RAG · Fine-tuning · AI Act data governance
Anonymize documents before they feed your AI projects
Company AI projects run on documents: contracts indexed for a retrieval-augmented (RAG) assistant, support tickets used to fine-tune a model, case files loaded into an internal knowledge base. Any of them may contain personal data, and once it has become vectors in an index or weights in a model it is far harder to find, correct or erase than in the original folder.
Anonimatum Pro from €19.90/month, VAT included.
Anonimatum cleans the corpus before ingestion. Batch processing on EU servers handles hundreds of PDF, Office and ZIP files with a single configuration, and the REST API lets you make the same step part of your data pipeline. Where the AI still needs to tell people apart, pseudonymization replaces them with consistent tokens or realistic substitutes: relationships survive, identities do not.
The EU AI Act requires providers of high-risk systems to apply data governance to training, validation and test data, and the GDPR still covers everything else. Anonimatum detects with its own models, without sending your corpus to external LLM APIs. Individual professionals outside Spain can start on Anonimatum Pro online; for teams and API access, contact us.
From raw documents to an AI-ready corpus
- 1
Define the policy
Decide per project what must go (names, contact details, identifiers, bank data) and what the model needs to keep, such as dates, amounts or product names.
- 2
Choose redaction or pseudonymization
Redact for shared or public knowledge bases; use tokens such as NAME_1 or realistic substitutes when the AI must follow who is who.
- 3
Process in batch or via API
Upload ZIP files to the server queue or call the REST API from your ingestion job, with the same patterns and word sets for every file.
- 4
Sample and keep the map apart
Spot-check results in the preview before indexing, and store the equivalence map outside the AI system with restricted access.
Fictitious document
Before and after: a support ticket for a knowledge base
Fictitious ticket prepared for a RAG assistant. Customer and agent become consistent tokens, the account number is partially masked and the technical content is untouched.
Ticket #48213 · Product: Router X200 · Priority: high
Customer: Jean Dupont, account FR-559201
Agent: Laura Bianchi
Jean Dupont reports that the router reboots every night at 02:00.
Firmware 4.2.1 installed; the fault started after the update.
Workaround: disable automatic channel selection.
Follow-up sent to j.dupont@example-mail.eu.
Ticket #48213 · Product: Router X200 · Priority: high
Customer: NAME_1, account FR-55****
Agent: NAME_2
NAME_1 reports that the router reboots every night at 02:00.
Firmware 4.2.1 installed; the fault started after the update.
Workaround: disable automatic channel selection.
Follow-up sent to EMAIL_001.
Tokens keep the same customer recognizable throughout the ticket without identifying them; product, firmware and fix stay because they are what the assistant needs to learn.
Why clean the data before the AI sees it
Easier than deleting later
Removing a person from an index or a fine-tuned model is hard. Keeping personal data out of the corpus is the simplest way to respect erasure and data minimization.
Consistent within each document
The same original always gets the same substitute within a document, so the model learns relationships rather than identities.
Pipeline-ready
Batch queues and the REST API fit into ingestion jobs, so anonymization becomes an automatic step in the pipeline, not a manual chore before each upload.
No third-party LLM in the loop
Detection runs on Anonimatum's own models on EU servers, so preparing the corpus does not create a new transfer to an external AI provider.
Anonymizing documents for AI: frequently asked questions
Should I anonymize or pseudonymize data for RAG?
If the knowledge base will be used by many people or exposed to customers, redact. If an internal assistant must follow a case across documents, pseudonymize with consistent substitutes and keep the equivalence map outside the AI system. Remember that pseudonymized data is still personal data under the GDPR.
Does this make my AI project compliant with the AI Act?
No tool can do that on its own. The AI Act requires appropriate data governance for the training, validation and test data of high-risk systems; removing or pseudonymizing personal data is one measure within it, which you document alongside your other controls.
Can I automate it?
Yes. The REST API, available in the enterprise plan, lets your pipeline submit documents and retrieve the processed results. For one-off corpora, ZIP files in the server batch queue are usually enough.
Which formats can go into the corpus?
PDF (including scanned pages, with OCR), Word, Excel, PowerPoint, OpenDocument and ZIP archives. Results come back in their original format, ready for your own chunking and embedding.
Is this the same as anonymizing a file before pasting it into ChatGPT?
Same engine, different scale. Pasting one document into a chatbot is an individual task; feeding an AI project means hundreds of documents, a repeatable policy and traceability, which is what batch processing, the API and shared configurations are for.
Build your AI on clean data
Outside Spain, individuals can start with Anonimatum Pro online at €19.90 per month or €199 per year (VAT included). For team projects, batch volumes or API access, tell us about your corpus.
Get AnonimatumNot in Spain?