Anonymisation
Before a buyer sees anything, we replace everything that could identify a person or a company. This happens as local data processing at the seller or in data centres in Germany.
- Three detection stages
- Consistent pseudonyms, so cases stay intact
- Audit report for every release
Dear Mr Person0519,
according to the delivery note for your order OrderA-1042, on Dateshifted we received only 40 instead of 50 ball valves. Please credit the difference of €385.00 to account IBAN03.
Kind regards, Person0412, Purchasing, Company0087, Tel. Phone11
Detecting personal data
Each stage catches what the previous one misses. Large documents are split into sections, but the context model still sees the whole document.
- Stage 1
Patterns and checksums
Rules and validation checks find structured details that follow a fixed format.
- Stage 2
Compact language model
A model tuned to personal data recognises names, addresses and references in running text, including unusual spellings.
- Stage 3
Context model
A larger model reads the whole document, reviews the previous hits and finds indirect references such as “the branch manager in Aue”.
What is replaced
- Names and signatures
- Addresses
- Dates of birth
- Email addresses and phone numbers
- IBAN, BIC and account numbers
- Tax IDs and social security numbers
- Customer, employee and contract numbers
- Case and file numbers
- Vehicle registration numbers
- Faces and signatures in scans
Consistent pseudonyms across all systems
Buyers need connected cases. That is why we replace a person or number with the same pseudonym in every system.
Sender
Person0412
CRM
Contact person
Person0412
Accounting
Credit note approval
Person0412
How this differs from redaction
Same pseudonyms across all systems
The same person or number is replaced identically everywhere, so cases remain traceable.
Date shift
All dates in a dataset are shifted by the same offset. Intervals are preserved.
Rare values coarsened
Conspicuous individual values that could reveal a person are grouped or removed.
Special categories excluded
Health data, personnel files and professional secrets are removed or handled separately.
Human review
Before every release we check a sample by hand. The result is recorded in the audit report.
Mapping destroyed
The table linking original and pseudonym never leaves Germany and is deleted after the handover.
Legal background: according to the CJEU judgment of 4 September 2025, C-413/23 P (EDPS v SRB), pseudonymised data are not personal data for a recipient who cannot re-establish the link with reasonable effort.
Where the data are processed
You decide whether the original data leave your premises.
In Germany at Hetzner
- Data centres in Falkenstein and Nuremberg
- Information security certified to ISO/IEC 27001:2022
- Separate, isolated environment for every dataset
- TLS 1.3 in transit, AES-256 at rest with separate keys
- Deletion after the handover, with deletion certificate
The ISO certification covers the data centres and hosting services of Hetzner Online GmbH.
Local data processing at the seller
- The anonymisation runs as a container on your servers or at your IT service provider
- Original data never leave your network
- Only the anonymised export and the audit report go out
- We set it up and support the release
Contracts and evidence
For the anonymisation we act as a processor. The decision on realisation and buyers remains with you.
- Data processing agreementunder Art. 28 GDPR, before the first access to data
- Non-disclosure agreementalso for professionals bound by secrecy under § 203 StGB
- Technical and organisational measureson request
- Audit reportfor every release of a sample or export
- Deletion certificateafter the handover
Frequently asked questions
How reliable is the detection?
We measure it for every dataset on a hand-checked sample and record the result in the audit report. Data are only released once the sample is clean.
Which formats do you process?
Email archives (PST, MBOX, EML), Office documents, PDFs including scans, spreadsheets, database exports and images. Scanned documents go through text recognition first.
Who sees the original data?
In normal operation, nobody. Processing runs automatically in an isolated environment. Administrative access requires two-factor authentication and VPN and is logged.
Do you train your own models on the data?
No. The data are only processed for the anonymisation and the agreed handover.
Is the result anonymous or pseudonymous?
Pseudonymous during processing, because the mapping table exists. Buyers never receive it, and it is deleted after the handover. For the buyer, the data can then no longer be linked to any person.