Detection engine

Two layers of detection. The checksum always wins.

Twenty-one deterministic detectors validate identifiers and secrets by checksum, structure or context. An on-device ONNX model classifies the four data types no pattern can describe. Both run in the browser.

Book a demo Get Early Access

Detections grouped by department, data class and destination.

What it detects

25 data classes. Four ways to be sure.

Twenty-one deterministic detectors, validated by checksum, structure or context, and an on-device model for the four classes no pattern can describe. Where a checksum matches, it overrides the model.

Financial data4

IBANChecksum
Payment card numberChecksum
Dutch VAT number (BTW)Format
KvK numberContext

National identifiers5

BSN (Netherlands)Checksum
German tax ID (Steuer-ID)Checksum
EU national IDChecksum
German tax number (Steuernummer)Format
BIG number (Dutch healthcare register)Context

Personal data5

Email addressFormat
Phone numberFormat
IP addressFormat
Dutch postcodeFormat
Date of birthContext

Secrets and credentials6

API keyFormat
AWS access keyFormat
GCP keyFormat
JSON Web TokenFormat
Private keyFormat
Generic secretFormat

Unstructured content5

Person nameOn-device model
Postal addressOn-device model
Health dataOn-device model
Organisation-confidentialOn-device model
Source codeFormat

Checksumthe number itself is mathematically verifiedFormatthe structure is validatedContextfires only beside a matching keywordOn-device modelclassified by the on-device model

How it decides

Precision first, then coverage.

Deterministic layer

Checksum validators such as IBAN mod-97, the payment-card Luhn check and the Dutch BSN eleven-test mean a match is a real number, not a lookalike.

Five checksum-verified classes
Thirteen format-validated
Three context-gated

On-device model

A 13 MB ONNX named-entity model classifies person names, postal addresses, health data and organisation-confidential text. It labels; it does not generate or decide.

Runs in Chrome and Edge
No content sent to a cloud AI service
Nothing your people type trains anything

Conflict rule

When a checksum match and the model disagree, the checksum wins. The model can add coverage; it can never override a verified identifier.

Precision gate on checksum classes in CI
Uninspectable content is flagged, never guessed

Files

Documents parsed on the device.

Formats: PDFDOCXXLSXPPTXCSVTXTMDJSON
Entry points: File pickerDrag-and-dropPaste
On a match: Upload stoppedClasses named in the bannerA file that needs redaction is stopped, not rewritten.
Cannot inspect: Scanned PDFsImagesNo OCR. These are flagged as uninspectable and your policy decides whether they may be sent.

Questions

What engineers ask about detection.

How do you keep false positives down?

Identifiers are validated, not just pattern-matched: an IBAN must pass mod-97, a card number the Luhn check, a BSN the eleven-test. Classes with no public checksum, such as KvK and BIG numbers, fire only when a matching keyword sits beside them.

Where does the model run?

In the browser, on the device. It is 13 MB, runs in Chrome and Edge, and never sends content to a cloud AI service.

Can we add our own data classes?

Organisation-confidential terms are covered by the model today. Custom patterns for your own identifiers are part of the rollout conversation; ask us in the demo.

Get started

See it stop real-looking data in a real browser.

A 30-minute technical walkthrough: a prompt redacted, a file stopped, the dashboard, and an evidence pack verified offline in front of you.