Security and privacy: we don't ask for trust, we give you the means to verify.
AnonyAI is built around a single promise: no document leaves the workstation. This page explains how the architecture guarantees it, rather than a policy, and how your IT department or DPO can check it for themselves.
Local processing
Extraction, detection, review, anonymization and export all run inside the AnonyAI process on the workstation. No step opens a connection.
No telemetry
No usage statistics, crash reports, analytics or “anonymous usage data”. It is not a setting to switch off: it simply does not exist.
Modern cryptography
Restore maps encrypted with ChaCha20-Poly1305, keys derived with scrypt. Licences signed with Ed25519.
Air-gap ready
Works on workstations that are never connected to the Internet, licence activation included.
Everything that leaves the workstation. The complete list.
The only outbound traffic concerns the licence, and it happens only when you request it, activate it or check for updates. On an isolated workstation there is no traffic at all.
| Data | When | Why | Retention |
|---|---|---|---|
| Email address | Trial, activation | Issuing the licence (contract) | Duration of the relationship |
| Company name | Trial | Issuing the licence (contract) | Duration of the relationship |
| Licence key | Activation, release | Verifying the purchase | Duration of the licence |
| PC fingerprint (salted hash) | Trial, activation | Binding the licence to a workstation | Duration of the activation |
| Computer name, operating system | Activation | Recognising your own PC in support | Duration of the activation |
| IP address and country | Trial, activation | Fraud prevention | 90 days, then deleted |
| Version number | Update check | Offering a new version | Not stored |
Never transmitted, under any circumstances
There is no code path, setting or “support mode” that sends:
- a document or any part of one
- a file name or path
- the extracted text
- a detected value, a placeholder or a map
- the fingerprint (hash) of a document
- the number of values found in a document
Why the last two as well
They are the kind of thing a vendor would consider harmless. They are not.
A document fingerprint is an identifier linking a specific file to a specific customer. A count of findings reveals the shape of the document: three people, one IBAN, two tax codes.
Both stay on the workstation, in the local audit log.
Only one module talks to the network. You can check it.
The application has a single point from which a connection can start: the licence client. It exposes five operations, and none of them accepts document content as a parameter.
A reviewer can confirm that there is exactly one network call in the whole code base, and observe with any monitoring tool that no connection is made while a document is being processed.
The application includes no third-party libraries: no dependency that could introduce network behaviour without your knowledge.
Conservative choices, declared parameters.
No proprietary algorithms. Public standards, documented parameters.
Restore map
Authenticated encryption with ChaCha20-Poly1305 (RFC 8439). Key derived from the passphrase with scrypt (N=215, r=8, p=1): about 100 ms and 32 MB per unlock, to make brute-force attempts expensive.
The cleartext header is bound to the content as associated data: the encrypted content of one map cannot be transplanted onto another.
Licences
Certificates signed with Ed25519 and verified locally against a public key built into the application. Verification needs no network, today or ten years from now.
The private signing key is never present on workstations.
PC identification
Hardware identifiers are read locally and immediately transformed with SHA-256 and a product-specific salt. The raw values never leave the machine and are never stored.
The salt prevents the fingerprint from being correlated with one computed by other software.
AnonyAI's position under the GDPR.
Stated precisely, because a DPO who is told otherwise will find out at the worst possible moment.
Pseudonymisation, while the map exists
A document processed by AnonyAI is pseudonymised within the meaning of Art. 4(5) GDPR as long as you keep the restore map: the data can be re-linked using information kept separately and protected.
Anonymization, once the map is destroyed
Without the map the document becomes anonymous and, as Recital 26 indicates, falls outside the scope of the Regulation. The choice is yours and it is explicit: saving the map is a separate action, with its own passphrase.
Minimisation and privacy by design
Removing personal data before using an AI service is a concrete measure of data minimisation (Art. 5) and data protection by design (Art. 25), and it reduces the personal data transferred to third parties.
Accountability
The local audit log documents the operations carried out on the workstation, supporting accountability (Art. 5(2)), without ever containing the data processed.
AnonyAI is a tool that supports compliance: the assessment of the processing as a whole remains with the controller. None of this information constitutes legal advice.
Material for the DPO and for IT.
We provide the technical documentation needed for vendor assessment, the record of processing activities and any data protection impact assessment.
- Description of data flows and legal bases
- Architecture of the application and of the licensing service
- Cryptographic details and key management
- Activation procedure for isolated workstations
Vulnerability reporting
If you believe you have found a security problem in AnonyAI or in the licensing service, write to us before making it public. We respond to every report and credit those who disclose responsibly.
Put it to the test in your own environment.
Download it, verify the SHA-256 fingerprint, unplug the network and try it. It is the most convincing test we can offer you.