# anonym.life > Find PII Automatically Across Every System. 317 regex recognizers with checksum validation. Deterministic results—same input, same output, fully auditable. Pattern-based detection, not AI guessing. 67 languages including RTL. - Full content: https://anonym.life/llms-full.txt - Summary: https://anonym.life/llms.txt - Sitemap: https://anonym.life/sitemap.xml --- ## Home URL: https://anonym.life/ > Find PII Automatically Across Every Data Flow. Regex-based recognizers detect names, addresses, IDs, and sensitive data. Deterministic. Auditable. Customizable for your industry. ### Hero Find PII Automatically Across Every Data Flow Regex-based recognizers detect names, addresses, IDs, and sensitive data. Deterministic. Auditable. Customizable for your industry. - Pattern matching, not AI guessing - Checksum validation - Custom recognizers - Zero Knowledge - GDPR Aligned - Your Keys, Your Data ### The Hidden Risk Can't Protect What You Can't Find PII hides in free-text fields, logs, documents, and API payloads. Manual review doesn't scale. Regex-based detection does. 1. **Scattered PII** -- Names in ticket descriptions. Phones in notes. Addresses in comments. 2. **Blind Spots** -- 12+ systems with overlapping customer data. No unified view. 3. **Breach Blast Radius** -- One compromised system exposes everything. EUR 4.3M average cost. ### Pattern Library: Deterministic Recognition Not AI guessing. Auditable regex patterns with checksum validation. Customize recognizers for your industry. **Identity** (12 patterns): NAME, SSN, PASSPORT, ID_NUMBER **Contact** (8 patterns): EMAIL, PHONE, ADDRESS, POSTCODE **Financial** (10 patterns): IBAN, CREDIT_CARD, BIC, TAX_ID **Location** (6 patterns): IP_ADDRESS, GPS_COORDS, LICENSE_PLATE How detection works: - **Pattern Matching** -- Regex patterns match known formats. Phone numbers, emails, IDs -- all have predictable structures. - **Checksum Validation** -- Luhn for credit cards. IBAN structure validation. Not just pattern, but mathematical proof. - **Context Awareness** -- Surrounding words boost confidence. "Email:" before a pattern increases match score. ### The Privacy Pipeline: From Raw PII to Sanitized Flow Detection first. Everything else follows. 1. **DETECT** (The Differentiator) -- Pattern-based recognition across structured and unstructured data. Regex recognizers, checksums, context. 2. **TRANSFORM** -- Redact, mask, generalize, or tokenize based on configurable presets. 3. **VAULT** -- Zero Knowledge storage. Your keys encrypt PII. We never see your data. 4. **DISTRIBUTE** -- Sanitized objects flow to downstream systems without raw PII. 5. **DISCLOSE** -- Controlled, time-limited re-identification when necessary. ### Industry Solutions: What Gets Detected in Your Industry Custom recognizer patterns for logistics, healthcare, e-commerce, and payments. **Logistics** - Detected: Driver names, Customer phones, Delivery addresses, Route notes - Transformed: Tokens, Relay channels, Zone references, Sanitized notes **Healthcare** - Detected: Patient names, DOB, Insurance IDs, Medical record numbers - Transformed: Sample tokens, Age ranges, Pseudonymous IDs, Case references **E-commerce** - Detected: Buyer names, Shipping addresses, Payment details, Support tickets - Transformed: Customer tokens, Zone codes, Transaction refs, Redacted tickets **Payments** - Detected: Card numbers, Account holders, Tax IDs, Billing addresses - Transformed: PAN tokens, Pseudonyms, Reference IDs, Masked addresses ### Detection Accuracy: Why Regex Beats AI Guessing - **Deterministic Results** -- Same input = same output. No probabilistic variance. Fully auditable. - **Custom Recognizers** -- Add patterns for your industry. Policy numbers, patient IDs, order refs -- your patterns. - **Fast Execution** -- No ML inference. No GPU required. Regex runs in microseconds. - **Zero Knowledge Architecture** -- Your keys, your data. We can't see your PII -- even if our systems are compromised. Regex vs AI Detection comparison: | Aspect | Regex | AI/ML | |---|---|---| | Results | Deterministic | Probabilistic | | Auditability | Pattern visible | Black box | | Customization | Add patterns | Retrain model | | Speed | Microseconds | Milliseconds+ | | Infrastructure | Any CPU | GPU preferred | | Explainability | Regex shown | "It guessed" | --- ## How It Works URL: https://anonym.life/how-it-works > Regex recognizers find PII. Presets transform it. Vault stores mappings. Deterministic. Auditable. Customizable. Detection first. Everything else follows. ### Six-Step Privacy Pipeline 1. **DETECT -- Pattern-Based Recognition**: Data enters through SDK, API gateway, or streaming integration. Regex recognizers find PII across structured and unstructured data. 2. **TRANSFORM -- Configurable Presets**: Apply configurable presets: redact, mask, generalize, tokenize. 3. **VAULT -- Secure Storage**: Original PII encrypted and stored with customer-managed keys. 4. **DISTRIBUTE -- Sanitized Flow**: Sanitized object flows to downstream systems. 5. **DISCLOSE -- Controlled Access**: Controlled, time-limited re-identification when necessary. 6. **INGEST**: Data received into the pipeline. ### 317 Regex Recognizers Deterministic regex patterns with checksum validation. Not AI guessing. See exactly what patterns match your data. - Pattern Matching: Regex patterns match known formats. Phone numbers, emails, IDs -- all have predictable structures. - Checksum Validation: Luhn for credit cards. IBAN structure validation. Mathematical proof, not guessing. - Context Awareness: Surrounding words boost confidence scores. ### Preset Engine Industry-specific presets with configurable transform rules: - Industry: Logistics, Healthcare, E-commerce, Payments - Purpose: Delivery, Processing, Fulfillment - Configurable disclosure rules, TTL, and role-based access ### Vault Storage - Encrypted Blobs - Token Mappings - Policy Receipts - AES-256 encryption - Identity Vault with separated and protected data ### Downstream Distribution Sanitized data flows to downstream services: - Delivery apps receive tokens, no raw PII - Workflow continues without interruption - No access to original PII fields ### Controlled Disclosure - Purpose-bound requests (e.g., Support) - Time-limited access (TTL: 5 min) - Policy engine evaluates: Identity verified, MFA complete, Policy match, Purpose valid - Auto-expires after TTL ### Architecture Transformation Before: PII exposed everywhere across all systems After: PII isolated in vault, downstream systems receive only sanitized data ### Integration Options: Deploy Your Way Multiple integration patterns to fit your architecture: - **Native SDKs**: Drop-in libraries with pattern detection built-in. Available for Node.js, Python, Go, Java, .NET. - **REST API**: Language-agnostic HTTP endpoints. - **Streaming Integration**: Real-time detection for event streams. Kafka Consumer/Producer, AWS SQS/SNS, Webhooks. ### Live Visualizations Interactive animations showing how patterns find and protect your data, including: - Data flow extraction demos - Preset configuration visualizations - Architecture transformation animations --- ## Security URL: https://anonym.life/security > Detection to Encryption Pipeline. Pattern-based detection feeds directly into Zero Knowledge encryption. Your keys, your control. We never have access to your encryption keys. ### Zero Knowledge Encryption Your data is encrypted before it leaves your systems. We never have access to your keys. Even if our infrastructure is compromised, attackers get only encrypted data. Pipeline: DETECT -> ENCRYPT -> PROTECT Every regex-detected entity flows through a secure pipeline to encrypted storage. Example: Pattern Detection to Encrypted Storage - DETECTED BY PATTERN: John Doe, +49 172 555 1234, DE89 3704 0044 0532 0130 00 - ENCRYPTED IN VAULT: tok_8f3a2b..., tok_c7d9e1..., tok_4b6f8a... - Each token is individually encrypted with a unique DEK ### Envelope Encryption - **Per-Detection DEKs**: Each pattern-detected PII entity gets a unique encryption key, limiting blast radius. - **Your KMS, Your Control**: Integrate with AWS KMS, Azure Key Vault, Google Cloud KMS, or HashiCorp Vault. - **Key Rotation & Revocation**: Automated rotation schedules with full audit trail of all key operations. - Customer KMS wraps data keys; anonym.life detects and encrypts; Your Domain controls keys. ### Threshold/MPC Key Custody High-Assurance Mode: No Single Point of Failure For high-value detected PII and regulated environments, use threshold cryptography where M-of-N key shares are required to authorize any disclosure. - **2-of-3 required for disclosure**: Shard A (Customer), Shard B (anonym.life), Shard C (Trustee). Third shard remains idle -- no single party can decrypt. - **No Single-Party Decryption**: Neither you nor anonym.life can decrypt detected PII alone. Requires cooperation across trust domains. - **Insider Risk Protection**: Strong defense against rogue employees, compromised credentials, or coerced access. - **Flexible Trust Domains**: Configure 2-of-3, 3-of-5, or custom threshold schemes. Add independent trustees for extra assurance. ### Access Patterns: Not JIT Keys For operational roles like drivers, prefer capability tokens over decryption keys. **Risky: JIT Keys** - Driver receives decryption key - Can decrypt all detected PII - Key can be copied/shared - Hard to revoke immediately - Broad exposure if device is compromised **Recommended: Capability Tokens (Relay + Token)** - Driver receives one-time token - Token unlocks only current delivery - Uses relay channels for contact (phone number hidden) - Auto-expires after delivery window - Minimal exposure, maximum control - Keys stay in vault - Full audit trail ### Tamper-Evident Audit Anchoring Audit Log with SHA-256 hashed events anchored to a permissioned ledger. Only hashes stored on-chain -- no secrets or PII. Cryptographic proof of integrity. ### Compliance Evidence: From Detection to Disclosure Every pattern match, transformation, and disclosure is logged with cryptographic integrity. Know exactly