Anonymisation proxies and confidential AI: market overview for DACH and France

What kinds of offerings are there?

The offerings solve different problems and are not mutually exclusive:

• Pseudonymisation proxy: Replaces personal details before sending to an external language model and puts them back into the answer.
• AI gateway with data protection rules: A central access point to several models that detects, masks, blocks or logs sensitive details, often without automatic restoration.
• Confidential inference: The model runs in a hardware-protected environment (Trusted Execution Environment, TEE); the operator of the infrastructure is not supposed to have access to plain text. The limits of this technique are covered in the guide Confidential computing for AI.

The information below comes from the providers’ websites and repositories, retrieved on 11 October 2026. It is not an assessment. Prices are mostly not published.

Which providers are there in Germany?

Provider	Type	Where detection or processing takes place	External models according to the provider	Status
Privatemode (Edgeless Systems)	Confidential inference	Encryption at the customer’s site, model in protected hardware in the EU	No forwarding; open models from various vendors	active
enclaive (Garnet, PrivacyMode)	Confidential inference and proxy	At the customer’s site, in a cloud or as a service from enclaive; re-assignment inside the protected environment	OpenAI, Anthropic, Google	active
BetterEdge (real-cis)	Confidential computing for any software, not an AI offering	In modules at the customer’s site or in rented encrypted environments	–	active
Vencla	Gateway with reversible tokenisation	In the customer’s network or in the browser	OpenAI, Anthropic	pilot phase
Noirdoc	Gateway with optional masking	not publicly stated	several, including via Azure and Google Vertex	active
DFKI Privacy Guardrail	Proxy as a browser extension, open source	Only in the browser	OpenAI, Anthropic, Google	public beta
pii-cloak	Proxy	Provider’s cloud, servers in Germany	OpenAI, Anthropic, Mistral AI, Azure OpenAI, local	active

On its website, Privatemode names among its customers the Federal Employment Agency (Bundesagentur für Arbeit, described there as a test), HÄVG (test) and ID GmbH & Co. KGaA. Hospitals that use software from ID are not automatically Privatemode customers as a result.

Which providers are there in Austria and Switzerland?

Provider	Country	Type	Where detection takes place	External models according to the provider	Status
AEGIS (Kaino GmbH, Innsbruck)	AT	Proxy as a browser extension	In the provider’s EU infrastructure	OpenAI, Anthropic, Google, Perplexity	active
AUSTR.AI (Vienna)	AT	Proxy as a chat application	On your own computer or a self-operated server	OpenAI, Anthropic, Google, Mistral AI, local	beta
aiproxy (d-side solutions, Bulle FR/CH)	CH	Proxy with chat, also for documents	On a provider server in Switzerland	Anthropic	pilot
Klyo	CH (company in the USA)	AI workspace with masking and tokenisation	At the customer’s site, in Swiss data centres or large clouds	numerous providers	active

For Austria and Switzerland we found no public references from healthcare or public administration. That does not mean there are none.

Which providers are there in France?

Provider	Type	Where detection takes place	External models according to the provider	Status
Kiji Privacy Proxy (Dataiku), open source	Proxy	Local: desktop application or customer server	OpenAI, Anthropic, Google, Mistral AI	generally available since April 2026
AIGuard	Proxy on the computer	On the person’s computer	OpenAI, Anthropic, Google, Microsoft, Mistral AI, Perplexity	active, initially Windows
Privasee	Proxy as a browser extension, for tax advisory firms	In the browser, if needed via the provider in the EU	OpenAI, Anthropic, Google, Perplexity	active
Sas de confiance IA (Comptoir des Signaux), open source	Proxy for local authorities	Locally at the customer’s site	European providers and local models	early version 0.1
Mithril Security	Confidential inference	In protected hardware	–	BlindAI no longer actively maintained according to the repository, BlindLlama marked as a prototype

What should you look for when choosing?

• Who sees plain text? If detection runs in the provider’s cloud, the provider is generally your processor and needs a data processing agreement.
• How well does detection work on your texts? In-house abbreviations, free text and attachments are the typical gaps (re-identification risk).
• How much context remains? Replaced details can make the answer worse (context loss).
• How mature is the product? Several offerings are in beta or a pilot phase.
• No general approval known. We are not aware of a general approval of a specific proxy software by the supervisory authorities in Germany, Austria, Switzerland or France (as of October 2026); the German Data Protection Conference requires a case-by-case review. If the model provider processes data on your behalf, the data are personal data for the provider too (Is pseudonymised AI use GDPR-compliant?).

For patient data there is a separate checklist with evidence.

Where does basebox stand in this market?

basebox is neither a proxy nor confidential inference, but a different architectural choice: the platform and the AI model run in your environment, on a server dedicated to you or in a separate environment in our cloud in the Munich-East data centre. By default, data go to no AI model from another provider, so nothing has to be replaced beforehand. basebox is available in Germany, Austria and Switzerland as cloud and server, in France as server. The options are compared in the guide Anonymisation or your own AI infrastructure.