AI data security: detection and masking

What we detect

Personal and contact data, tax identifiers, bank accounts and IBANs, social security numbers, API keys and technical secrets, plus the categories you define yourself: case references, client codes, confidential project names. The list is tuned with you during the pilot, because what counts as sensitive in a clinic is not what counts in a law firm.

What we do with it

Masking replaces the value with a stable token, so the model understands the sentence structure without seeing the real data: the contract for CLIENT_1 and the payment to IBAN_1. Routing sends the full request to a model hosted in the EU (today, Mistral) when the content must not leave the perimeter. Blocking stops the request and tells the user why, offering the allowed alternative.

Watch first, block later

Turning on blocking from day one is the fastest way to push people back to personal accounts. That is why a pilot starts in audit mode: the system classifies and records without interfering, and policies go live once we know what actually happens in your company and how often.

The limits, stated plainly

No detection is perfect. Sensitive data written ambiguously can slip through, and an over-strict rule can stall legitimate work. That is why everything is logged and reviewable: the goal is to reduce risk measurably and be able to prove it, not to promise an infallible barrier.

Coming soon: the same protection in your other AI tools

Many teams already use AI assistants inside other applications, such as Claude or Cursor. Soon Acotia will bring the same data protection and your company's rules to those compatible tools, so the perimeter does not depend on which app each person uses.

Which categories we actually validate

It is not enough to look for numbers that resemble an IBAN. We check the control digit of Spanish tax IDs (NIF, NIE and CIF), the mod-97 algorithm on IBANs and Social Security numbers, and the Luhn algorithm on cards. We also detect keys and technical secrets, emails, phone numbers and IP addresses, plus the custom terms you define, as exact text or as a regular expression.

What each action does by default

If you change nothing, secrets and cards are blocked, IP addresses are let through and every other category is masked. The company starts in audit mode, so at first it only records what would have happened.

A separate folder for the most sensitive material

You can mark a team folder as sensitive. What is attached from it makes the request sensitive and always gets its own action (mask, send to an EU model or block), even in audit mode.

Official sources

General Data Protection Regulation (GDPR), Regulation (EU) 2016/679: official text on EUR-Lex.

Pseudonymisation is defined in Article 4(5) of the GDPR.