which regex detected what, when, and who accessed it. - **Pattern Match Receipts**: Every detection includes: which recognizer matched, confidence score, and exact pattern used. - **Disclosure Receipts**: Every disclosure includes: who requested, what purpose, which attributes, TTL, and policy version. - **Optional Ledger Anchoring**: Anchor audit hashes to a permissioned blockchain for cross-party verification. No secrets on-chain. Audit Timeline: Data received -> PII detected (3 patterns) -> Tokenization applied -> Encrypted & vaulted -> Sanitized distributed -> Disclosure request -> Grant issued (2/3 MPC) -> Grant expired ### Security Controls Matrix Honest Assessment: What's Still Required Pattern detection and encryption reduce scope -- governance obligations remain your responsibility. Some control areas are reduced downstream (fewer systems needing full security controls), but core governance remains essential and is still required. ### Security Specifications - AES-256-GCM per-entity encryption - 317 regex recognizers for pattern-based detection - MPC custody with threshold key protection --- ## Pricing URL: https://anonym.life/pricing > Zero Knowledge PII protection tailored to your organization. Custom pricing based on your needs. ### Plans **Startup** For startups getting started with Zero Knowledge PII protection. - Pattern-based PII detection - Core recognizers (50+ patterns) - Zero Knowledge vault storage - Basic transformation presets - Email support - API access - Audit logging **Professional** (Most Popular) Full pattern library with customer-managed encryption keys. - All 317 pattern recognizers - Custom recognizer builder - Customer KMS integration (BYOK) - Unlimited transformations - Priority support (4h SLA) - Webhook integrations - Extended audit retention - Team management **Enterprise** Zero Knowledge architecture with MPC custody for regulated industries. - Everything in Professional - MPC threshold custody (2-of-3) - Industry-specific recognizers - Customer KMS/HSM integration - SSO/SAML integration - Dedicated infrastructure option - Dedicated support + TAM - SLA guarantees (99.99%) - Custom audit retention - Compliance assistance - Custom contracts & DPA ### Zero Knowledge Guarantee We Can't See Your Data. Unlike traditional solutions, our Zero Knowledge architecture means we literally cannot access your PII. Even if compromised, attackers get only encrypted data. - **Customer-Managed Keys**: Bring your own encryption keys (BYOK). We never have access to your master keys. - **Client-Side Encryption**: PII is encrypted before it leaves your systems. Even we cannot access your data. - **MPC Threshold Custody**: No single point of compromise. Multiple parties must authorize sensitive operations. ### 317 Built-in Regex Recognizers Deterministic pattern matching with checksum validation. 100% auditable. No AI guessing. Categories: Identity (75+), Contact (40+), Financial (50+), Location (30+), National IDs (120+) Professional & Enterprise: Build custom recognizers for industry-specific or regional PII formats. ### Frequently Asked Questions (Pricing Page) **What is Zero Knowledge architecture?** With Zero Knowledge, your data is encrypted client-side before it reaches our servers. We never have access to your decryption keys, meaning we literally cannot see your PII -- even if our systems were compromised. **How does pattern-based detection differ from AI detection?** Our regex recognizers use deterministic pattern matching with checksum validation (like Luhn for credit cards). Unlike AI/ML approaches, results are 100% reproducible and auditable. You can see exactly which pattern matched. **Can I bring my own encryption keys?** Yes! Professional and Enterprise plans support BYOK (Bring Your Own Key) with integration to your KMS (AWS KMS, Azure Key Vault, Google Cloud KMS) or on-premises HSM. **What is MPC threshold custody?** Multi-Party Computation (MPC) distributes key management across multiple parties. In our 2-of-3 model, at least 2 parties must authorize decryption. Even if one party is compromised, your data remains secure. **How do I get started?** Contact our sales team for a personalized demo. We'll walk you through the Zero Knowledge architecture, pattern detection capabilities, and help design a solution tailored to your compliance needs. --- ## Use Cases URL: https://anonym.life/use-cases > Detection Tuned for Your Industry. 317 recognizers with industry-specific patterns for logistics, healthcare, fintech, legal, and more. Each industry has specific PII patterns—our library knows them all. ### Logistics **Detect customer PII in delivery data automatically** Pattern recognizers find names, addresses, and phone numbers in delivery records. Drivers receive tokens instead of raw customer data. **The Problem**: Every driver, dispatcher, and warehouse worker has access to customer names, addresses, and phone numbers across thousands of deliveries. **Pattern Detection Solution**: Our regex recognizers automatically detect PII in delivery data. Names, addresses, and phone numbers are tokenized before reaching driver apps. Pattern Recognizers: NAME, PHONE_DE, PHONE_INTL, ADDRESS_DE, POSTCODE_DE, EMAIL Detection -> Transformation Flow: | Field | Detected | Raw Value | Transformed | |---|---|---|---| | Customer Name | NAME pattern | John Smith | [Delivery Token] | | Phone Number | PHONE_DE pattern | +49 170 1234567 | relay://tok_abc123 | | Address | ADDRESS_DE pattern | Hauptstr. 42, 80331 Munchen | Munchen, Altstadt district | | Order ID | No PII detected | ORD-2024-789 | ORD-2024-789 | | Delivery Window | No PII detected | 14:00-16:00 | 14:00-16:00 | Detection Benefits: - Auto-detect customer PII in delivery records - Reduce insider threat from drivers and contractors - Comply with GDPR data minimization principles - Enable relay contact without phone number exposure Detection Metrics: 12M PII entities detected/mo, 99.2% detection accuracy, 0% delivery SLA impact ### Healthcare **Detect PHI patterns in clinical workflows** Specialized recognizers for patient identifiers, insurance numbers, and medical record numbers. Labs process samples without patient identities. **The Problem**: Laboratory information systems, billing platforms, and third-party processors all have access to sensitive patient health information. **Pattern Detection Solution**: Healthcare-specific recognizers detect patient names, DOBs, insurance IDs, and MRNs. Labs receive sample tokens, results flow back through secure channels. Pattern Recognizers: NAME, DATE_OF_BIRTH, INSURANCE_ID_DE, MEDICAL_RECORD_NUMBER, PHONE, ADDRESS Detection -> Transformation Flow: | Field | Detected | Raw Value | Transformed | |---|---|---|---| | Patient Name | NAME pattern | Maria Schmidt | [Sample Token] | | Date of Birth | DOB pattern | 1985-03-15 | [Redacted] | | Insurance ID | INSURANCE_ID pattern | AOK-12345678 | ins_tok_xyz | | Sample ID | No PII detected | LAB-2024-456 | LAB-2024-456 | | Test Orders | No PII detected | CBC, Lipid Panel | CBC, Lipid Panel | Detection Benefits: - Detect PHI automatically in clinical data - HIPAA and GDPR compliant data flows - Reduce scope for security audits - Enable multi-lab processing without identity exposure Detection Metrics: 8M PHI patterns detected/mo, 60% audit scope reduction, 0 compliance incidents ### E-commerce **Detect customer PII before it spreads** Pattern recognizers catch emails, addresses, and payment details at ingestion. Downstream systems work with sanitized data only. **The Problem**: Customer data flows to analytics platforms, marketing tools, fulfillment vendors, and support systems -- each a potential breach point. **Pattern Detection Solution**: Regex recognizers detect customer PII at the API gateway. Emails, addresses, and phone numbers are tokenized before reaching analytics or vendors. Pattern Recognizers: EMAIL, PHONE, ADDRESS, POSTCODE, NAME, CREDIT_CARD, IBAN Detection -> Transformation Flow: | Field | Detected | Raw Value | Transformed | |---|---|---|---| | Customer Email | EMAIL pattern | maria@example.com | hash_a3f2... | | Billing Address | ADDRESS pattern | Maximilianstr. 101, 80538 Munchen | [Vault Protected] | | Order Value | No PII detected | EUR 149.99 | EUR 149.99 | | Product SKUs | No PII detected | SKU-001, SKU-042 | SKU-001, SKU-042 | | Customer Segment | No PII detected | Premium Shopper | Premium Shopper | Detection Benefits: - Auto-detect PII at API ingestion - Safe vendor data sharing - Analytics without privacy risk - Reduced PCI-DSS scope Detection Metrics: 45M PII entities detected/mo, 0% vendor PII access, -95% breach blast radius ### Payments **Detect payment data with checksum validation** Credit card and IBAN patterns include Luhn and checksum validation. No false positives on random number strings. **The Problem**: Payment processors, fraud systems, and reconciliation platforms all have access to customer identity and financial data. **Pattern Detection Solution**: Financial recognizers detect card numbers (with Luhn validation), IBANs (with checksum), and bank codes. Tokenize before reaching processors. Pattern Recognizers: CREDIT_CARD, IBAN_DE, BIC, NAME, ADDRESS, TAX_ID Detection -> Transformation Flow: | Field | Detected | Raw Value | Transformed | |---|---|---|---| | Cardholder Name | NAME pattern | Thomas Weber | [Tokenized] | | Full Card Number | CREDIT_CARD (Luhn validated) | 4532 **** **** 1234 | tok_card_xyz | | Transaction Amount | No PII detected | EUR 89.00 | EUR 89.00 | | Merchant ID | No PII detected | MER-12345 | MER-12345 | | Transaction Ref | No PII detected | TXN-2024-789 | TXN-2024-789 | Detection Benefits: - Detect card numbers with Luhn validation - IBAN detection with checksum verification - Reduced PCI-DSS audit scope - Fraud detection without identity exposure Detection Metrics: 28M payment PII detected/mo, 80% PCI scope reduction, <0.01% false positive rate ### Customer Success Stories **Major European Carrier (Logistics)**: "Pattern detection now catches 12M PII entities per month in our delivery data -- all before