AI in your company without handing over your clients' data
It is always the second question, right after "what does this save me?". It goes like this: fine, but where does my data end up? The short answer is that it does not leave, and not because we promise so: because between your systems and the model there is a filter that strips the personal data before anything leaves. What reaches the artificial intelligence is text with no names. That is how we work from Barcelona on everything we build, from invoice capture to logistics back office automation.
Personal data crossing over to the model: zero.
It is not a figure of speech. A delivery note, an invoice or an email from a client is full of names, phone numbers, delivery addresses, tax IDs and account numbers. Before that text leaves your systems, each of those values is replaced by a label. The model does its job on the labels, which serve the task just as well, and the real values are put back at your end when the answer arrives. The dictionary that translates one into the other never leaves.
It is called the Privacy Filter and it fits in one line
This is a delivery notice like the ones processed every day, with made up data. On top, the way it comes in. Below, the way it goes out towards the model.
Delivery EXP-2026-1184 for Martí Serra Puig, C/ Provença 212, Barcelona. Warehouse contact 600 000 000. Customer B00000000. Outstanding 1.475,60 €.
Delivery EXP-2026-1184 for [PERSONA_1], [DIRECCION_1]. Warehouse contact [TELEFONO_1]. Customer [NIF_1]. Outstanding [IMPORTE_1].
The file reference stays as it is because it identifies nobody, and it is exactly what the AI needs in order to know which shipment is being discussed. Everything else goes labelled. When the model answers "let [PERSONA_1] know that [DIRECCION_1] moves to Tuesday", the text is restored at your end and whoever reads it sees the usual name and street.
Made up example. Neither the name, nor the phone number, nor the tax ID belongs to anyone.
The three guarantees holding it up
Almost everyone selling "private AI" is describing an intention. These are three mechanisms, and every one of them can be checked.
No model decides it
The filter is rules and validators, not judgement. A model you ask "is this sensitive?" gets it right almost every time, and the almost is the problem: when it fails, it leaks. Here there is nothing to get right, the detector goes through every text in full.
Deterministic, not probabilisticIf in doubt, nothing leaves
Once filtered, the filtered text is scanned again. If any trace of personal data shows up, the call is not made: it stops and raises an error. The system fails closed. A halted automation can be fixed; a piece of data that has already left cannot.
Fails closed, never openThe dictionary does not travel
The table saying which real name sits behind each label lives in memory for as long as the call lasts and is destroyed when it ends. It is not written to disk, it is not sent anywhere, and without it the labels mean nothing.
Only on your side of the borderA record is kept, without the data
Every processing operation leaves an audit line: when it happened, which types of data were detected and how many, and whether it was blocked. Never the value. It is the documentary evidence the regulation asks for, written by itself, without turning the log into a second copy of your data.
Audit trail with no personal dataThe AI never holds a master key
The filter protects what goes out. This is the other half: what it can ask for.
An assistant connected to your ERP and your email does not get access to your ERP and your email. It gets a handful of specific functions that someone has written and bounded: "look up the status of file X", "list this month's overdue invoices". Each one returns only the fields that task needs, and the trimming is done by your server before anything is handed over, not by an instruction in the prompt asking the model to behave.
That gives three permission levels, and every automation is contracted at one of them. It never moves up a level unless you decide so.
| Level | What the automation can do | Who closes it |
|---|---|---|
| Look up | Read and answer with what is there, touching nothing | Nobody has to approve: nothing changes |
| Propose | Leave the email, the quote or the entry drafted and on hold | A person reviews and sends |
| Execute | Act on its own inside a written, bounded perimeter | You, by authorising that perimeter in writing |
Two tiers, depending on how far you want the text to travel
Standard
The large commercial models, with the Privacy Filter in front and the data processing agreement signed. It is the best performance per euro and it covers the vast majority of back office processes.
Top performance, filtered dataSovereign
European open weight models, on European infrastructure or on your own server. The text never leaves European soil, not even filtered. It costs more and performs slightly worse on the hard tasks; on the repetitive ones the difference is not noticeable.
