tonytautai

PII Guardian

Drop a file — PDF, scan, photo, e-mail, zip, CSV export — and get it back with every piece of personal data redacted. Your file is processed in memory and never stored: that is the whole point of the product.

Drop your file here, or choose one

PDF · images · docx · xlsx · csv · txt · eml · html · zip · json — 10 MB max

What to protect — everything hidden

Hide replaces the value with its label ([EMAIL]). Pseudonymize gives it a consistent stand-in (Person A, [EMAIL 1]) so the document stays readable. Keep leaves it visible. For dates of birth, Year only keeps just the year (1985). For IDs and financial numbers, Last 4 keeps the last four characters (XXX-XX-6789), as US court filings require (FRCP 5.2).

Measured scores, baselines and protocol (we sell honesty too)
  • 97.6 % protection on the latest unseen test set (70 insurance, legal and accounting files — US, UK, AU, DE, FR, ES, IT; Oct 2026), chain frozen by SHA-256 before scoring. Each new model is judged on a set built by an independent agent that it has never seen.
  • 97.5 % in real conditions — browser on this page, live service, 13 mixed files (PDF, Word, Excel, CSV, e-mail, photo). The misses: two phone numbers, one tax ID, one name, one address fragment. We always show them.
  • Metric: a value is protected only if every occurrence of it in the file is covered. Target is 99 % — we are not there yet, and we say so.
  • Baselines (same 175 files, same metric): this chain 95.4–96.5 % at the time · Azure AI Language 83.7 % · GLiNER 77.2 % · Presidio 64.7 %. Detector-level comparison on text from our own extraction/OCR — those tools do neither, their end-to-end would be lower.
  • Download in the original format (PDF, Word, Excel, CSV): true redaction — the text under a black box is removed, not covered. Hidden content is cleared on the way out: tracked changes, comments, authors, metadata, bookmarks. Tested on 40 adversarial files hiding 5,361 values in 50 places (text boxes, hidden sheets, footnotes, formulas…): 0 value left in the returned files. Each file is re-read before it is offered; if anything is still readable, you get the text version instead. Scans and photos come back as text.
  • Red-team: prompt injections in documents ignored · damaged, password-protected and empty files rejected with a clear message · 5 simultaneous visitors served without error.
  • Model: Qwen3-4B (Apache 2.0 base) fine-tuned by us, proprietary LoRA adapter — trained by us, licensed to you, running on your infrastructure. The current one (r2, Oct 2026) comes out of our improvement loop: its own errors are turned into new training examples, and it is adopted only if it beats the previous model on a fresh unseen set by more than retraining noise. Four retrained variants were measured and rejected along the way, and documented.

Measured, not promised. ← all models · tonytautai.com