reaching driver apps." Result: 12M detections/mo **Regional Lab Network (Healthcare)**: "Our PHI recognizers automatically detect patient identifiers in lab workflows. Zero manual data classification needed." Result: 8M PHI detected/mo **Fashion Retailer (E-commerce)**: "Email and address patterns catch customer PII at API ingestion. Vendors never see the raw data." Result: 99.2% detection rate --- ## Compare URL: https://anonym.life/compare > Detection That Actually Works. Others require manual field definition or use probabilistic AI. We use 317 auditable regex patterns with checksum validation. ### Three Approaches to PII Detection **Manual Field Definition** (VGS, Skyflow, In-House) Pros: Full control over what's protected. Cons: Must know every PII field in advance; Missed fields remain unprotected; Schema changes require reconfiguration; Developer overhead for every new data source. **AI/ML Detection** (Some enterprise solutions) Pros: Can find unexpected PII. Cons: Probabilistic -- results vary; Black box -- can't audit why; False positives disrupt workflows; Model drift over time; Expensive compute costs. **Pattern-Based Detection** (anonym.life) Pros: 100% deterministic -- same input, same output; Auditable -- see exactly which pattern matched; Checksum validation (Luhn, IBAN); 317 pre-built recognizers; Custom patterns for your industry; No compute overhead. Cons: Won't catch truly novel PII formats. ### anonym.life vs VGS (Very Good Security) VGS requires manual field definition -- you must know every PII field in advance. anonym.life's 317 pattern recognizers automatically detect PII across structured and unstructured data. VGS offers: Tokenization and secure storage; PCI-DSS compliance focus; Proxy-based integration; Manual field mapping required. anonym.life differs: Pattern-based detection (317 regex recognizers vs manual config); Checksum validation (Luhn, IBAN) -- no false positives; Customer-managed KMS/HSM integration; MPC threshold custody option; Industry-specific recognizer presets; Auditable detection -- see which pattern matched. VGS is best for: Payment-focused apps where you know exactly which fields to protect. anonym.life is best for: General PII protection where detection should be automatic. ### anonym.life vs Skyflow (Data Privacy Vault) Skyflow requires explicit field definition in schemas. anonym.life detects PII automatically using pattern matching -- no schema changes needed. Skyflow offers: Data privacy vault; Role-based access controls; Schema-based field protection; Governance workflows. anonym.life differs: Automatic pattern detection vs explicit field definition; No schema changes required -- detect PII in any payload; Customer-controlled key management (your KMS/HSM); MPC threshold custody for high-assurance use cases; Checksum validation for financial identifiers; Custom recognizers for industry-specific patterns. Skyflow is best for: Organizations needing explicit schemas and governance workflows. anonym.life is best for: Organizations wanting automatic detection with customer-controlled keys. ### anonym.life vs Build In-House Building PII detection in-house means maintaining regex libraries, handling edge cases, and keeping up with new PII formats. anonym.life provides 317 production-ready recognizers. Total Cost of Ownership comparison: | | Build In-House | anonym.life | |---|---|---| | Initial Investment | EUR 500K - EUR 2M | EUR 0 | | Annual Cost | EUR 300K - EUR 800K | EUR 24K - EUR 240K | | Time to Production | 12-24 months | 2-4 weeks | | Team Required | 4-8 engineers | 0.5 FTE | In-House is best for: Organizations with dedicated security teams and unique detection requirements. anonym.life is best for: Organizations wanting production-ready detection without building from scratch. ### Feature Comparison Matrix | Feature | VGS | Skyflow | In-House | anonym.life | |---|---|---|---|---| | Pattern-Based Detection | No | No | Varies | 317 recognizers | | Checksum Validation (Luhn, IBAN) | No | No | Varies | Yes | | Custom Recognizers | No | No | Yes | Yes | | Schema Changes Required | Yes | Yes | Yes | No | | Customer-Managed KMS | Partial | No | Yes | Yes | | MPC Threshold Custody | No | No | No | Yes | | Detection Audit Trail | No | No | Varies | Yes | | Industry Recognizer Presets | No | No | No | Yes | | Time to Deploy | Weeks | Weeks | Months | Days | | SOC 2 Type II | Yes | Yes | Varies | Yes | --- ## ROI Calculator URL: https://anonym.life/roi-calculator > Calculate Your Privacy ROI. See how reducing PII exposure can lower breach risk and compliance costs for your organization. ### Interactive Calculator Inputs - **Systems with PII Access**: CRM, ERP, analytics, support tools, etc. that can access customer identifiers (1-50) - **Average Records per System**: Customer records, orders, transactions containing PII (10K-10M) - **Industry**: Healthcare ($10.93M avg breach), Financial Services ($6.08M), Pharmaceuticals ($5.01M), Technology ($5.45M), Energy ($4.72M), Industrial ($4.47M), Retail ($3.48M), Transportation & Logistics ($4.18M), Media & Entertainment ($3.58M), Hospitality ($3.36M), Other ($4.35M) - **Annual Privacy/Compliance Spend**: DPO, audits, assessments, privacy tooling, legal, etc. ($50K-$5M) ### Calculated Outputs - Risk Reduction (% breach probability reduced) - Annual Savings (expected value saved) - ROI (return on investment) - PII Systems reduction (systems no longer needing raw PII) - Savings Breakdown: Breach Risk Reduction Value, Compliance Efficiency Savings, Est. anonym.life Cost, Net Annual Value - Breach Probability Comparison: Current vs. With anonym.life ### Methodology - **Breach Probability**: 2.5% annual breach probability per system with PII access (Source: IBM Cost of Data Breach Report 2025) - **PII Reduction**: 85% of downstream systems can operate with pseudonymized data (Source: anonym.life customer implementations) - **Compliance Efficiency**: 30% reduction in privacy compliance overhead (Source: Reduced audit scope and simplified data mapping) - **Industry Costs**: Breach costs vary by industry from $3.4M to $10.9M average (Source: IBM Cost of Data Breach Report 2025) --- ## Contact URL: https://anonym.life/contact > Contact Sales. Get a personalized demo and pricing for your organization. See our Zero Knowledge PII detection in action. ### Contact Form Fields: Name, Email, Company, Subject (Demo, Pricing, Enterprise, Technical, Partnership, Other), Message, Newsletter opt-in. Response within 24 hours. Located in Saarbrucken, Germany. ### Why Zero Knowledge? Your data is encrypted before it leaves your systems. We can't see it. We can't access it. - **Your Keys, Your Control**: Customer-managed encryption keys (BYOK). We never have access to your master keys. - **Encrypted at Rest**: PII is encrypted before storage. Even database breaches expose only encrypted data. - **MPC Threshold Custody**: No single point of compromise. Multiple parties must authorize sensitive operations. ### Quick Answers **What is Zero Knowledge architecture?** With Zero Knowledge, your data is encrypted client-side before reaching our servers. We literally cannot access your PII -- only you hold the keys. **How does pattern detection work?** Our 317 regex recognizers scan data for known PII patterns. Unlike AI, results are 100% deterministic and auditable. **Can I use my own encryption keys?** Yes! Enterprise plans support BYOK (Bring Your Own Key) with your KMS/HSM integration. --- ## About URL: https://anonym.life/about > 27+ Years of Enterprise IT, Now Focused on Detection. From managing 700+ endpoints across 26 countries to building privacy middleware. ### Key Facts - 27+ Years Experience - 317 Regex Recognizers - 26 Countries Served - 5,000+ Accounts Managed ### Our Mission Make pattern-based PII detection the standard for enterprise privacy. Deterministic. Auditable. No AI guessing. - **Detection First**: You can't protect what you can't find. Pattern-based recognizers detect PII with 100% reproducibility. - **Security by Design**: Zero-Trust principles built in from day one. Envelope encryption, MPC custody, customer-managed keys. - **Audit-Ready**: Every detection logged. Every transformation traceable. Compliance documentation built into every project. ### Our Story: From Enterprise IT to Privacy Middleware curta.solutions has been delivering enterprise IT consulting since 1998. Over 27 years, we've managed infrastructure across 26 countries, built 80+ SharePoint Virtual Data Rooms, and governed 5,000+ accounts for regulated organizations. We saw the same problem everywhere: personal data spreading uncontrollably through transaction systems. CRMs, analytics tools, delivery apps, vendor integrations -- all holding copies of sensitive customer information. Every breach meant total exposure. Every compliance audit meant painful data mapping. anonym.life is our answer. We built pattern-based PII detection that finds sensitive data automatically -- no manual field configuration, no probabilistic AI guessing. Just deterministic regex recognizers with checksum validation. Detection first. Everything else follows. ### Heritage - Founded 1998 - 27+ years enterprise IT experience - curta.solutions: Parent company for regulated IT consulting - European Focus: EU-only data centers, GDPR-aligned operations ### Track Record - 700+ managed endpoints - 80+ Virtual Data Rooms - 26 international locations - 5,000+ governed accounts ### Our Approach Principles refined over 27 years of enterprise IT delivery: - **Pattern-Based Detection**: 317 regex recognizers find PII automatically. No manual field mapping. No AI hallucinations. Same input, same output, every time. - **Documentation-First**: Comprehensive runbooks and handover materials. Every detection logged with pattern name, confidence score, and timestamp. - **Governance Built-In**: Compliance isn't an afterthought. GDPR, ISO 27001, ITILv4 frameworks integrated from project inception. - **Zero-Trust Security**: Envelope encryption for every detected entity. Customer-managed keys. MPC threshold custody for high-value