Personal data stays with you
The privacy layer finds names, contact details, account numbers and credentials in your requests and replaces them with placeholders before the model sees them. Detection runs on our own hardware in Austria. That way you can use external models too, without personal data leaving the house.
Write a friendly payment reminder to Maria Huber (maria.huber@example.at), IBAN AT61 1904 3002 3457 3201, invoice 2026-114.
Write a friendly payment reminder to <<PERSON_1>> (<<EMAIL_1>>), IBAN <<IBAN_1>>, invoice 2026-114.
Dear Ms Maria Huber, an amount on invoice 2026-114 is still open …
In pseudonymize mode the layer puts the original values back into the answer. In mask mode the placeholders stay.
What is detected
Fixed patterns
Email addresses, Austrian and German phone numbers, IBANs with checksum, Austrian social security numbers with check digit, credit card numbers with checksum.
Credentials
API keys of common providers, tokens, private keys and passwords in connection strings, so no credentials reach a model by accident.
Names, places, organisations
Named-entity recognition finds people, places and organisations in free text, in German and other languages. It runs on one of our DGX Spark.
Four levels
From “off” to “strict”: the higher the level, the more is checked. Selectable per request, can be fixed for aliases.
What we promise
- Fail-closedIf detection cannot run, we reject the request. It never goes out unprotected.
- No values in logsDetected values appear in no log and no error message. We only record how many hits of which kind there were.
- Mapping only for the requestWhich placeholder stands for which value lives only in memory and is discarded after the answer. None of it is stored.
- Mandatory for external modelsFor models outside our hardware the layer always runs, at least in mask mode. Images cannot be masked, so they are not sent to external targets at all.
- On our own hardwareDetection and the checking model run on our Sparks in Austria, not at a third party.
How to turn it on
One field in the request is enough. For aliases we can also fix a mode; you can then tighten it, but not loosen it.
{
"model": "mid",
"messages": [ … ],
"privacy": { "mode": "pseudonymize", "strict": true }
}
Price
Charged only when the layer is active for a request, on the input tokens. Without the privacy field it costs nothing.
External models via the privacy layer
We do not host these models ourselves: open-weight models too large for our hardware, and models available only through the vendor's API. Through the privacy layer you can still use them. How well they reason logically, compared with our own models, is shown in the Logic Index.
What the layer cannot do
- Detection is best effort, not complete. It is an extra layer of protection, not a substitute for sending only what is needed.
- Named-entity recognition errs both ways: it sometimes misses a name and sometimes takes an ordinary word for one. In our own logic test, made-up words were detected as company names.
- Images and other non-text content are not masked.
- Tool definitions (names, descriptions, schemas) are not scanned; they come from the developer, not the end user.
- The layer is a technical measure. Whether it is enough for your use case is a legal question it does not answer.