The text does not cross the AtlanticThe choice is not ideological, it is about the process. To read delivery notes or sort email, the standard tier is more than enough. If you work with a tender that requires European data residency, or with health records or employment files, the sovereign tier stops being a preference and becomes the requirement.
Where we draw the line
The Privacy Filter does not cover everything, and we say so before anyone asks, because a supplier who simply says their AI is private is describing something that does not exist.
- It does not save voice. Filtering a text requires it to be text, and a call has to be transcribed first. That is a different conversation: transcription on local infrastructure, or the notice to the other party that they are talking to an automated system, as the European AI regulation requires.
- It does not get inside an image. A scanned delivery note is a pixel until it is read. When the document arrives as a photo, what gets decided is where that reading happens, not how it is filtered afterwards.
- It does not replace the signed paperwork. It is a technical minimisation measure, which is a principle of the regulation itself, but the data processing agreement, the record of processing activities and the confidentiality agreement are separate and always come along.
The two layers, and why both are needed
| What it solves | What it leaves unsolved | |
|---|---|---|
| Technical layer | That the personal data never gets out. Real minimisation, verifiable line by line | It does not give you a contract or a record of processing |
| Contractual layer | Data processing agreement signed, training use excluded, confidentiality | A contract does not technically stop a piece of data from leaving |
Almost the whole sector sells only the second one, because that is the one a PDF solves. We build both, and the first one is the one you can audit without taking anything on faith: if the detector missed something, the second pass stops the call and it is written down that it stopped it.
If what you are after is the legal text of this website and not how we handle the data of a project, it is in the privacy policy.
Frequently asked questions
Is my clients' data used to train the artificial intelligence?
No, for two reasons that stack. The first one is contractual: we work on business plans whose terms exclude your content from model training, with the data processing agreement signed. The second one is technical, and it is the one that really shuts the door: thanks to the Privacy Filter, your clients' personal data never reaches the model. What crosses over is text in which names, phone numbers, tax IDs and addresses have already been replaced by labels.
What is the Privacy Filter and how is it different from anonymising with AI?
It is a border crossed in one direction only, and no model decides it. Before a text leaves your systems, a deterministic detector, made of rules and validators, replaces every piece of personal data with a label such as [PERSONA_1] or [NIF_1]. The AI works only with those labels and, when it sends the answer back, the real values are restored at your end. Asking a model to decide what counts as sensitive is precisely what we do not do: a model gets it wrong, and when it gets it wrong it leaks.
And what if the detector misses something?
That is what the second pass is for. Once filtered, the filtered text is scanned again in full, and if any trace of personal data shows up the call is not made: it stops and raises an error. The system fails closed, never open. We would rather have an automation come to a halt than have one piece of data slip through a gap in the detector, and in our own tests that second pass has already caught a case the first one had missed.
Can all of this be done without anything leaving for the United States?
Yes, and it is your call. On the standard tier we use the commercial models with the filter in front and the contract signed. On the sovereign tier the process runs on European open weight models, hosted on European infrastructure or on your own server, so the text never leaves European soil, not even filtered. The second one costs more and performs slightly worse on the hard tasks; for many back office processes the difference is not noticeable.
Does the filter work for voice calls too?
No, and it is worth saying before anyone asks. Filtering a text requires it to be text, and on a call the audio has to be transcribed first, so it leaves in full towards the transcription provider before the filter can touch it. When voice is involved the conversation is a different one: transcription on local infrastructure, or a clear notice to the other party that they are talking to an automated system, as the European AI regulation requires.
Does this replace the privacy policy or the contract?
No. The Privacy Filter is a technical data minimisation measure, which is a principle of the regulation itself, but it does not replace the paperwork. That is why they travel together: the filter in front, the data processing agreement signed, the record of processing activities and the confidentiality agreement. Either layer on its own leaves a hole.
Half an hour about your data
A 30 minute call to see which data the process you want to automate really touches, which of it is not needed at all, and which tier works out best. No strings attached.
Book a call Message us on WhatsApp