data. ### Compliance Standards - GDPR: EU General Data Protection Regulation aligned - ISO 27001: Information security management pathway - ITILv4: IT service management framework - NIS2: Network and Information Security Directive - SOC 2: Service Organization Control readiness ### Product Roadmap **Phase 1 -- Foundation**: Core privacy middleware (Detection, Presets, Vault, KMS, Audit) **Phase 2 -- Enterprise**: Advanced security features (Rotation, Anomaly, Hardening, RBAC) **Phase 3 -- Advanced**: High-assurance capabilities (MPC Mode, Ledger, Industry) ### Leadership **George Curta** -- Founder & CEO Location: Saarbrucken, Germany Company: curta.solutions (since 1998) Roles: IT Solutions Architect, Head of IT George Curta founded curta.solutions in 1998 and has led IT operations for global organizations across Europe. With experience as IT Solutions Architect and Head of IT in multinational environments, George has designed Zero-Trust security architectures, led teams up to 12 members, and implemented ISO 27001-aligned IT service management at scale. anonym.life represents the culmination of decades of enterprise IT experience, now focused on the single most important challenge: finding and protecting personal data before it spreads through your systems. ### Technology Partners Integrations with the tools you already use: - AWS: KMS Integration - Azure: Key Vault - Google Cloud: KMS Integration - HashiCorp: Vault Integration - Microsoft 365: Compliance Center Implementation Partner: MacXpress IT Consulting (macxpress.net) --- ## Documentation URL: https://anonym.life/docs > Build with anonym.life. Pattern-based PII detection with 317 regex recognizers. Everything you need to integrate privacy-preserving data handling into your applications. ### Getting Started Install the SDK and run your first pattern detection in minutes. ### API Reference Complete reference for detection, transformation, and vault endpoints. ### SDK Libraries Native SDKs for Node.js, Python, Go, Java, and .NET (Beta). Ruby coming soon. ### Recognizers Guide 317 built-in regex patterns plus custom recognizer configuration. ### Core Concepts - **Detection**: Pattern-based PII recognition using 317 regex recognizers with checksum validation. Deterministic, auditable, reproducible. - **Transformation**: Configurable presets to redact, mask, generalize, tokenize, or hash sensitive fields. - **Vault**: Secure storage with envelope encryption and customer-managed keys. - **Distribution**: Route sanitized data to downstream systems while maintaining referential integrity. - **Disclosure**: Time-limited, purpose-bound access to original values when needed. - **Key Management**: Integrate with AWS KMS, Azure Key Vault, GCP KMS, or HashiCorp Vault. ### Quick Example (TypeScript) ```typescript import { AnonymLife } from '@anonym.life/sdk'; const client = new AnonymLife({ apiKey: process.env.ANONYM_API_KEY }); // Detect and transform incoming order data const result = await client.process({ data: { customer_name: "John Doe", email: "john@example.com", phone: "+49 170 1234567", credit_card: "4532015112830366" }, preset: "ecommerce_fulfillment" }); // Detection results (pattern matches): // result.detections = [ // { field: "email", pattern: "EMAIL_ADDRESS", confidence: 1.0 }, // { field: "phone", pattern: "DE_PHONE_NUMBER", confidence: 1.0 }, // { field: "credit_card", pattern: "CREDIT_CARD", checksum: "luhn_valid" } // ] // Transformed output: // result.data = { // customer_name: "tok_abc123", // email: "tok_def456", // phone: "+49 170 ***4567", // credit_card: "************0366" // } ``` ### Support - **API Support**: Technical questions about integration and implementation. - **Security Questions**: Compliance, security assessments, and architecture reviews. - Schedule a Technical Consultation via the contact page. --- ## Resources URL: https://anonym.life/resources > Learn About Privacy Engineering. Explore our knowledge base to understand pseudonymization, compliance requirements, and how anonym.life helps reduce your PII exposure. ### Resource Categories - **Blog**: Insights on privacy engineering, compliance strategies, and industry best practices. - **Case Studies**: Real-world examples of how organizations reduced PII exposure with anonym.life. - **FAQ**: Answers to common questions about anonym.life, pseudonymization, and privacy compliance. - **Glossary**: Privacy and security terminology explained. From pseudonymization to MPC custody. Looking for Technical Documentation? Visit the docs page for API references, integration guides, and SDK information. --- ## Blog URL: https://anonym.life/resources/blog > Privacy Engineering Insights. Practical guidance on pseudonymization, compliance, and building privacy-respecting systems. ### Articles - **What is Pseudonymization? A Practical GDPR Guide**: Pseudonymization is a key GDPR concept, but it's often confused with anonymization. Learn the differences, implementation strategies, and how to apply pseudonymization in your organization. - **5 Signs Your PII is Overexposed**: Is your organization inadvertently spreading sensitive data across too many systems? Here are the warning signs of PII overexposure and what to do about it. - **Tokenization vs Pseudonymization: What's the Difference?**: Both techniques protect sensitive data, but they work differently and serve different purposes. Understand when to use each approach in your privacy architecture. - **Healthcare Privacy Beyond HIPAA: European Requirements**: HIPAA is the US standard, but what about healthcare data in Europe? Explore GDPR requirements and additional considerations for healthcare organizations. - **Key Management Best Practices for Privacy Systems**: Your encryption is only as strong as your key management. Learn enterprise patterns for key rotation, separation of duties, and high-assurance custody. - **GDPR Article 25: Privacy by Design in Practice**: Privacy by design sounds good in principle, but what does it mean for your software architecture? Practical patterns for building privacy into systems from the start. Stay Updated: Get the latest privacy engineering insights delivered to your inbox. --- ## Case Studies URL: https://anonym.life/resources/case-studies > Real Results from Real Organizations. See how organizations across industries have reduced PII exposure and simplified compliance with anonym.life. ### European Logistics Provider **90% Reduction in PII Exposure Across Delivery Network** Implemented anonym.life to pseudonymize customer data before distribution to driver apps, partner systems, and analytics platforms. Delivery drivers receive tokens and relay channels instead of raw contact details. Quote: "anonym.life allowed us to maintain operational efficiency while dramatically reducing our data exposure footprint." Results: Reduction in PII exposure, systems with fewer direct identifiers, reduced compliance audit scope. ### Diagnostic Laboratory Network **Secure Patient Data Handling Across 50+ Partner Clinics** Deployed anonym.life with healthcare-specific presets to separate patient identity from sample processing. Lab systems work with sample tokens; patient re-identification occurs only at referring clinics. Quote: "We can now demonstrate exactly who accessed patient data, when, and for what purpose. This transformed our compliance posture." Results: Audit trail coverage, patient data removed from analytics systems, added processing latency, faster partner onboarding. ### E-commerce Platform **Customer Data Minimization Across Vendor Ecosystem** Integrated anonym.life as middleware between the order management system and vendor APIs. Vendors receive only the data necessary for their function, with full transformation audit trails. Quote: "Our vendors can do their jobs effectively without having access to data they don't need. It's privacy by design in practice." Results: Reduction in vendor PII access, vendors with zero full customer profiles, reduced new vendor integration time, estimated annual risk reduction. ### Research Report: The Paradigm Shift in PII Anonymization **Why Deterministic Hybrid Architectures Outperform LLM-Based Redaction** PDF Download: https://anonym.life/downloads/PII_Anonymization_Case_Study.pdf This research evaluates two fundamentally different approaches to PII anonymization: **Approach 1: LLM-Based Redaction** - Uses Large Language Models (GPT-4, Claude) for PII detection - Probabilistic outputs with variable accuracy - Requires sending data to external AI providers - No guarantee of consistent results across runs **Approach 2: Deterministic Hybrid Architecture** - Combines 317 regex recognizers with NER models - 100% deterministic: same input = same output - All processing stays within controlled infrastructure - Full audit trail showing exactly which pattern matched **Key Research Findings:** | Metric | Result | |--------|--------| | F1 Improvement vs NER Baseline | +82% | | Performance vs Zero-Shot LLMs | +17% better | | Cost Savings per 1M Records | $45M vs breach | | Trust Boundaries Crossed | 0 | | Audit Trail Reproducibility | 100% | **Why Deterministic Wins for Compliance:** 1. **Reproducibility**: Auditors can verify that the same input produces the same output. LLMs cannot guarantee this. 2. **Explainability**: Every detection can be traced to a specific regex pattern or NER rule. No "black box" explanations. 3. **Zero Knowledge**: Data never leaves your control. No third-party AI providers see your PII. 4. **Checksum Validation**: Financial identifiers (credit cards, IBANs) validated mathematically, not probabilistically. 