How Pseudora protects data

Where your data lives

The application, the detection engine and the database run on a dedicated server provided by Contabo GmbH, in a data centre in the European Union.

• Traffic goes through Cloudflare's network, which handles DNS, HTTPS and bot protection. Cloudflare terminates the encrypted connection at the edge closest to you, which is why it is listed as a sub-processor.
• With Pseudora Cloud you send the original text to the service so it can be processed. The protection covers what then reaches the AI or the destination you choose: processing does not happen on your device.
• Every request is checked against tenant, identity and permissions. Automated tests also attempt cross-tenant access.

How we handle documents

Files uploaded in Documents or in the playground File tab are never stored: they exist only in the server's memory while we process them.

• The document is read in memory. The web server's temporary buffers (request bodies, PHP uploads, FastCGI) are in RAM (tmpfs) too, not on disk.
• The server is configured to avoid swapping to disk almost entirely (vm.swappiness=1).
• The job is deleted as soon as we return the result. If you leave the page, it expires after 15 minutes at most.
• Content, file name, extracted text and the pseudonymization key never reach the database or the logs. We record metadata only: sizes, number and types of data found, duration.

Text via the API

To let you restore the original values (de-anonymization), the engine keeps the mapping between placeholders and original values: always encrypted, and for a limited time.

• Envelope encryption: each tenant has its own data encryption key (DEK), itself encrypted by an application master key (KEK).
• Mappings expire after the configured TTL: 1 hour by default, adjustable by each tenant in the console. An automatic job deletes expired mappings.
• From the console you can export the tenant's data, run a cleanup and request erasure.
• With dry_run you get detection only: no mapping is stored, only an audit entry without any text.
• Usage and audit records do not contain the text you send.

Fail-closed clients

If protection is not confirmed, the text does not leave.

• Browser extension and VS Code extension: they release text only after a successful response from the service. If the service does not answer, times out or errors, nothing is sent.
• Python and Node SDKs: they raise an explicit error when the engine does not respond, instead of passing the original text through.
• Some server integrations (for example logging middleware) let you choose fail-open so the workflow is not blocked: that is an explicit choice of whoever configures them.
• Fail-closed protects against outages, not against false negatives: no detector guarantees complete coverage.
• MCP server: enabling it does not intercept every message in an AI chat. Use the protected tool explicitly and check the content before sending it.

Logs without personal data

Our own logs must not become a store of personal data.

• A redaction filter runs on every log channel: emails, IP addresses, tokens, phone numbers, IBANs and payment cards are masked before anything is written.
• Application logs rotate daily and are kept for 14 days.
• Automatic error reports record the page address without its query string (which could carry tokens or emails).
• The engine does not log request text.

Open source and self-hosting

The detection engine is open source under the Apache-2.0 licence.

• You can read the code that handles your data, check how it behaves and install it on your own infrastructure.
• When you self-host, data does not pass through our servers: you control keys, retention and access.

github.com/nephilimdie/pii-protect

Infrastructure and access

Baseline controls, applied consistently.

• HTTPS only, with HSTS. A strict Content Security Policy, and the site cannot be embedded in other pages.
• Bot protection (Cloudflare Turnstile) on public forms and CSRF protection on every form.
• API keys are stored as hashes only; payment notifications are accepted only with a verified signature.
• Configuration secrets are encrypted (sops/age) and never stored in plain text in the repository.
• Every deploy starts only after a successful database backup. Backups stay on the same server, behind the same access controls.
• The project pipelines run tests, dependency scanning and secret detection. They are no substitute for an external audit or an independent penetration test.

Sub-processors

The providers that process personal data on our behalf. We give at least 30 days' notice before adding or replacing one (see the DPA).

Google and Stripe only process account and billing data, never the text or documents you protect. Where indicated, transfers outside the EU rely on the EU-US Data Privacy Framework and/or the Standard Contractual Clauses provided in the provider's terms.