Anonymise
Send the meaning. Keep the identity.
How it works
Four steps, all inside a single round trip.
Detect
Before send. Rule packs and detection engines identify the sensitive spans in the outbound request — names, account numbers, client references, credentials.
Tokenise
Swap, don't strip. Each identifier is replaced with a stable token for that request, so the model still understands that two mentions refer to the same thing. Meaning survives; identity doesn't leave.
Restore
On the way back. Real values are substituted back into the reply from an in-memory map before it reaches your application. What your staff read is the answer they expected.
Destroy
No key, ever. The token map is built per request and destroyed on every exit path. There is no persistent A/D key, nothing to store, and nothing to escrow.
Why this matters
This is pseudonymisation under UK GDPR Article 4(5). You remain the controller of the data throughout, and CattleGrid never holds a re-identification key you did not already have. A redacted payload also sends fewer tokens upstream, so the compliance control quietly reduces your provider bill.
Rule packs
Detection is only as good as what it recognises. Packs ship ready to run, and you can write your own.
UK PII
GDPR pack. National Insurance and NHS numbers, postcodes, +44 phone numbers, email addresses, passport numbers. Included in every tier.
Financial
FCA-facing. Card numbers, sort codes, bank account numbers, SWIFT/BIC. For firms whose exposure is transactional.
Legal
SRA-facing. Client references and matter identifiers, for firms where confidentiality is a professional duty rather than a preference.
API keys and secrets
Credentials. Common API-key patterns and AWS access keys — the material most often pasted into an AI tool by accident.
Salesforce
CRM records. Object and record identifiers, for teams whose customer data lives in Salesforce.
Write your own
Rule generator. Where your exposure is specific to your organisation — internal project names, customer codes — author your own packs, linted and versioned, and test them on the rule bench before they go anywhere near live traffic.
Documents too
The same controls, applied to what your staff upload rather than what they type.
Formats
PDF, Word, Excel, OpenDocument, RTF. Files are extracted, inspected against your rules, and discarded. There is no document store.
Coverage
Every route. Including provider file-upload paths such as OpenAI file_data and Gemini inline_data, so an upload cannot slip past by taking a different road.
Fail-closed
STRICT mode. If A/D cannot complete safely, the request does not proceed. The safe answer is the default, not a setting you have to remember.
Allowance
In every tier. A monthly A/D allowance is included at every level, and additional usage credit can be purchased at any time. You pay for how much you use it, never per seat.
Context-aware, not just pattern-matching. Proximity matching means a number that looks like a sort code is treated as one when it sits beside an account number, and left alone when it doesn't. Detection runs across the rule-pack engine and context-aware regex packs, so the packs catch what plain patterns miss.
Redaction is still there when you want it. Where restoring a value serves no purpose, REDACT and REMOVE do the simpler job, with a maximum-removal threshold that escalates to a block if a request turns out to be more sensitive than it first appeared.
Preview before you enforce. Run a rule in preview mode and see exactly what it would have caught, on your own traffic, before it changes anything for your staff.
Every A/D event is audited — what was tokenised, which rule fired, when, and by whom — without the audit log ever holding the sensitive value itself. See Audit & Compliance for how those records are sealed and verified.