5. **Cost Predictability**: Fixed processing costs vs variable LLM API costs. **Conclusion:** For compliance-critical PII anonymization, deterministic hybrid architectures provide the explainability, reproducibility, and Zero Knowledge guarantees that LLM-based approaches cannot match. The +82% F1 improvement over baseline NER demonstrates that hybrid approaches achieve superior accuracy without sacrificing auditability. Quote: "Organizations face a critical architectural decision: optimize for perceived accuracy with probabilistic LLM approaches, or prioritize the determinism and auditability required for regulatory compliance." --- ## Free Compliance Resources URL: https://anonym.life/resources/whitepapers > Compliance guides and checklists available for immediate download. No email required. ### GDPR Compliance Checklist **50-Point Checklist for GDPR Compliance** (14 pages) Download: https://anonym.legal/resources/pdfs/gdpr-compliance-checklist.pdf A comprehensive checklist covering all 99 GDPR articles organized into 11 sections: - Legal basis for data processing - Data subject rights (access, rectification, erasure, portability) - Consent management - Data mapping and documentation - Privacy notices and transparency - Data protection impact assessments (DPIA) - Cross-border data transfers - Breach notification procedures (72-hour rule) - Data Protection Officer responsibilities - Vendor and processor management - Technical and organizational safeguards Key stat: €4.7 billion in GDPR fines issued to date. 83% to US companies. ### AI Data Leakage Prevention Guide **Protecting Organizations from GenAI Data Exposure** (18 pages) Download: https://anonym.legal/resources/pdfs/ai-data-leakage-prevention.pdf Actionable strategies for preventing data leaks through AI tools: - The Problem: 77% of employees paste sensitive data into GenAI tools - AI channels account for ~33% of all data exfiltration incidents - December 2025 Chrome extension breach exposed 900,000 users What's Covered: - AI acceptable use policy template - 30/60/90 day implementation roadmap - Vendor evaluation criteria - Incident response procedures for AI-related breaches Target Audience: CISOs, Security Directors, IT Leadership, Compliance Officers ### HIPAA Compliance Handbook **Privacy Rule, Security Rule & Breach Notification** (22 pages) Download: https://anonym.legal/resources/pdfs/hipaa-compliance-handbook.pdf Comprehensive guide covering all 18 PHI identifiers defined in 45 CFR 164.514(b)(2): 1. Names 2. Geographic data (street address, city, ZIP) 3. Dates (except year) related to individual 4. Phone numbers 5. Fax numbers 6. Email addresses 7. Social Security numbers 8. Medical record numbers 9. Health plan beneficiary numbers 10. Account numbers 11. Certificate/license numbers 12. Vehicle identifiers 13. Device identifiers and serial numbers 14. Web URLs 15. IP addresses 16. Biometric identifiers 17. Full-face photographs 18. Any other unique identifying characteristic De-Identification Methods: - **Safe Harbor**: Remove or generalize all 18 identifiers - **Expert Determination**: Statistical analysis demonstrating minimal re-identification risk Key stat: Healthcare data breaches average $7.42M annually. 96% of ransomware attacks involve data exfiltration. ### PII Anonymization Case Study **Deterministic vs LLM-Based Detection Benchmarks** (12 pages) Download: https://anonym.legal/resources/pdfs/pii-anonymization-case-study.pdf Research comparing two approaches to PII anonymization: **Approach 1: LLM-Based** - Uses GPT-4, Claude for detection - Probabilistic outputs - Data sent to external providers - No consistent results **Approach 2: Deterministic Hybrid** - 317 regex recognizers + NER - 100% deterministic - All processing in controlled infrastructure - Full audit trail Results: | Metric | Result | |--------|--------| | F1 vs NER Baseline | +82% | | vs Zero-Shot LLMs | +17% better | | Cost Savings | $45M per 1M records | | Trust Boundaries | 0 crossed | | Reproducibility | 100% | --- ## FAQ URL: https://anonym.life/resources/faq > Frequently Asked Questions. Find answers to common questions about anonym.life. ### General **What is anonym.life?** anonym.life is a privacy middleware platform that separates identity data from transaction data. It detects PII in your data flows, transforms it according to configurable policies, vaults the sensitive information securely, and enables controlled disclosure only when necessary. This reduces your breach blast radius and simplifies compliance. **What is the difference between anonymization and pseudonymization?** Anonymization irreversibly removes all identifying information, making re-identification impossible. Pseudonymization replaces direct identifiers with tokens or pseudonyms while keeping the mapping secure and separate. With pseudonymization, authorized parties can still re-identify data when legally required. anonym.life focuses on pseudonymization because most business processes require some level of re-identification capability. **Which industries does anonym.life serve?** We serve any organization handling personal data in regulated environments. Our primary focus areas are healthcare (diagnostics, lab workflows), logistics (food delivery, last-mile), e-commerce (customer data minimization), and payment processing (transaction tokenization). We offer industry-specific presets tailored to each domain. **Is anonym.life a data storage solution?** No, anonym.life is middleware, not storage. We integrate between your data sources and downstream systems to transform and control PII flow. The vault component stores only the mappings and tokens needed for controlled disclosure -- your actual business data remains in your existing systems. ### Technology **How does PII detection work?** We use Microsoft Presidio as our detection engine, enhanced with custom recognizers for industry-specific data types. The system identifies entities like names, addresses, phone numbers, emails, and national IDs with confidence scoring. You can configure thresholds per preset -- stricter for healthcare, more flexible for less sensitive workflows. **What transformation methods are available?** anonym.life supports multiple transformation methods: redaction (complete removal), masking (partial hiding like j***@email.com), generalization (city instead of full address), tokenization (reversible replacement), and encryption-to-recipient (only specific parties can decrypt). Each preset defines which method applies to which data type. **How is key management handled?** We support two modes: Enterprise baseline uses envelope encryption with your own KMS/HSM (AWS KMS, Azure Key Vault, HashiCorp Vault). High-assurance mode uses threshold/MPC cryptography where decryption requires M-of-N parties, ensuring no single entity can access data alone. **What about false positives and negatives in detection?** Automated detection is not perfect. Our system uses confidence gating -- low-confidence detections default to minimize/mask rather than pass-through. We provide privacy regression testing and optional human-in-the-loop review for high-risk workflows. You tune thresholds based on your risk tolerance. ### Compliance **How does anonym.life help with GDPR compliance?** anonym.life supports GDPR principles through: data minimization (downstream systems receive only necessary data), purpose limitation (disclosure tied to declared purposes), storage limitation (configurable retention schedules), and accountability (immutable audit logs). We help reduce scope and effort, but governance obligations remain with you as the controller. **Do you provide audit logs?** Yes. Every detection, transformation, and disclosure event is logged immutably. Logs include timestamps, policy versions, requester identity, purpose declarations, and disclosed attributes. Optional ledger anchoring provides tamper-evident proof for high-assurance scenarios. Logs can be exported for external audits and DPIAs. **What certifications does anonym.life have?** We are on the ISO 27001 certification pathway and preparing for SOC 2 Type II. Our infrastructure runs on certified cloud providers (AWS) within EU regions. Contact us for our current security documentation and compliance roadmap. **Can anonym.life handle cross-border data transfers?** Yes. By minimizing PII before it reaches downstream systems or vendors, anonym.life can help reduce the compliance burden of cross-border transfers. However, you remain responsible for ensuring appropriate legal mechanisms (SCCs, adequacy decisions) are in place for any remaining personal data flows. ### Integration **How do I integrate anonym.life with my systems?** Integration is via REST APIs, webhooks, or SDKs. anonym.life sits between your data sources and downstream consumers. You route data through our endpoints, specifying the preset to apply. Sanitized objects flow to your downstream systems. We provide integration guides for common platforms and patterns. **What data formats are supported?** We support JSON payloads (structured data), text content (unstructured), and can be extended for specific formats. The detection engine handles both structured fields and free-text content. Image OCR pipeline is available for document processing workflows. **Can I customize the presets?** Yes. While we provide industry-specific presets out of the box, you can customize detection thresholds, transformation rules, disclosure policies, retention schedules, and audit requirements. Enterprise customers can create fully custom presets for unique workflows. **What is the latency impact?** Detection and transformation typically add single-digit milliseconds for standard payloads. We optimize for streaming scenarios and support async processing for batch workloads. Exact latency depends on payload size, complexity, and chosen transformations. ### Pricing & Support **How is pricing structured?** Pricing is based on transaction volume and features required. We offer Starter, Professional, and Enterprise tiers. Contact our sales team for detailed pricing information tailored to your specific needs and volume. **Is there a free trial?** Yes, we offer a trial period for qualified organizations to evaluate anonym.life with their own data flows. Contact us to discuss trial parameters and setup. **What support is included?