On this page
I was recently using AI to process client data, and the client was clear: sensitive information should not be sent to AI servers. But when I went looking for de-identification tools, I hit a wall—Taiwan’s PII formats (national ID numbers, local phone numbers, tax IDs) aren’t supported by any existing tool.
So I combined an open-source library with local adaptations and built pii-guard-tw. It automatically replaces PII in your documents with placeholders, lets you send the sanitized version to AI for processing, and then restores the original data afterward. Your real data never leaves your machine.
Want AI working in your own job, not just in demos? See the 3-month 1-on-1 program →
Supported PII Types
- National ID numbers, resident certificate numbers, passport numbers
- Mobile numbers (09xx / +886 format), landlines
- Email addresses, credit card numbers
- Tax ID numbers (統一編號, Taiwan’s business registration number), license plates, dates of birth, bank account numbers
- Person names, organization names, location names (detected via CKIP BERT, a Mandarin NLP model from Academia Sinica)
Supported File Formats
- Plain text (.txt / .csv / .tsv)
- Excel (.xlsx) — processes cell by cell, preserves formatting
- Word (.docx) — handles both paragraphs and tables
- PDF (.pdf) — extracts text first, then processes
Measured Recall When Local Models Hunt for Sensitive Data
When implementing de-identification, the core question is whether the underlying model can catch everything cleanly. I actually tested de-identification. qwen2.5:1.5b got 3/16: fast, misses way too much. qwen3-vl:8b got 14/16: very fast, but the answer fields came out malformed and it dropped people. qwen3-coder:30b got 15/16: fine on single tests, but the full pipeline took over 110 seconds and died partway. qwen3.6:35b-a3b got 16/16, the most complete and the most stable overall. Don’t hand it straight to a local model. Sweep it with a regex script first and let the local model cover the edge cases.
Browser Mode, Direct PDF Upload, and Enhanced Mode
Later, three things got updated. First, you no longer need Ollama running to use it: install it, run one command, open a browser tab, pick a file, review the de-identification results, circle any missed names with your mouse to redact them, download. All of it runs on your own machine — the lookup table never touches the web and never enters any log. Second, text-based PDFs can now be dropped in directly. It extracts the text and runs it through the same pipeline, with parsing sandboxed in an isolated subprocess under a time and memory cap, so a broken or booby-trapped PDF only ever produces one fixed error message. Third, if you want an extra layer of safety, you can check “enhanced mode”: it has your local Ollama read each block of text three times, and only lets it through once all three passes agree — until then you can’t even see the de-identified text. Long documents don’t get dumped in whole; rules pick out the suspicious passages and their surrounding context first.
MCP Integration
There’s also an MCP server so you can plug it directly into Claude Code and use it seamlessly in your workflow.
A Note for API / Enterprise Users
Claude API and Enterprise users can look into Anthropic’s ZDR (Zero Data Retention) option—but it isn’t on by default; it has to be enabled for eligible organizations. For regular subscription users, besides using a de-identification tool, remember to go into your settings and turn off “Allow my data to be used for model training.” That way your data is only stored by Anthropic for 30 days instead of five years.
What Isn’t Solved Yet
That said, I’m still working on the privilege and isolation problem with commercial agents, and I’m considering a proxy setup down the road. Batch document processing and multi-format documents are the other directions I want to push on.
Anyone interested in collaborating is welcome to try it, and issues and PRs are all welcome.