Windows desktop · single user · no installer service

Finds and masks the personal data in bank documents.

So staff can use AI tools on real client files — and it runs entirely on the machine that holds them. No network calls at runtime, no cloud account, no telemetry, no data leaves the machine.

Request access Evaluation builds are issued by hand, one organisation at a time.

CREDIT_MEMO_0001.pdf detect ◦ outbound 0 bytes

Commercial Credit Approval Memorandum
Ashvale Commerce Bank, N.A.  Commercial Credit Administration  CONFIDENTIAL
Obligor: Montclair Restaurant Group Bancorp
Obligor Number: 62157985     Facility: FAC-677814761
Relationship Manager: ARNAULT, PEYTON E
Prepared By: Fariha CITRANO   Memo Date: 07/02/2026
Request: Renewal   Amount: $10,388,329   Risk Rating: 5

The Bank has held the primary operating relationship since 2017 through
account 752965719079, obligor number 62157985. The borrower's federal
tax identification number is 75-5241227. Montclair Restaurant Group Bancorp
operates two craft brewing and taproom locations. Gross margin of 58.4% is
in the upper half of the peer range for regional craft brewers.

0 found

Above: a real pass over one of the project's own gold documents, with the evidence trail the engine actually recorded. Every value, confidence, layer and replacement on that screen came out of the shipped build.

0.90 span recall
1,651 occurrences measured
35 entity types
23 carry a regulatory basis
0 network calls

01 / THESIS

It cannot phone home, because there is nothing in it that can.

NetworkNone. No client, no server, no port, no socket opened at runtime.

Browser engineNone. Pure Tkinter. No renderer process, no JavaScript engine, no localhost server.

Auto-updateNone. The application never modifies itself.

Licence checkNone. No activation, no phone-home, no account.

TelemetryNone.

Elevated privilegesNone required. It runs as the user.

A security reviewer can confirm this by inspection, or with a network monitor, in about a minute. Offline has also been proven by execution: with all socket connections blocked, ingestion, the PDF parser and a full model-loaded scan ran clean.

02 / INGESTION

Getting the document in, faithfully

A masking tool is only as good as its reading of the file. Most of the engineering here is in refusing to lose something.

Open anything a bank reviews

PDF, Word, Excel, PowerPoint, Outlook and .eml mail, web pages, CSV, text, Markdown, JSON and XML. Drag one onto the window, or point it at a whole folder and let it work through them.

Folder mode keeps three parsed documents resident, prefetches the next, and writes a manifest.csv recording what happened to each.

Folder mode: a rail listing eight bank documents on the left, the selected credit memorandum shown as source PDF and parsed Markdown beside it.

The PDF path is not a generic converter

PDF always uses this project's own geometry engine, built on PDFium. It reconstructs tables from ruling lines and whitespace, preserves page provenance, and produces Markdown whose character offsets map back to the rendered page.

That mapping is what makes click-a-finding-jump-to-the-page work. The general-purpose PDF path was evaluated and rejected: it loses page numbers, which was verified inferior on bank documents.

A credit memorandum with detected personal data highlighted in place. Monetary amounts, ratios and percentages are deliberately left unmarked.

Scanned pages say so before they say anything else

“NO TEXT COULD BE READ FROM THIS DOCUMENT. This tool reads text only and cannot see inside images, so NO PII SCAN WAS PERFORMED. An empty findings list here does NOT mean the document is clean.”

Two buttons follow, and nothing runs until one is pressed. OCR uses the engine already built into Windows, so there is nothing to download, nothing to get approved, and nothing new inside the security boundary.

The NO TEXT LAYER banner across the top of the document window, offering to read the pages with OCR or continue without them.

And then it shows you what it read

After an OCR pass a stepper walks every page it recovered — the scanned image on the left, the text OCR produced on the right — so the reviewer can check it themselves rather than trust it.

The banner keeps saying the thing that matters: the original page images are unchanged. Masking applies to the text this application exports, not to the picture. The export window repeats it, and there it cannot be dismissed.