** Support tiers vary by plan: Starter includes email support, Professional adds priority support with faster response times, and Enterprise includes dedicated customer success management, custom training, and SLA guarantees. --- ## Glossary URL: https://anonym.life/resources/glossary > Privacy & Security Glossary. Key terms and concepts in privacy engineering explained. ### Terms **Anonymization**: The irreversible process of modifying data so that individuals cannot be identified, directly or indirectly. Unlike pseudonymization, anonymized data is no longer considered personal data under GDPR. Related: Pseudonymization, Personal Data. **Audit Log**: An immutable record of all system activities including data access, transformations, and disclosures. Essential for compliance demonstration and security investigations. Related: Immutability, Disclosure. **Breach Blast Radius**: The scope of impact when a data breach occurs. By minimizing PII in downstream systems, anonym.life reduces the blast radius -- fewer systems with sensitive data means less exposure when any single system is compromised. Related: PII, Data Minimization. **Confidence Score**: A numerical value (0-1) indicating how certain the detection engine is that identified text is actually PII. Higher thresholds reduce false positives but may miss some PII; lower thresholds catch more but increase false positives. Related: Detection, False Positive. **Data Controller**: Under GDPR, the entity that determines the purposes and means of processing personal data. The controller bears primary responsibility for compliance. Related: Data Processor, GDPR. **Data Minimization**: A GDPR principle requiring that personal data collected and processed should be adequate, relevant, and limited to what is necessary for the specified purposes. Related: GDPR, Purpose Limitation. **Data Processor**: Under GDPR, an entity that processes personal data on behalf of the controller. Processors must follow controller instructions and implement appropriate security measures. Related: Data Controller, DPA. **DEK (Data Encryption Key)**: The key used to encrypt actual data. In envelope encryption, DEKs are themselves encrypted by a KEK, allowing key rotation without re-encrypting all data. Related: KEK, Envelope Encryption. **Detection**: The process of identifying PII entities within data. anonym.life uses Microsoft Presidio with custom recognizers to detect names, addresses, phone numbers, emails, and other sensitive information. Related: Recognizer, Confidence Score. **Direct Identifier**: Information that can directly identify an individual without additional data, such as name, social security number, or email address. Related: Quasi-Identifier, PII. **Disclosure**: The controlled reveal of previously pseudonymized or masked data to an authorized party. In anonym.life, disclosures are purpose-bound, time-limited, and fully audited. Related: Selective Disclosure, JIT Access. **DPA (Data Processing Agreement)**: A legally binding contract between a data controller and processor that specifies data processing terms, security requirements, and compliance obligations under GDPR. Related: Data Controller, Data Processor. **DPIA (Data Protection Impact Assessment)**: A process to identify and minimize data protection risks for processing activities likely to result in high risk to individuals. Required under GDPR Article 35 for certain processing types. Related: GDPR, Risk Assessment. **Envelope Encryption**: A key management pattern where data is encrypted with a DEK, and the DEK is encrypted with a KEK stored in a KMS/HSM. This allows efficient key rotation and centralized key management. Related: DEK, KEK, KMS. **False Positive**: When the detection system incorrectly identifies non-PII as PII. High false positive rates can disrupt workflows by over-masking legitimate data. Related: False Negative, Confidence Score. **False Negative**: When the detection system fails to identify actual PII. False negatives are more dangerous than false positives as they allow sensitive data to pass through unprotected. Related: False Positive, Detection. **Generalization**: A transformation technique that replaces specific values with more general ones. For example, replacing a full address with just the city, or an exact age with an age range. Related: Masking, Transformation. **GDPR**: General Data Protection Regulation. The EU regulation governing personal data protection and privacy, effective since May 2018. Sets requirements for lawful processing, data subject rights, and breach notification. Related: Data Controller, Data Minimization, Pseudonymization. **HSM (Hardware Security Module)**: A physical computing device that safeguards cryptographic keys and provides secure cryptographic processing. Used in high-assurance scenarios for key protection. Related: KMS, Key Management. **Immutability**: The property of data that cannot be changed after creation. Immutable audit logs provide tamper-evident records essential for compliance and forensics. Related: Audit Log, Ledger Anchoring. **JIT Access (Just-In-Time)**: A security pattern where access is granted only when needed, for a limited time, with specific scope. Reduces standing privileges and exposure window. Related: Disclosure, Least Privilege. **KEK (Key Encryption Key)**: A key used to encrypt other keys (DEKs). Stored in KMS/HSM, allowing centralized key management, rotation, and access control. Related: DEK, Envelope Encryption. **Key Management**: The administration of cryptographic keys including generation, storage, rotation, and revocation. Critical for maintaining data security and compliance. Related: KMS, HSM, Envelope Encryption. **KMS (Key Management Service)**: A cloud service for creating and managing cryptographic keys. Examples include AWS KMS, Azure Key Vault, and Google Cloud KMS. Related: HSM, Key Management. **Ledger Anchoring**: The practice of recording hashes of audit events to a tamper-evident ledger (blockchain or similar). Provides cryptographic proof of audit log integrity. Related: Audit Log, Immutability. **Least Privilege**: A security principle stating that entities should have only the minimum access necessary to perform their functions. Reduces risk from compromised accounts or insider threats. Related: JIT Access, Data Minimization. **Masking**: A transformation technique that partially hides data while preserving format. For example, showing only the last four digits of a phone number: ***-***-1234. Related: Redaction, Transformation. **MPC (Multi-Party Computation)**: A cryptographic technique allowing multiple parties to jointly compute a function over their inputs while keeping those inputs private. Used in threshold key management where no single party can decrypt alone. Related: Threshold Cryptography, Key Management. **Personal Data**: Under GDPR, any information relating to an identified or identifiable natural person. Includes direct identifiers and any data that could be combined to identify someone. Related: PII, Direct Identifier, Quasi-Identifier. **PII (Personally Identifiable Information)**: Information that can be used to identify, contact, or locate an individual. Includes names, addresses, phone numbers, email addresses, and identification numbers. Related: Personal Data, Direct Identifier. **Preset**: In anonym.life, a policy package that defines detection thresholds, transformation rules, disclosure policies, retention schedules, and audit requirements for a specific use case or industry. Related: Policy, Transformation. **Presidio**: Microsoft's open-source PII detection and anonymization engine. anonym.life uses Presidio as its core detection layer, extended with custom recognizers. Related: Detection, Recognizer. **Pseudonymization**: Processing personal data so that it can no longer be attributed to a specific individual without additional information, kept separately and securely. Unlike anonymization, pseudonymization is reversible. Related: Anonymization, Tokenization, GDPR. **Purpose Limitation**: A GDPR principle requiring that personal data be collected for specified, explicit purposes and not processed in ways incompatible with those purposes. Related: GDPR, Data Minimization. **Quasi-Identifier**: Information that alone may not identify an individual but can do so when combined with other data. Examples include zip code + birth date + gender combinations. Related: Direct Identifier, Re-identification. **Recognizer**: A component in the detection engine that identifies specific PII types. Can use patterns (regex), NLP models, or checksum validation. Custom recognizers can be created for domain-specific data. Related: Detection, Presidio. **Redaction**: A transformation technique that completely removes PII from data, replacing it with a placeholder or nothing at all. The most aggressive transformation method. Related: Masking, Transformation. **Re-identification**: The process of linking pseudonymized or de-identified data back to specific individuals. anonym.life controls re-identification through authorized disclosure with full audit trails. Related: Pseudonymization, Disclosure. **Sanitized Object**: The output payload after PII detection and transformation. Contains only the data necessary for downstream processing, with sensitive information removed or protected. Related: Transformation, Data Minimization. **Selective Disclosure**: The ability to reveal only specific attributes of pseudonymized data to authorized parties, rather than full records. Enables purpose-bound, minimal data access. Related: Disclosure, Least Privilege. **Threshold Cryptography**: A cryptographic scheme where a secret is divided into shares, and a minimum number of shares (threshold) must combine to perform operations. Used for distributed key management. Related: MPC, Key Management. **Tokenization**: Replacing sensitive data with non-sensitive tokens that can be mapped back to the original data through a secure lookup. Tokens preserve data format without exposing actual values. Related: Pseudonymization, Transformation. **Transformation**: The process of converting PII into protected forms. Methods include redaction, masking, generalization, tokenization, and