gliner_multi-v2.1, threshold 0.5, with the same regex and secrets stages in front.
Art. 4 GDPR, indirect: identifiable without a name
blind set 2: 113 texts with an identifiable person, 112 harmless
A text is personal data even without a name. "The mayor of Neukirchen" or "the only midwife in town" point to exactly one person. Measured: how often the person is still identifiable after replacement and how often harmless texts are changed unnecessarily.
As good as Qwen 3.6 35B: both differences are within the measurement uncertainty. ALLSmartArt4i is about five times faster in the median (15 ms against 75 ms added by the Qwen check) and above all steady: with Qwen, one request in twenty took 2.7 s or more extra.
Art. 9 and 10 GDPR: special categories and criminal offences
blind set 5: 151 sensitive, 149 harmless texts
Art. 9 GDPR protects some information particularly strictly: health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life and sexual orientation, genetic and biometric data. Criminal convictions and offences are covered separately by Art. 10; the model detects both, even when they appear only indirectly, for example through a medication or a church office. Measured: how many sensitive texts are detected and how many hits are actually sensitive (precision).
Paired comparisons on the same 300 texts: ALLSmartArt9-10 finds significantly more sensitive texts than Clef 27B and Clef Flash (p ≈ 0.02 each) and raises significantly fewer false alarms than Clef Flash (p ≈ 0.04) and Jev (p ≈ 0.001). Jev finds as many sensitive texts. Clef 27B has the fewest false alarms; the difference to ALLSmartArt9-10 is not significant (p ≈ 0.06).
Blind set: test texts written and labelled to our definitions by a separate agent that knows neither the model nor the training data, and none of its texts was ever used in training. Each task measured on the same blind set; below each value the case count and the 95% interval (Wilson). ↑ higher is better, ↓ lower is better. "tbd": measurement to follow, Jev (TypeSafe) is a commercial cloud service, measured through its public API; its time includes the network round trip. All other times on our own hardware (NVIDIA GB10), Clef in Ollama.
ALLSmartArt4
Art. 4 Nr. 1 DSGVO · v3
Detects people, companies and addresses.
Including the cases where general-purpose recognisers fail: lower-case names in chats, initials, names in tables and CSV, names that are also words, names from every language area. Roles, departments, rooms and code identifiers stay untouched. A place counts only when it belongs to a person.
BasemmBERT
Parameters0.3B
Duration≈ 41 ms per request
In the gatewayevery level from mask
people found
97.4 %81.3 %
all values found
94.4 %86.6 %
Precision
94.4 %85.3 %
Measured on: Blind set: 120 texts with 695 marked values, German and English. Before: GLiNER.
Example
hi tom, the delivery goes to Rosseggerweg 7, 4553 Schlierbach.
hi <<PERSON_1>>, the delivery goes to <<LOC_1>>, <<LOC_2>>.
Limits
A place next to a person is sometimes taken for an address.
Street names without a house number occasionally cause false alarms.
ALLSmartArt4i
Art. 4 Nr. 1 DSGVO, indirekt · v2
Finds people who are identifiable without a name.
A role in a place, an office, a unique description, a chain of small attributes: "the mayor of Neukirchen", "the only midwife in town". The model replaces the whole passage, not just the place name. It replaced the check by a large language model.
BasemmBERT
Parameters0.3B
Duration≈ 15 ms per text
In the gatewaystrict level
person still identifiable afterwards
9 %12 %
false alarms on harmless texts
2.7 %1.8 %
check duration
15 ms75 ms
Measured on: Independent blind set 2: 240 texts, a third of them long, 39 % English. Identifiability checked independently. Before: check by Qwen 3.6 35B.
Example
Write to the mayor of Neukirchen am Walde that the meeting is postponed.
Write to the <<INDIRECT_1>> that the meeting is postponed.
Limits
Chains of several scattered attributes are caught in only about half of the cases.
ALLSmartArt9-10
Art. 9 / Art. 10 DSGVO · v3.1
Detects special categories of personal data and finds the sensitive passages.
Health, racial or ethnic origin, political opinion, religion, trade union membership, genetics, biometrics, sex life and criminal offences, including when they are only revealed indirectly: dialysis, strike pay, an electronic ankle tag, a medication without a diagnosis. A classifier scores the text, a second model finds the words we replace.
BaseQwen3.5-4B (LoRA) + mmBERT
Parameters4.2B + 0.3B
Duration≈ 90 ms per section
In the gatewaySpecial-category levels flag, mask, block
sensitive texts found
97.3 %98.7 %
false alarms on harmless texts
4.0 %18.0 %
Precision
96.1 %84.6 %
Measured on: Blind set 4: 300 texts, 150 sensitive and 150 harmless, 105 of them hard counterexamples. Before: our version 2.
Example
Mrs Berger is only available half days since her chemo.
<<PERSON_1>> is only available half days <<PRIVACY_1>>.
Limits
Clerical offices in short sentences are still missed.
Masking removes which illness, but not always that there is one: "since her <<PRIVACY_1>>" still reveals something. The re-check then replaces the whole sentence or blocks. For destinations outside the EU, blocking remains the safe level.
Versions
Each of the three models went through several versions before going live; the public versions were trained separately on top. Each model measured on one blind set.
ALLSmartArt9-10
blind set 4: 150 sensitive, 150 harmless texts
Version
Date
What changed
sensitive found
false alarms
precision
v2
31.10.
more training data, labelling rule based on the GDPR and case law
148/150
27/150
84.6 %
v3
01.11.
harmless counterparts sharpened, against false alarms
Before that, two small models and a first version with 4 bn parameters, measured on earlier sets. The topics of v3.1 were derived from errors on blind set 4; it was therefore also measured on the new blind set 5: 147/151 found, 7/149 false alarms.
ALLSmartArt4i
blind set 2: 174 passages, 112 harmless texts
Version
Date
What changed
passages found
precision
harmless changed
v1
01.11.
first version
79 %
97 %
2/112
v2
01.11.
additional data on roles in context
87 %
96 %
5/112
v2 + Filter live
01.11.
single lower-case words dropped
87 %
98 %
3/112
ALLSmartArt4
blind set: 120 texts, 695 values
Version
Date
What changed
values found
precision
GLiNER
starting point, live until 1 Nov
86.6 %
85.3 %
v1
01.11.
people and companies; addresses still missing
75.3 %
97.8 %
v2
01.11.
address type added
94.0 %
96.0 %
v3 live
01.11.
rule for places of residence, targeted additional data
94.4 %
94.4 %
v3 finds more than v2 but raises slightly more false alarms.
How the three models work together
In the gateway the models run one after another before a prompt leaves the house. First, fixed rules find secrets such as keys and passwords as well as phone numbers, IBANs and similar patterns. ALLSmartArt4 finds names of people and companies as well as addresses. ALLSmartArt4i finds people who are identifiable without a name. ALLSmartArt9-10 checks whether the text touches special categories under Art. 9 or criminal offences under Art. 10, and finds the sensitive passages.
Every finding is replaced by a placeholder such as <<PERSON_1>>. If a model fails, the request is rejected instead of being passed on unchecked. If you need the names back in the reply, you only get them at the pseudonymize level, and only within your own gateway.
Which level for what
All models run on our own hardware in Austria; the three of the privacy layer together in about 10 GB of GPU memory.