After OCR: a banner reporting two pages read and 3,163 characters recovered, with a page stepper, the scanned image beside the recovered text.

03 / DETECTION AND MASKING

Five layers, fused, with one gate over them

Candidates from every layer are clustered by overlap, scored, and resolved into one finding carrying its own evidence trail.

L0GazetteerA known-value dictionary. Your own customer list, if you provide one.
L1ValidatorsRegex plus real validation: Luhn, ABA mod-371, SSA rules, Verhoeff, ISO 3779. A nine-digit number is only a routing number if the checksum passes.
L2AnomalyEntropy and structure. Catches identifier-shaped values no rule anticipated.
L3ModelGLiNER, a small transformer fine-tuned on this domain, running locally through ONNX. Names, addresses and organisations in prose.
L4StructureTable headers, column typing, field captions, form layouts. “Loan Number:” tells you what follows it.

The NOT-PII gate

Currency amounts, fiscal periods, percentages and bare finance acronyms are never PII, no matter which layer proposed them. The rule is enforced once, at fusion, so every detection source agrees.

That gate exists because the same phrase mislabels differently per path: “Value Added Tax” came back as a person name from one and an account number from another. One gate ends the class.

Review is per value. Masking is per occurrence.

Findings are grouped by the value, not the hit. A name appearing two hundred times is one decision. The Becomes column is computed with the real masking function, so what the queue promises is what the export writes.

Colour means certainty, never whether something gets masked. Green is a confident detection and amber a less confident one — both are masked. A value is only left in the file when it is struck through, and only because a person asked.

The findings queue: category cards, the certainty legend, values grouped with occurrence counts, a masking-style letter, the action, and an evidence line reading employer_org, sources same_value_sweep, confidence 1.00.

Masked output that is still worth analysing

Five styles: Redact, Tokenise, Synthetic, Hash, No Mask. The interesting one is deterministic keyed pseudonymisation — the same person masks to the same synthetic name everywhere, across a document and across every sheet of a workbook.

So you can still count how many loans that borrower has, join across sheets, and let a model reason about the structure, without ever seeing the identity. Card numbers follow the PCI DSS 6+4 truncation rule, and checksums are repaired so masked SSNs, routing numbers and cards stay structurally valid.

The masked document beside the original PDF. Names have become TOK_0001 style tokens, organisations have become consistent synthetic names, account numbers are truncated.

Columns, not cells

A spreadsheet is masked by column, with the detected type, the rule applied and a live preview of the result. One rule can be pushed across every sheet with a matching header.

A table is judged by what it exposes rather than by reading time, and the application says so twice — when the scan finishes and again before export: one column left open exposes five thousand people, not one.

Table mode: per-column masking rules with a radio grid, and a live preview showing names replaced by synthetic names, SSNs and account numbers truncated, and the balance column deliberately unmasked.

04 / RELEASE AND EVIDENCE

The controls, by their register numbers

These are the identifiers the governance document uses. They are cited here so a reviewer can ask for the control by name.

C1 · THE RELEASE GATE

Nothing reaches the clipboard or the disk without one function being asked

It answers in four states: allowed, needs acknowledgement, blocked by policy, or allowed with the warning switched off by the organisation.

Its first test is “was this ever scanned”, and that ordering is the point of the control. An unscanned document reports zero findings, and a gate that treats zero findings as zero risk waves through the likeliest leak of all — because it looks exactly like success.

The export confirmation sheet: every value grouped by category, showing the original, what it becomes, how many times it appears, the masking style, and whether the engine was certain.

C10 · READ BACK

What was written is read back and checked

The Export step reports one of four verdicts, and the third is the reason it exists: ready to export, saved and checked, 3 NOT masked!, saved, unverified.

A file that read back dirty must not look like a clean one.

C11 · EVERYWHERE

A value is masked everywhere it appears, or it is not masked

The whole-file sweep used to be a button in the export dialog. A button that can be skipped is not a defence, so it now runs at the end of every detect.

