Pseudonymization

Pseudonymization is a protective layer between your original content and the model. It replaces detected personal data with placeholders before text is sent to a chat model. This lets the model work with the structure of the request without directly seeing clear names, email addresses, phone numbers, or similar data.

Pseudonymization is not deletion and does not guarantee that a text is fully anonymous. It reduces risk by replacing detected sensitive spans and keeping the mapping locally for the active chat.

What is replaced

elmtree chat looks for personal or sensitive data such as:

• names and name parts,
• email addresses and phone numbers,
• addresses and locations,
• dates and age values,
• passport, tax, or similar identification numbers,
• additional categories you enable in privacy settings.

Detected terms are replaced by typed tokens. A name is not simply changed to ***; it becomes a placeholder that roughly preserves its role. That helps the model answer usefully.

Document-bound pseudonymization

Pseudonymization is mainly designed for document work. When you load a document into the chat and document pseudonymization is active, the extracted document text is prepared and pseudonymized in the preview.

Plain typed text is no longer pseudonymized by itself. Typed text is pseudonymized when you are chatting with a pseudonymized inline document. In that case, document and typed follow-up question belong to the same send context and are protected together.

Preview before sending

The preview is the authoritative view of what will be sent to the model. When a document is pseudonymized, the preview shows the replacement tokens. You can check whether the replacement looks plausible before sending.

You can also edit manually in the preview:

• Add mask replaces a selected term with a token.
• Remove mask restores a selected token where the mapping is available.
• Remove text deletes selected passages from the document or follow-up question.
• Insert text adds text manually to the preview.

Inline documents and large documents

Preview pseudonymization applies to inline documents. These are documents whose extracted text is included directly in the chat context.

Large indexed documents are used differently: they are prepared for RAG and attached to the chat as a document reference. The inline preview toggles do not apply to these documents.

Limits

Pseudonymization is a strong reduction measure, but not full anonymization. Limits can come from undetected personal data, indirect identifiability, OCR errors, unusual formats, or rare context combinations.

For important documents, check the preview, add missing masks, and remove unnecessary passages.