encryption. Related: Masking, Tokenization, Redaction. **Vault**: In anonym.life, the secure storage component that holds mappings, token tables, encrypted PII blobs, and policy receipts. The vault enables controlled re-identification. Related: Tokenization, Disclosure. --- ## Integrations URL: https://anonym.life/integrations > Integration with your existing tools and infrastructure. ### Cloud KMS Integrations - AWS KMS - Azure Key Vault - Google Cloud KMS - HashiCorp Vault ### Platform Integrations - Microsoft 365 Compliance Center ### Implementation Partner MacXpress IT Consulting (macxpress.net) --- ## Privacy Policy URL: https://anonym.life/privacy > Privacy Policy. Last updated: February 1, 2026. ### Our Commitment to Privacy As a privacy-focused company, we practice what we preach. We collect only what's necessary to provide our services and protect your data with the same standards we help our customers achieve. ### Data Controller curta.solutions GmbH Karl-Leidinger-Strasse 13 66130 Saarbrucken, Germany ### Data We Collect **Website Visitors**: Contact form submissions (name, email, company, message); Demo request information; Cookie data (with consent) for analytics. **Customers**: Account information (name, email, company); Billing information; Usage logs and API access data; Support communications. ### How We Use Your Data - To provide and maintain our services - To respond to inquiries and support requests - To send service-related communications - To improve services and develop new features - To comply with legal obligations ### Legal Basis (GDPR Article 6) Contract performance, Legitimate interests, Consent, Legal obligation. ### Data Sharing We do not sell your personal data. We may share data with: - Cloud infrastructure providers (AWS, within EU) - Payment processors (Stripe) - Analytics services (Plausible -- privacy-focused, EU-hosted) - Legal authorities when required by law ### Data Retention - Contact form data: Deleted after inquiry is resolved (max 2 years) - Customer account data: Duration of contract + 7 years (legal requirement) - Analytics data: 26 months - Audit logs: As specified in customer contracts ### Your Rights (GDPR) Access, Rectification, Erasure, Restriction, Portability, Object, Withdraw consent. ### Security Appropriate technical and organizational measures including encryption at rest and in transit, access controls, and regular security assessments. ### Contact & Complaints Contact via the contact form. Right to lodge a complaint with the Unabhangiges Datenschutzzentrum Saarland (UDZ). --- ## Terms of Service URL: https://anonym.life/terms > Terms of Service. Last updated: February 1, 2026. ### Description of Services anonym.life provides privacy middleware services including: - PII detection and classification - Data transformation and tokenization - Secure vault storage with encryption - Controlled disclosure mechanisms - Audit logging and compliance tools ### Account Registration Requires: Accurate registration information, secure account credentials, prompt notification of unauthorized access, minimum age of 18. ### Acceptable Use Users agree not to: Use services for illegal purposes, bypass security measures, reverse engineer software, transmit malware, interfere with other users, process data in violation of applicable laws. ### Data Processing - You remain the data controller for your customer data - anonym.life acts as data processor on your behalf - Data Processing Agreement governs the relationship - You are responsible for ensuring lawful basis for processing ### Fees and Payment - Fees based on selected plan and usage - All fees in EUR unless otherwise specified - Invoices due within 30 days - 30 days notice for fee changes - Non-payment may result in service suspension ### Service Level Agreement - Starter: 99.5% monthly uptime - Professional: 99.9% monthly uptime - Enterprise: 99.99% monthly uptime (with SLA credits) ### Intellectual Property Services owned by anonym.life GmbH. Users receive limited, non-exclusive license. Users retain all rights to their own data. ### Limitation of Liability - Not liable for indirect, incidental, or consequential damages - Total liability limited to fees paid in preceding 12 months - Not liable for data losses caused by user actions or third parties ### Termination - Users may terminate at any time - 30 days notice for breach-related termination - 30 days to export data after termination - Data deleted 90 days after termination ### Governing Law Laws of Germany. Disputes resolved in courts of Saarbrucken, Germany. --- ## Cookie Policy URL: https://anonym.life/cookies > Cookie Policy. Last updated: February 1, 2026. ### Privacy-First Approach We minimize cookie usage and use privacy-focused analytics (Plausible) that doesn't require cookie consent banners for basic functionality. ### Cookies We Use **Essential Cookies (Required)**: - session_id: User session management (Session duration) - csrf_token: Security / form protection (Session duration) - cookie_consent: Remember cookie preferences (1 year) **Analytics (Optional)**: We use Plausible Analytics, a privacy-focused alternative to Google Analytics. Plausible is cookie-free and doesn't collect personal data, so it doesn't require consent under GDPR. No cookies set -- Plausible uses anonymous, aggregate data only. **Marketing Cookies**: We do not use marketing or advertising cookies. We do not serve ads or track you across other websites. --- ## Data Processing Agreement URL: https://anonym.life/dpa > Data Processing Agreement. Standard Contractual Clauses for GDPR Compliance. ### Pre-Signed DPA Available Professional and Enterprise customers can request a pre-signed DPA. Our standard DPA includes EU Standard Contractual Clauses (SCCs) and meets GDPR Article 28 requirements. ### Subject Matter and Duration The Processor will process Personal Data for the purpose of providing the anonym.life Services as described in the Terms of Service. Processing continues for the duration of the service agreement. Categories of Data Subjects: Your customers and end users; Your employees and contractors; Other individuals whose data you process through our Services. ### Processor Obligations - Process Personal Data only on documented instructions from the Controller - Ensure persons authorized to process have committed to confidentiality - Implement appropriate technical and organizational security measures - Assist the Controller in responding to data subject requests - Make available all information necessary to demonstrate compliance - Delete or return all Personal Data at the end of the service agreement ### Security Measures **Technical Measures**: AES-256 encryption at rest; TLS 1.3 encryption in transit; Customer-managed encryption keys; Regular security assessments. **Organizational Measures**: Access control policies; Employee training; Incident response procedures; Regular compliance audits. ### Sub-processors | Sub-processor | Purpose | Location | |---|---|---| | Amazon Web Services (AWS) | Cloud infrastructure | EU (Frankfurt) | | Stripe | Payment processing | EU/US (SCCs) | 30 days notice for any intended changes to sub-processors. ### International Transfers Data processed within the European Economic Area (EEA). For transfers outside the EEA: EU Standard Contractual Clauses (SCCs); Adequacy decisions by the European Commission; Binding Corporate Rules where applicable. ### Data Subject Rights The Processor will assist the Controller in responding to requests from data subjects to exercise their rights under GDPR, including access, rectification, erasure, restriction, portability, and objection. ### Breach Notification Notification within 48 hours of becoming aware of a Personal Data breach, providing all information necessary for the Controller to fulfill its notification obligations. ### Audit Rights The Controller has the right to audit compliance with this DPA. The Processor will make available relevant certifications, audit reports (e.g., SOC 2), and allow on-site inspections with reasonable notice (Enterprise plans). --- ## Impressum URL: https://anonym.life/impressum > Impressum. Legal Disclosure according to Paragraph 5 TMG. ### Service Provider George Curta ### Contact anonym.life/contact ### VAT Identification Number USt-IdNr.: DE237786404 ### Responsible for Content George Curta (according to Paragraph 55 Abs. 2 RStV) ### Liability for Content As a service provider, we are responsible for our own content on these pages according to Paragraph 7 Abs.1 TMG. According to Paragraphs 8 to 10 TMG, however, we are not obligated as a service provider to monitor transmitted or stored third-party information or to investigate circumstances that indicate illegal activity. Obligations to remove or block the use of information under general law remain unaffected. However, liability in this regard is only possible from the point in time at which we become aware of a specific legal violation. Upon notification of corresponding violations, we will remove this content immediately. ### Liability for Links Our offer contains links to external websites of third parties, on whose contents we have no influence. Therefore, we cannot assume any liability for these external contents. The respective provider or operator of the pages is always responsible for the contents of the linked pages. The linked pages were checked for possible legal violations at the time of linking. Illegal contents were not recognizable at the time of linking. However, permanent monitoring of the content of the linked pages is not reasonable without concrete evidence of a violation of the law. Upon notification of violations, we will remove such links immediately. ### Copyright The content and works created by the site operators on these pages are subject to German copyright law. Duplication, processing, distribution, or any form of commercialization of such material beyond the scope of the copyright law shall require the prior written consent of its respective author or creator. Downloads and copies of this site are only permitted for private, non-commercial use. Insofar as the content on this site was not created by the operator, the copyrights of third parties are respected. In particular, third-party content is marked as such. Should you nevertheless become aware of a copyright infringement, please inform us accordingly. Upon notification of violations, we will remove such content immediately. ### Partner MacXpress IT Consulting (macxpress.net) --- ## AI Safety URL: https://anonym.life/ai-safety > Detect PII in AI Prompts Before It Leaves Your Control. 