How it works
Find, replace, restore
Every request is read whole, its personal data replaced with stand-ins of the same kind, and every reply restored before you see it. Anthropic receives a conversation about other people; you never see the stand-ins.
Where your data goes
What is found
People and cities are found by GLiNER2's Polish PII model, running inside the gateway on a GPU; everything with a grammar is found by that grammar, with its check digit where one exists.
| Kind | Found by | Kept in the stand-in |
|---|---|---|
| Person | the model | given name or surname, gender, declension |
| Address | street, postal code, a city beside them | street kind, building number, postal region |
| its grammar | domain | |
| Phone | a country code, 0048, nine Polish digits grouped, or a mobile number | country code and two digits |
| IP address | IPv4 or IPv6 | first octet or group |
| IBAN, NRB | ISO 7064 mod 97 | country and bank |
| Payment card | Luhn | issuer and length |
| PESEL, NIP, REGON | their checksums | century and sex; tax office; voivodeship |
| ID card, passport | series and check digit; series and number | nothing |
| KRS, date of birth | after "KRS" or the register's name; after "ur.", "born" and similar | nothing; the year and the written form |
On 65 hand-written cases from a landlord's correspondence, every address and number is replaced, and every name but one the model misses; what is left by design arrives as written: health conditions, an address abroad, a URL, a driving licence number, company names and a city on its own.
How stand-ins are chosen
A name maps to another name of the same class, gender and declension pattern from SGJP, the Grammatical Dictionary of Polish, so "z Eryką Delmaczyńską" becomes "z Edytką Babalską" and every case form still reads right. A value maps to a look-alike that passes the same checksum. Choices are keyed per person: the same original gets the same stand-in in every conversation, so Anthropic's prompt cache keeps working.
Every stand-in comes from a finite, counted set: 3,075 given names, 93,867 surnames, 12,412 Polish localities from GUGiK's register of geographic names, the 365 or 366 days of a birth year. A conversation that uses up a set is refused with a message naming it, never sent with an original left in.
How replies are restored
The gateway keeps a dictionary of exactly what it sent and matches it in the reply: names as written, values also with spaces, dashes or another letter case. Text passes through at once unless it may still be the beginning of a stand-in, so replies stream as fast as Claude writes them.
What is refused
Before anything else, a request is checked against a closed grammar of the Messages API. Every string must be prose, which is pseudonymized, a short token such as a tool name, or Anthropic's own signed output. Anything else is refused with a message naming where, rather than sent unread; privacy and limits lists it.
Speed
Detection runs on an RTX 3060: 1,938 words took 0.68 s on 2026-10-30, and a text already seen is not detected again.