GDPR-compliant AI usage
Use AI without personal data ever reaching the model.
AVGfilter is a filter layer between your employees and the AI model. Personal data is tokenized before the AI call and restored after the answer. The model processes tokens only.
- Hosted inside the EU
- No model training on your data
- Tokenization before the AI call
- Fail-closed on outage
The problem
Uncontrolled AI usage is a GDPR risk.
Personal data in prompts
Work orders, quotes and email threads get pasted into an AI chat in full. Everything in them leaves the organisation.
Unknown processing
Where the input is stored, how long it is kept and who has access to it cannot be established in practice.
No demonstrability
During an audit there is no way to substantiate which personal data was or was not shared with an AI model.
The solution
A filter layer between your data and the model.
Tokenization before the AI call
National IDs, IBANs, names, addresses, phone numbers, email addresses, postcodes and company registration numbers are replaced server-side before the request reaches the model.
Fail-closed on outage
If the filter is unavailable or processing takes longer than five seconds, the AI call is aborted. There is no path along which raw text reaches the model.
No impact on how people work
The answer on screen contains the original data. The filter layer requires no extra steps from the user.
The difference
With and without AVGfilter.
The same message from the same employee. Left what reaches the AI model without a filter layer, right what the model receives with AVGfilter.
Without a filter layer
This reaches the AI model
Draft an email to Jan de Vries, national ID 123456782, living at Dorpsstraat 14 in Utrecht. The fault in his boiler has been resolved; call 06-12345678 to schedule a check-up. IBAN NL91 RABO 0417 1643 00 for the refund.
Name, national ID, address, phone number and IBAN leave the organisation and end up with an external AI provider.
With AVGfilter
This reaches the AI model
Draft an email to [NAAM_a41], national ID [BSN_92f], living at [ADRES_3d1] in Utrecht. The fault in his boiler has been resolved; call [TEL_7c2] to schedule a check-up. [IBAN_55e] for the refund.
The model sees tokens only. The real values stay inside the EU and are only restored in the answer.
The process
From input to answer
- 01
Input
An employee asks a question containing a customer name, address, IBAN or national ID.
- 02
Tokenization
Server-side, every piece of personal data is replaced by a token. Jan de Vries becomes [NAAM_a41].
- 03
AI processing
Only the tokenized text is sent to the model.
- 04
Detokenization
In the answer, tokens are mapped back to the original values.
- 05
Cleanup
The token mapping is deleted as soon as the session or conversation is cleaned up.
See it work in the demo
Enter a message with a name, email address or IBAN. Next to the answer you can see which text was actually sent to the model.