Found by a real leak: one document exported with a value masked in one place and left in the clear in twenty-one others.

C12 · THE FILENAME

The filename tells the truth about the file

Three prefixes, each of them true of the file it names: MASKED_, UNREVIEWED_, and UNMASKED_UNSAFE_TO_UPLOAD_IN_COPILOT_.

The filename is the only part of an export that survives being mailed.

C8 · THE LOG

The log is not allowed to become a PII file

Type, a safe preview, an occurrence count and a keyed HMAC-SHA256 fingerprint. An auditor can confirm a value they already suspect; they cannot recover one they do not.

Keyed rather than plainly hashed, on purpose — a plain hash is a rainbow table away from the value.

C4 / C5 · THE AUDIT TRAIL

Append-only, hash-chained, and readable without our software

One file per session, one JSON object per line, flushed and synced as each event happens, so a session that crashes still has everything up to the crash. Each entry is sealed with the one before it, and Check integrity reports the first bad record by number.

Per masked span: the document, the page, the offsets, the entity type, the confidence, which layers and which named rules fired, the reason the tier was assigned, the decision, any human override, the masking strategy, and a timestamp. Per run: input hashes, a configuration snapshot, model hashes, and a salt fingerprint — so an auditor can confirm two runs used the same key without ever seeing it.

The activity log: application opened, file opened, scanned for personal information, masking decisions — each with structured detail including a field recording that no network access is made by this app.

REVERSAL

Reading the answer back in the clear

When an assistant sends back an answer full of masked values, open it here and the real values go back in. It finds the map itself — the open document, the answer's folder, then the last twelve maps it wrote — and tells you which one it used.

Only Synthetic and Tokenise reverse. Redact and Hash destroy the value on purpose, and the window says so rather than failing quietly.

The decrypt reader, with a standing warning that what appears below is the unmasked original and the window should be treated as confidential.

05 / CONFIGURATION

It cannot know your bank's own formats. Teach it once.

Paste one real example. That is the whole job.

The application works out the shape, states in plain English what it will match, and shows how many it finds in the document you have open.

$ EMP-004512
  This matches: 3 capital letters, then a '-',
  then 6 digits. Anything of that shape is found,
  not just this one value.

You never have to write a pattern, and there is nothing to choose between: type one anyway and the application works out by itself whether it is wildcards or a regular expression, and tells you which it used. For a lot of rules at once, take the template spreadsheet and import it — anything that does not make sense is reported with its line number, and everything else is still added.

The rule editor with four rules: employee number, branch facility code, internal customer reference and policy number, each with the pattern it inferred and what it is treated as.

PROFILES

Three, picked on first run

US banking, India, or development finance. The last one stops World Bank and ADB style project identifiers being flagged as personal data.

India ships PAN, Aadhaar with its Verhoeff check, and +91 phone formats.

DEFAULTS

Set once, not per value

A default style per kind of information, and how much of a redacted value stays readable.

The recommendation is the start only. The last characters of an account number or a phone are the ones that identify a person.

THE SALT

Two people, one key, matching output

A 256-bit key per installation makes masking consistent. Share it with a colleague and your outputs match theirs. Regenerate it and they will not.

A fingerprint lets two people confirm they hold the same key without either of them seeing it.

SECOND OPINION

Send the list, not a screenshot

Export the findings as a spreadsheet, a colleague changes one column, load their answer back. You are told exactly what changed, what already agreed, and what did not match this document.

One undo reverses the whole file. Their notes are written beside the export, so the reasoning survives with the evidence.

06 / THE PATH

Open, detect, review, apply, release

The application draws this same chain across the top of the window. Green is done; the first step that is not done is where you are; a step is done only when every step in front of it is.

