Every sector has the same problem and a different regulator.
The engine does not change between a clinic and a Landesbank. What changes is which law binds you, which failure mode costs you, and which deployment survives your own procurement process. Those three things are the package.
Healthcare and life sciences
Discharge letters, findings, coding, cohort studies. The most useful AI applications in a hospital operate on exactly the data with the strictest legal protection there is.
What binds you
- GDPR Article 9 — health data is a special category and the default is prohibition, not balancing
- Professional secrecy — in Germany § 203 StGB makes disclosure by a clinician a criminal matter, independent of data-protection law
- HIPAA for any workload that touches a US entity
- The European Health Data Space, which turns secondary use into a regulated process rather than a local decision
What actually breaks
Two things, and they pull in opposite directions. Send a discharge summary to a cloud model and you have disclosed health data to a processor the patient never heard of. Strip the identifiers irreversibly and the clinical record is no longer a record — nobody can put the result back into the patient file.
What we deploy
- The local client inside the clinical perimeter, where the text never leaves the machine at all — the only shape that satisfies a data-protection officer who has already refused three cloud tools this year
- The reversible operator, so an authorised clinician gets the plaintext back while the model only ever saw a token
- A HIPAA preset for the Safe Harbor identifiers it detects, for the US-facing half of a research collaboration — not all eighteen are covered (device and vehicle identifiers, biometrics and photos are not), so human review stays part of the method
Both products build on the same Presidio detection core, each with its own recognizer set. Whether the text may leave the building decides the product; what differs by sector is the preset, the templates and the evidence your auditor asks for.
Further reading in our knowledge base
Legal and professional services
Review, drafting, disclosure, due diligence. A law firm has a duty of confidentiality that is older and stricter than data-protection law, and it is owed to the client, not to a regulator.
What binds you
- Professional secrecy — in Germany § 43a BRAO for lawyers, with parallel duties for auditors, tax advisers and notaries
- Legal professional privilege, which can be lost by disclosure rather than merely breached
- GDPR, as the ordinary floor underneath all of it
What actually breaks
Privilege is not a setting you can restore. Once a privileged document has been handed to a third-party processor without a proper basis, the argument that it remained confidential is materially weaker — and that is a matter for the opposing side to exploit, not for a data-protection officer to remediate.
What we deploy
- The hosted platform for firms that already work with EU processors under a signed agreement, with Office and LibreOffice add-ins so the work happens where the drafting happens
- Reversible tokens, so the anonymised draft can be turned back into the client version at the end of the review rather than retyped
- For firms that want to offer anonymization to their own clients under their own name: a custom build on anonym.plus Enterprise, set up with you as part of implementation and scaling
Both products build on the same Presidio detection core, each with its own recognizer set. Whether the text may leave the building decides the product; what differs by sector is the preset, the templates and the evidence your auditor asks for.
Further reading in our knowledge base
Financial services and insurance
Know-your-customer files, claims handling, complaints, fraud narratives. Finance is the sector where detection has to be provable rather than merely good, because somebody will audit the log.
What binds you
- DORA, which puts operational resilience and third-party risk on the same footing as data protection
- PCI DSS, where the scope boundary is drawn by where card numbers appear — including in a prompt log nobody thought of as a system
- Banking and insurance secrecy, plus the GDPR
- Supervisory expectations on model governance, which require a reproducible record of what was processed
What actually breaks
Scope creep with no change ticket behind it. A support agent pastes a complaint containing a primary account number into an assistant, and the assistant's log store is now inside PCI scope. Nothing was deployed and nothing was approved; the boundary simply moved.
What we deploy
- Checksum-verified detection for the things that can be verified — Luhn for card numbers, MOD-97 for IBANs. These are arithmetic, so an auditor can re-run the check without taking our word for anything
- anonym.plus on your own machines, so the processing sits inside an estate that has already been through third-party risk review
- Scope reduction as the stated objective: fewer systems holding card data, not better controls around more of them
Both products build on the same Presidio detection core, each with its own recognizer set. Whether the text may leave the building decides the product; what differs by sector is the preset, the templates and the evidence your auditor asks for.
Further reading in our knowledge base
Education and research
Pupil data is the category where consent is rarely the right basis: in an obligatory school relationship it is hardly freely given, and it cannot cover a lesson that already happened. Marking, planning, pastoral notes and SEN documentation all run on exactly that data, and the school is the controller for every use of it.
What binds you
- GDPR Article 8 and the national ages of consent, which restrict consent for online services offered directly to children
- National school-data legislation, which in several states forbids US cloud processing of pupil data outright
- FERPA for institutions with a US footprint
- Research ethics approval, which is granted for a defined data set and not for whatever a model provider retains
What actually breaks
For an ad hoc paste into an unapproved AI tool there is usually no lawful basis to fall back on. Consent is hardly available, contract does not apply between a school and a pupil, and legitimate interest is not open to a public authority acting in its public task (GDPR Art. 6(1)). So a teacher pasting an essay into a marking assistant at eleven at night is not a policy breach the school can regularise afterwards — there was nothing to regularise it with. Multiply by the size of a staff room.