317 regex recognizers intercept sensitive data in real-time. Pattern-based detection stops data leaks automatically before they reach ChatGPT, Claude, or any AI provider. ### The Problem Your Data Is Already in AI Systems. Every prompt containing customer data, employee info, or business secrets is stored and potentially used for training. - **Data Retention**: AI providers store prompts for up to 30 days. Some use data for model training unless you opt out. 68% of companies affected. - **Employee Usage**: Employees use AI tools daily, often pasting customer emails, support tickets, and internal documents. 45% paste PII weekly. - **Breach Cost**: Average cost of a data breach in 2025 is EUR 4.3M. AI-related breaches often involve larger datasets. ### The Solution Anonymize Before Sending. Strip PII from prompts before they reach AI providers. Get the same AI assistance without the compliance risk. 1. **Paste Your Text** - Input documents, emails, or support tickets 2. **Detect PII** - 317 recognizers find names, addresses, IDs automatically 3. **Anonymize** - Replace PII with tokens: [PERSON_1], [ADDRESS_1] 4. **Send to AI** - AI sees anonymized text, responds normally ### MCP Server Integration Native AI Tool Integration. Our MCP Server integrates directly with Claude Desktop and Cursor. Automatic anonymization on every prompt. - Zero Workflow Change - Works automatically in your AI tools - Automatic Detection - 317 recognizers scan every prompt - Developer Friendly - Simple JSON configuration - Pro Tier Feature - Available on Pro and Business plans ### Use Cases - **Customer Support**: Summarize tickets, draft responses, analyze sentiment - without exposing customer PII. - **Development**: Debug code, write documentation, review PRs - keep API keys and credentials private. - **Legal & HR**: Review contracts, draft policies, analyze documents - protect employee and client information. --- ## Detection Accuracy URL: https://anonym.life/accuracy > How We Achieve High-Precision PII Detection. 317 regex recognizers with checksum validation. NER models for named entities. Confidence scoring for every match. ### Key Metrics - **317** Regex Recognizers - **100%** Regex Accuracy (pattern matches are deterministic) - **0-100%** Confidence Scores (context-aware scoring) ### Hybrid Detection Approach Not regex-only. Not ML-only. The best of both. **Regex Layer (First Pass)** - 100% accuracy for structured patterns - Credit cards with Luhn validation - IBANs with country-specific checksum - Emails, phones, IDs, SSNs, passports - Note: Regex finds patterns, not meaning **NER Layer (Second Pass)** - 85-95% accuracy for named entities - Person names, organization names - Locations, dates, medical terms - Context-aware disambiguation - spaCy (25 languages), Stanza (7), XLM-RoBERTa (16) ### Entity Accuracy by Type **Structured Data (100% when valid format)** - Credit Cards: Regex + Luhn checksum - IBANs: Regex + country-specific checksum - Emails: RFC 5322 compliant regex - Phone Numbers: E.164 format validation **Named Entities (85-95% typical)** - Person Names: spaCy NER, context scoring - Organizations: NER + business suffix patterns - Locations: NER + geocoding validation **National IDs (95-100%)** - German: Personalausweis, Reisepass, Steuer-ID - French: INSEE, Carte Nationale - Spanish: DNI, NIE, NIF - And 72 more countries ### Confidence Scoring Every detection includes a confidence score (0-100%) based on: - Pattern match strength - Checksum validation (if applicable) - Context analysis (surrounding words) - Historical accuracy for entity type ### False Positive Mitigation - **Checksum Validation**: Mathematical proof, not just pattern - **Context Analysis**: "Email:" before pattern boosts confidence - **Confidence Threshold**: Configurable minimum (default 70%) - **Allowlist**: Exclude known-safe patterns ### Multilingual Support - **67 Languages** supported for UI and detection - **4 RTL Languages** (Arabic, Hebrew, Persian, Urdu) with full right-to-left UI support - **38 OCR Languages** for document processing - spaCy (25 languages at 95%+), Stanza (7 at 90%+), XLM-RoBERTa (16 at 85%+) --- ## vs DIY Presidio URL: https://anonym.life/compare/presidio > 317 Recognizers vs Build-Your-Own. anonym.life is built on Presidio but handles all the infrastructure, scaling, and maintenance. Same detection, none of the DevOps. ### The Hidden Costs of DIY Presidio Self-hosting Microsoft Presidio sounds free until you count the real costs: - **Infrastructure**: Kubernetes, load balancers, NER model hosting, GPU for spaCy/Stanza - **Engineering**: 3-6 months to production-ready, ongoing maintenance - **Compliance**: You own the audit trail, encryption, key management - **Scaling**: Handle traffic spikes, model updates, security patches ### Comparison | Aspect | DIY Presidio | anonym.life | |--------|--------------|-------------| | Setup Time | 3-6 months | 5 minutes | | Infrastructure | You manage | We manage | | Recognizers | ~50 built-in | 317 + custom | | NER Models | You host GPUs | Included | | Key Management | You build | AWS/Azure/GCP KMS | | Audit Trail | You build | Built-in | | Compliance | You certify | ISO 27001 certified | | Support | GitHub issues | Dedicated support | ### Total Cost of Ownership **DIY Presidio (Annual)** - Infrastructure: EUR 20,000-50,000 - Engineering: EUR 80,000-150,000 - Compliance: EUR 10,000-30,000 - Total: EUR 110,000-230,000/year **anonym.life (Annual)** - Pro: EUR 180/year - Business: EUR 348/year - Enterprise: Custom - Savings: 80-90%+ ### What You Get with anonym.life - 317 regex recognizers (vs ~50 in Presidio) - 3 NER engines pre-configured (spaCy, Stanza, XLM-RoBERTa) - Zero Knowledge encryption with your KMS - Full audit trail for compliance - 67 language support with RTL - 100% EU infrastructure ### Migration Guide Already using Presidio? Migration is straightforward: 1. Export your custom recognizers 2. Import via anonym.life API 3. Update API endpoints 4. Verify detection parity 5. Sunset your infrastructure --- ## vs Private AI URL: https://anonym.life/compare/private-ai > 317 Deterministic Patterns vs ML Black Box. When compliance requires explainability, pattern-based detection wins. ### Detection Approach Comparison **Private AI (ML-Based)** - Transformer models detect PII - Probabilistic confidence scores - Requires GPU infrastructure - Model retraining for new patterns - Black box: cannot explain why **anonym.life (Pattern-Based)** - 317 regex recognizers + 3 NER engines - Deterministic pattern matching - CPU-only for regex layer - Add patterns in minutes - Full explainability: show the regex ### Key Differences | Aspect | Private AI | anonym.life | |--------|------------|-------------| | Detection | ML transformers | Regex + NER hybrid | | Determinism | Probabilistic | 100% deterministic | | Explainability | Black box | Pattern visible | | Accuracy | Model-dependent | 100% for regex patterns | | New Patterns | Retrain model | Add regex in minutes | | Infrastructure | GPU required | CPU for regex | | Zero Knowledge | No | Yes (BYOK) | | EU-Only | No | Yes (Hetzner DE) | ### Why Patterns Win for Compliance 1. **Audit Trail**: Show exactly which pattern matched which text 2. **Reproducibility**: Same input = same output, always 3. **Speed**: Regex runs in microseconds, no ML inference 4. **Customization**: Add industry-specific patterns instantly 5. **No Training Data**: Patterns work from day one ### When to Choose Each **Choose Private AI if:** - You need entity resolution (linking mentions) - Free-text classification is primary use case - You have GPU infrastructure **Choose anonym.life if:** - Compliance requires explainability - You need deterministic results - You want Zero Knowledge encryption - EU data residency is required - You need fast time-to-value --- ## vs VGS URL: https://anonym.life/compare/vgs > 317 Auto-Detecting Patterns vs Manual Field Mapping. Why discover PII automatically instead of defining fields one by one? ### Core Difference **VGS (Manual Field Mapping)** - Define which fields contain PII - Configure each field individually - Works well for structured payment data - You must know where PII exists **anonym.life (Auto-Detection)** - 317 regex recognizers scan all content - Find PII you did not know existed - Works on structured and unstructured data - Discovery-first approach ### Use Case Comparison | Use Case | VGS | anonym.life | |----------|-----|-------------| | Payment Fields | Excellent | Good | | Free-Text Fields | Manual | Automatic | | Multi-Source Data | Per-source config | Universal detection | | PII Discovery | No | Yes | | Unstructured Docs | Limited | Full support | ### Feature Comparison | Feature | VGS | anonym.life | |---------|-----|-------------| | PCI DSS Focus | Primary | Supported | | Auto-Detection | No | 317 regex recognizers | | NER Support | No | Yes (3 engines) | | Free-Text | Manual tokenization | Auto-detection | | Discovery Mode | No | Yes | | Pricing | Per-operation | Token-based | | EU Infrastructure | Partial | 100% EU | | Zero Knowledge | Partial | Full BYOK | ### When to Choose Each **Choose VGS if:** - PCI DSS compliance is primary goal - You process structured payment data only - You know exactly which fields contain PII - You need established payment processor integrations **Choose anonym.life if:** - You have free-text fields (support tickets, notes, comments) - PII exists in multiple systems - You need to discover unknown PII - EU data residency is required - You want transparent pricing