→OpenPDF through the geometry engine, everything else through the general converter. Scanned pages raise a banner and wait.
1Detect PIIFive layers locally, fused into one finding per value with its evidence trail. The whole-file sweep runs at the end.
2ReviewOne decision per value, not per occurrence. J and K move, A accepts, R rejects, U undoes, Enter jumps to it in the document.
3Apply masksThe masked document is built and shown. Show masked is a view, not a commitment; switch it off and everything is back.
◆Release gateWas this ever scanned? Would anything detected leave in the clear? One dialog, once, stating a number rather than a feeling.
4ExportMasked Markdown, Word or Excel, the audit log, the run manifest, and an encrypted mapping if anything is reversible. Then read back and checked.

The four-step chain as drawn in the application: Detect PII, 23 found, in green; Review, 1 of 2 pages, in amber; Apply masks and Export in red, both marked not yet. — The chain, mid-job, from the shipped build.

07 / SPECIFICATION

Measured, and where it is weak

There is no social proof on this page because there is none worth printing. These are the numbers instead, with the ones that are unflattering kept in.

Detection, on documents this project did not write

Span recall: 0.90 1,486 of 1,651
Type-correct recall: 0.87 1,436 of 1,651
False positives: 46 of 271 declared not-PII controls
Corpus: 36 bank documents, hand-audited answer key
Reproduction: 12 minutes, one command, on your machine

Quote 0.90, not 0.900. Two runs of identical code can differ by a few occurrences because of floating-point scheduling in the model runtime. It is documented, the cure was priced, and it was refused.

The answer key was made harder three separate times: when the engine started scoring well, occurrences it missed were added on purpose.

Per type, so nobody has to take an average on trust

SSN, ITIN, EIN	1.000	Date of birth	1.000
US phone	1.000	Loan number	1.000
ABA routing	1.000	Credential	1.000
Email	1.000	Property legal desc.	1.000
Card, IBAN, VIN	1.000	Customer ID	0.971
Passport, licence	1.000	Licence number	0.966
Postal address	0.992	Facility ID	0.962
Person name	0.920	Account number	0.954
Demographic	0.897	Employer / organisation	0.745

The weakest type is organisation names at 0.745, and that is stated deliberately. It is the hardest class, it is where the remaining work is, and a vendor who claims uniform excellence is not measuring.

Regulatory mapping

In the product rather than in a brochure. A locked, machine-readable schema ships with the application. Of 35 detection categories, 23 are personal information, and each of those carries its basis.

NIST SP 800-122: 23 categories
HIPAA: 21 the 18 PHI identifiers, mapped individually
GLBA: 19 non-public personal information
CCPA / CPRA: 15 consumer categories A to K
ISO 27001 Annex A: 8 control references
GDPR Article 9: 1 special category data
PCI DSS: 1 6+4 truncation implemented

It maps to these frameworks and is designed to support compliance with them. It is not “HIPAA compliant” and not “ISO 27001 certified”. Software is not compliant; organisations are, and certification needs an accredited auditor. Anyone qualified to sign a purchase order knows the difference.

What it does not do

English only. No Hindi, no EU languages.
No visually redacted PDF. Output is masked Markdown or Office files, not a blacked-out PDF for a court filing. Page images are never rewritten.
Single user. No central policy console, no multi-seat administration, no aggregated team audit.
Windows in practice. Clipboard integration uses a Windows-only library.
Organisation names at 0.745. Named, measured, and where the next work goes.
The neural detector is not bundled. It adds roughly 662 MB and is a component the bank provisions and can inspect. Without it, span recall holds at 0.869 but type-correct recall falls to 0.719 and unclassified noise rises sharply — it mostly still finds the personal data, then mislabels it.
No penetration test has been performed. The security documentation is a self-assessment and says so.
The decrypt map is the residual risk. It sits beside the export in plain JSON containing original values. It is named in the dialog, in the folder and in the session report. The software cannot enforce that it stays put.

Screens on this page are the shipped build running against the project's own synthetic gold corpus. No customer document appears anywhere.

08 / ACCESS

Request access

Tell us who you are and what you are trying to protect. Evaluation builds go out by hand, one organisation at a time, with the reproduction command for every number on this page.