Pick a record on the left, or paste text to redact.
No document loaded
Select a record on the left or paste text, then press Redact.
Detected entities appear inline and in the panel on the right.
No batch yet
Configure a source on the left and press Preview to see how the mapping redacts the first records, then Run batch.
Canonical entity to stable pseudonym. One real entity maps to one pseudonym everywhere, so the relationship graph survives.
Run a redaction to populate the vault.
Reversibility (gated)
Reversal needs the operator key and is written to the audit trail. POC mode keeps the vault; release mode destroys the key.
Right to erasure (DSR)
Crypto-shred a subject's re-identification path. The pseudonyms already emitted into documents stay, but can no longer be reversed to the real value. Destructive and irreversible: gated on the operator key and written to the audit trail. Use the Forget action on a subject in the table above.
Governed-in → enforce → evidence-out. When a de-identified deliverable leaves the boundary, the system emits this PII-free record to the governance platform's webhook, anchored to the tamper-evident audit chain so the platform can verify the export against our log. No raw values, ever.
Loading the evidence record…
Hash-chained, tamper-evident. Records detection, mapping, review, and reversal events. It holds no raw PII by design.
Loading the audit chain…
Loading the recall report against the gold labels…
Read-only. The active redaction configuration (fixed server-side in this release). Direct identifiers below the confidence threshold fail closed: redacted and queued for review.
Detected entity types
Confidence threshold