What we deploy
- The browser extension across the whole staff body, free to start on anonym.legal’s Free tier — the only intervention with a realistic chance of adoption where there is no device management
- Presets that treat pupil identifiers, dates of birth and SEN markers as high-severity rather than ordinary personal data
- Batch anonymization for research data sets, with a per-record log an ethics committee can read
Both products build on the same Presidio detection core, each with its own recognizer set. Whether the text may leave the building decides the product; what differs by sector is the preset, the templates and the evidence your auditor asks for.
Further reading in our knowledge base
Software and product development
Coding assistants, agent frameworks, support tooling, test data. Development teams handle other people’s customer data constantly and are the fastest adopters of exactly the tools that forward it.
What binds you
- Your own data processing agreements with your customers, which name your sub-processors — and an MCP-connected model provider can be one, depending on the roles and the contract chain
- GDPR, where you are the processor and your customer carries the controller's exposure
- Contractual audit rights your enterprise customers will eventually exercise
What actually breaks
A production log line, a stack trace with a payload in it, a customer record pulled into an agent to reproduce a bug. Every one of these is a disclosure to a party your customer's contract does not list, performed by an engineer who was doing their job well.
What we deploy
- An MCP server, so the agent itself calls anonymization before the model sees the text — the control sits in the tool chain rather than in a policy nobody reads
- The REST API in CI and in support tooling, so test fixtures are anonymised at the point they are created rather than audited afterwards
- The local loopback API on the Enterprise tier, for development estates with no route to the internet by design
Both products build on the same Presidio detection core, each with its own recognizer set. Whether the text may leave the building decides the product; what differs by sector is the preset, the templates and the evidence your auditor asks for.
Further reading in our knowledge base
Public sector and critical infrastructure
Case files, citizen correspondence, freedom-of-information responses, procurement records. A great deal of text to process, and unusually little freedom about where it may be processed.
What binds you
- National administrative law and social-data protection, which frequently prohibit commercial cloud processing of case data outright
- NIS2 for essential and important entities
- Procurement rules that require European processing and demonstrable exit options
- The GDPR, applied by an authority that is itself a supervisory body
What actually breaks
Nothing may leave the estate, which rules out every cloud service before the evaluation starts — and then the work still has to be done, so it gets done by hand or not at all. A freedom-of-information response redacted by hand is slow, expensive and, on the evidence of every published correction, unreliable.
What we deploy
- Air-gapped and on-premise installation, with the models on local disk
- A perpetual licence, which fits a capital procurement process far better than a subscription that has to be re-justified every budget year
- A reproducible detection log, because a redaction decision may have to be defended years later in front of a court or an information commissioner
Both products build on the same Presidio detection core, each with its own recognizer set. Whether the text may leave the building decides the product; what differs by sector is the preset, the templates and the evidence your auditor asks for.
Further reading in our knowledge base
Five sentences we hear in every sector
A head teacher, a compliance officer at an insurer and a municipal records manager use different vocabulary for the same five problems. Pick the one closest to yours.
“Our people are pasting client data into ChatGPT and we cannot police it.”
Blocking the tool does not work. It produces shadow use, not compliance — the request goes to a private phone and leaves no trace at all. The browser extension masks personal data in the input field before the paste lands, so the assistant stays useful and the personal data it detects is removed before the text reaches the AI provider. Enabling beats forbidding, and it is the only version of this that survives contact with a deadline.
The browser extension ↗“We have to hand these documents to someone outside and they are full of personal data.”
A partner, a court, a regulator, a research group, an external auditor. 5 protection methods cover it: replace, redact, mask, hash, and encrypt where an authorised reader has to reconstruct the original later. One file at a time, or in batches with a per-document log.
What the operators do“Policy says the data may not leave the building, so every cloud tool is out.”
This is where hosted and local separate. The local client processes on the machine it sits on and never sends the text anywhere — not encrypted in transit, not sent. It is the answer for the buyers no cloud vendor can serve, and the reason on-premise depth is part of the product rather than a roadmap item.
The local client“I have to sign this off and I cannot verify a single claim the vendor makes.”
The product figures on this site are generated at build time from recorded source measurements; the build fails rather than print one of them without a source. That is a deliberate response to a real finding — our own sites once carried seven different entity-type counts at the same time.
The five questions to ask us“We do not even know where the personal data in our systems is.”
Start with a measurement. piisafe.eu reads a website and reports where personal data is sitting in public (detection uses an anonym.legal API key, from €3 a month), then deletes the results within 35 minutes of finishing.
Scan a site ↗Your sector is not on the list?
It probably still is — the six above cover the regulatory shapes rather than the industry codes. Tell us what the data is and who is allowed to see it, and the answer usually takes one exchange.