Pseudonymisation proxy for ChatGPT and other AI services: how the technology works

What does a pseudonymisation proxy do?

A pseudonymisation proxy is software that sits between what a person types and an external language model, such as ChatGPT or the models of other providers. It changes the text on the way out and on the way back. The model itself stays with the provider; the proxy is meant to ensure that no names or identifiers arrive there.

Which steps does it go through?

1. Detect: The proxy searches the input for personal details. It finds fixed patterns such as IBAN, telephone number, email address or health insurance number using rules. It recognises names, places and organisations with a language model for named entity recognition. Many products allow custom lists, for example for case reference numbers or ward names.
2. Replace: Each detected detail is replaced with a placeholder, such as “PERSON_1” or “PATIENT_17”. Some products insert invented but plausible names so that the text stays natural for the model. The proxy stores the assignment between placeholder and original in a table.
3. Send: The altered text goes to the language model.
4. Restore: In the answer, the proxy looks for the placeholders and puts the originals back. The person sees an answer with the real names.

An example, explicitly invented: a doctor asks for a summary of the case “Maria Müller, 43, Starnberg, rare metabolic disorder”. The proxy sends “PATIENT_17, 43, Starnberg, rare metabolic disorder” to the model and puts the name back into the summary.

Where does the proxy run, and who holds the key?

Products differ widely here, and this determines whom you are trusting:

Set-up	Who sees the original?	What this means
Proxy runs at your site (in the browser, on a server in your organisation)	only your organisation	the lookup table does not leave your organisation
Proxy runs at the proxy provider	your organisation and the proxy provider	the proxy provider is usually a processor; a data processing agreement under Art. 28 GDPR is required
Proxy runs at the provider in protected hardware	according to the manufacturer, only your organisation	trust shifts to hardware and attestation (confidential computing)

If placeholders stay the same across several requests, the model understands context better. At the same time, a recipient can then link requests about the same person. Ask the provider how long an assignment is valid and whether it is assigned per conversation or permanently.

Where are the technical limits?

A proxy can be a sensible safeguard, but it does not replace a review. Typical limits:

• Undetected details: Free text, abbreviations, typos, nicknames, handwriting in scans or details in metadata slip through. Even tools with good detection give no guarantee; the open-source tool Presidio itself points out that automatic detection does not find all sensitive details.
• Combination of characteristics: Age, place and a rare diagnosis together can make a person identifiable, even without a name. The German Data Protection Conference (DSK) therefore states that removing names and addresses is regularly not enough. The data protection authorities assess this as singling out, linkability and inference (re-identification).
• Lost context: If the proxy replaces details that the model needs to understand the text, the answer gets worse, for example with local references in citizens’ enquiries or age in medical texts (context loss).
• Incorrect restoration: If the model merges two placeholders, translates them or rewrites them, the proxy puts the names back wrongly or not at all.
• Other routes out: File attachments, web search, agents, connected tools and logs can transfer data that does not pass through the proxy.

What should you ask a provider?

• Where does detection run, and where is the lookup table kept?
• Which details does the product detect, in which languages and file formats? Are there measured detection rates for your type of text?
• How long are placeholders valid, and when is the table deleted?
• Which model does the text go to, in which country, under which contract?
• What is logged, at the proxy and at the model provider?

A checklist for patient data is available in the guide Checklist for anonymisation proxies.

How does this work with basebox?

basebox is not a proxy but a different architectural choice: the platform and the AI model run on a server in your organisation or in our cloud in the Munich-East data centre. Data is therefore not altered; by default it does not leave this setting. An external model is only available as a separate app, and only if you explicitly have it set up (details). Which approach suits your data is compared in the guide Anonymisation or your own AI infrastructure.