Detection
Names, company names, addresses, social insurance numbers, IBANs, dates of birth, case and contract references, across PDF, Word and Excel files.
In preparation
Document redaction and data protection
Use an artificial intelligence on a real case file without handing it your client's name. The software strips identifying data on your own machine, offline, and puts it back when the answer returns.
Status : In preparation. First product of the programme, headed for testing with partner firms. Sheet updated 12 September 2026.
Discuss your projectThe demonstration
What you write, what the outside tool receives, what comes back to you.
An ordinary case note, run through the software. The highlighted values are the ones that must not leave the firm. The tokens in brackets are what the outside tool sees in their place.
Ms Rossi, born 12.03.1978, social insurance number 756.1234.5678.97, is consulting us about her dismissal.
Her employer paid the balance into account CH93 0076 2011 6238 5295 7.
She can be reached on +41 22 345 67 89.
[PERSON_1], born [DATE_1], social insurance number [AVS_1], is consulting us about her dismissal.
Her employer paid the balance into account [IBAN_1].
She can be reached on [PHONE_1].
[PERSON_1] disputes the balance paid into [IBAN_1].
The documents mention three dates, including [DATE_1].
The employment contract is missing before any view can be taken.
Ms Rossi disputes the balance paid into CH93 0076 2011 6238 5295 7.
The documents mention three dates, including 12.03.1978.
The employment contract is missing before any view can be taken.
And what it did not dare touch
A social insurance number and an IBAN carry a check digit: when the arithmetic works out, there is no doubt. A person's name proves nothing. A capital letter at the start of a line is compulsory anyway, and says nothing about a proper noun.
Where the software hesitates, it does not replace, it flags. You review a short list instead of the whole document, and you decide.
- person · 50% · Laurent Girard
- person · 50% · Girard and Partners
The boundary
What crosses the edge of your machine, and what never does.
It is the only question left once the demonstration makes sense. The answer does not rest on a commercial promise, it rests on the architecture: what is never sent cannot be demanded.
Your machine
- The original document
- The mapping table, encrypted
- The processing log
Never crosses the edge
The service you chose
- The redacted text, and nothing else
Why a firm cannot paste a case file into an online service
Professional secrecy is not suspended by a technical novelty. Sending an identifiable document to a generative service amounts to disclosing it to a third party. The Swiss Bar Association guidelines on the use of artificial intelligence say so plainly.
Jurisdiction compounds it. A United States company remains subject to the CLOUD Act, which lets US authorities compel access to data it holds, including data stored in Europe. Where the server sits does not settle the question. Who owns it does.
The outcome on the ground is familiar. Either the firm gives up the tool and loses the time others are gaining, or it uses the tool and hopes the question is never asked.
Who it is for
- Law firms and notaries
- Fiduciaries and audit firms
- Human resources departments
- Medical practices and therapists
- Municipal administrations
How it works
The document never leaves the machine.
All processing happens locally. That is an architectural constraint rather than a setting, and it is what makes the claim verifiable by the person buying it.
Stable substitution
Each entity gets one consistent token throughout the document. The text stays coherent, which matters if a model is to reason over it rather than trip on gaps.
Encrypted mapping table
It stays on the machine and never travels with the document. It is what lets the real names go back onto the text the external tool returns.
Review before export
Everything the software touched is highlighted, and everything it could not classify is counted. Nothing is exported without a person looking at it.
Local log
Which document, when, how many entities, by which user. The log stays on the machine and exports for an internal review.
Three languages
Detection in French, German and Italian, including the date formats and proper-noun forms that differ from one region to the next.
Platforms
Limits
What this software will not do.
Perfect automatic redaction does not exist. A false negative is a leak, and we would rather write that on the sheet than bury it in a clause.
The whole architecture follows from that: the machine proposes, the person decides.
- It does not process a whole folder in the background without review.
- It sends nothing to our servers: no document, no usage statistics, no mapping table.
- It does not make a document anonymous in the legal sense. It reduces the risk of identification, which is not the same thing.
- It does not decide, in place of the professional, what may leave the firm.
Frequent questions
Redaction
Does it work with no connection?
Yes, and that is the first demonstration we give. Cut the network, process a document, the result is identical. You verify it yourself rather than take our word for it.
What happens if a name escapes detection?
It stays in the document, which is why export requires review. The software highlights what it handled and counts what it set aside, so the zone of doubt is visible rather than hidden.
Can it be used with any AI service?
Yes. Redaction is independent of whatever comes next. That is its main point: it makes usable what the firm has already chosen, without forcing a change.
Read next
Software for Swiss professional workflows.
Interested in a project?
Tell us which software and use cases interest you. We will explain its status and opportunities to contribute to preparation.
Discuss your project