Tools

De-identify your records before anyone else sees them.

Drop your exports. We take out names, email addresses, phone numbers and other details that say who someone is, and give each person the same label every time they appear, so the records still read (who asked, who answered) without naming anyone. Check the changes, then download the copy. It all runs in this browser: no file is uploaded, to us or anyone.

Drop export files, archives or a whole folder

Documents (Word, PDF, scans too), pictures of text (photos and screenshots), email (.mbox, .eml, Outlook .msg), chat (Slack, WhatsApp), tables (CSV, Excel, Numbers, Parquet), JSON (records, e-invoices), code (repositories, git history), transcripts (recordings are counted) and archives (ZIP, TAR, .gz, any size). Archives of any size are read in place. Nothing leaves this computer.

How it checks its own work

A second pass. Every rewritten record is read again from scratch, and the copy cannot be downloaded while it still finds anything.
What it leaves to you. Records about health, children, beliefs, union membership, crime or someone's money are flagged for you to read, and so is a team so small that writing style alone could give people away.

The detail: what it finds, and the thresholds

What it finds

Name of a person. The export's own list of people (senders, authors, assignees, Slack and CRM users) matched wherever they are mentioned, then dictionaries of given names and surnames (public US and Wikidata lists), greetings and sign-offs, titles and speaker labels.
Email address. Address syntax. Shared mailboxes (support@, sales@) and example domains stay; a person's address takes that person's stand-in.
Phone number. International or grouped digit runs of 9 to 15 digits, with dates, versions and bare ids told apart.
Postal address or postcode. House number and street in English, Dutch, German, French, Spanish and Italian forms; UK, Dutch, Canadian and US ZIP+4 postcodes by shape, other postcodes after a state or the word postcode.
Date of birth. A date next to born, birthday, date of birth or DOB.
National identity or tax number. Each country's format and check digit: US SSN and ITIN, UK National Insurance and NHS numbers, Dutch BSN, German tax id, French NIR, Belgian national number, Spanish DNI and NIE, Italian codice fiscale, Swedish, Danish, Norwegian and Finnish personal numbers, Polish PESEL, Indian Aadhaar and PAN, Canadian SIN, Brazilian CPF, Singapore NRIC, Australian TFN; company and tax register numbers (Dutch KvK and RSIN with its 11-proof, US EIN by its IRS prefix, also written in a form's boxes, EU VAT numbers); passports and driving licences after their name.
Card number. 13 to 19 digits that pass the Luhn check and start like a card.
Bank account number. IBAN shape and its mod-97 check; other account numbers after account or routing words.
Customer, employee or account number. A number or code right after customer, client, account, member, employee, staff, badge, patient, policy, order, case, application or user id; codes that carry their kind (SF-EMP-45731, ACC-201029); a code beside a person's email or phone in a contact line; every later code of the same shape in the same export (PFE-208814 once labelled an employee id makes PFE-219337 one too); masked numbers (****4126); every value in a column named that way; payment processors' customer, card, invoice and charge ids (Stripe's cus_, pm_, in_, ch_); SEPA creditor identifiers; and Bitcoin and Ethereum wallet addresses (Bitcoin by its checksum).
IP address. Public IPv4 and IPv6 addresses; private and local ranges stay.
Device id. MAC addresses by shape; IMEI, advertising and device ids after their name.
User id or handle. Slack and Teams mentions, @handles in prose, LinkedIn member ids (ACoAA...), and user-id fields; a known person's handle takes that person's stand-in.
Personal or internal link. Profile links (LinkedIn, X, Facebook, Instagram, GitHub users, Calendly, WhatsApp, Telegram), private file and workspace links (SharePoint, OneDrive, Google Drive and Docs, Dropbox, Box, Notion, Confluence and Jira, Slack archives, meetings), links that carry an email address or a token, and links to an organisation the engine replaces.
Precise location. Latitude and longitude pairs with four or more decimals (about 11 metres).
Name of an organisation. The export's own email domains (hudsonandvine.com makes Hudson & Vine one wherever it is written), a legal or trade word after a capitalised name (Eastman Farms LLC, Meridian Studios), the name learned from it for the rest of the export, and the companies listed with the US Securities and Exchange Commission. Names you keep (usually your own company) stay.
Password, key or token. The published formats of AWS, Google, Azure, GitHub, GitLab, Slack, Stripe, Twilio, SendGrid, OpenAI, Anthropic and npm keys, private keys, JWTs, passwords in connection strings and links, and assignments to password, secret, token or key.

The thresholds

Tables. Postcode, birth year, gender and job together can single a person out, so every combination of those details must be shared by at least 11 people before a table goes to a buyer.
Free text. Before a delivery, 300 records picked at random are read. With none still identifying anyone, fewer than 1.0% of all records can, at 95% confidence.

The method and the research behind it: our de-identification standard.