Give the AI the document, not your client's personal data.
Drop in a Word file or PDF. pii-roundtrip swaps names, NHS and National Insurance numbers, bank details and addresses for placeholders, so ChatGPT, Copilot or Claude never see them. Paste the answer back and the real details return. Everything happens on your Mac.
Free and open source (Apache 2.0). No admin rights needed. On first launch macOS asks you to confirm opening it (how).Windows version in development. Follow releases on GitHub to be notified.
Patient: LAWRENCE, Maureen, NHS No 943 476 5919, NI number AB 12 34 56 C.
Discharged from St Aldhelm's Hospital to 7 Larkspur Row, Leeds LS99 9ZZ.
GP: Dr A. Hartwell
Dear Dr Hartwell,
Mrs Lawrence (NHS No 943 476 5919) was discharged on 12 May with a follow-up in six weeks.
Please confirm her address: 7 Larkspur Row, Leeds LS99 9ZZ.
Three steps. No setup, no internet.
-
Drop in a document
Word, PDF or text. pii-roundtrip finds the personal data and replaces it with placeholders. One person gets one placeholder throughout, whether written "Maureen Lawrence", "LAWRENCE, Maureen" or "Mrs Lawrence".
Discharge summary.docxdrop here -
Paste the text into any AI tool
The AI works on the document as usual: drafts a reply, summarises, checks the terms. It never sees the real data.
Patient: [PERSON_1], NHS No [NHS_1], NI number [NINO_1]…ChatGPTClaudeCopilotGemini -
Paste the answer or drop the AI's file back
Placeholders turn back into the real values, even when the AI has changed them slightly, for example by adding a qualifier or changing the case.
Dear Dr Hartwell, Mrs Lawrence (NHS No 943 476 5919) was discharged on 12 May.
For anyone whose documents are about people.
- Solicitors
Leases, letters, bundles
Review a lease, draft a letter before action, summarise a bundle.
- Clinicians
Clinical correspondence
Draft a discharge letter or a GP summary from clinical notes.
- HR teams
Employee files
Prepare a grievance outcome letter or summarise an investigation.
The fewest leaks of the open tools we tested.
We tested the open tools on 1,000 synthetic UK documents modelled on real ones: contracts, references, letters, HR files and discharge summaries. None of the tools, pii-roundtrip included, was tuned on these documents.
994 of 1,000
documents came out of pii-roundtrip with no personal data left.
424for GLiNER Guard Omni, the best of the other open tools.
Share of documents in which at least one real value remained after redaction. Lower is better.
- Documents, not sentencesPublic datasets hold short messages. We tested whole documents, where a name appears in the header, the body and the signature.
- Frozen in advanceThe documents were generated after the final engine changes and published with their hashes and the scoring rules before the first run. Each tool ran once, and every run is logged.
- Same data for everyoneEvery tool is scored on the same datasets. A tool is never scored on a dataset built by its own authors.
- Check it yourselfCode, data, results and a reproduction script are public. The report describes the method and its limits.
The benchmark was run by the author of pii-roundtrip. Code, data and run logs are public so that anyone can repeat it. pii-roundtrip builds on the pii-guard and GLiNER Guard Omni models and adds checksum validation, name-variant matching and consistent placeholders across the whole document. The gap in results comes from these additions.
Everything that identifies a person.
Identifiers are checked against their checksums and found with any spacing, with typos, and even when written out in words.
- Names, including "SURNAME, First"
[PERSON_1] - NHS numbers
[NHS_1] - National Insurance numbers
[NINO_1] - IBAN and account numbers
[IBAN_1] - Card numbers
[CARD_1] - Phone numbers
[PHONE_1] - Email addresses
[EMAIL_1] - Addresses with postcode
[ADDRESS_1] - Employers, practices, firms
[ORG_1] - Dates of birth
[DATE_OF_BIRTH_1]
- 01
Different people stay different
Two Smiths in one file get two placeholders, so the AI never mixes up the landlord and the tenant.
- 02
A conversation, not one request
In follow-up messages the same people and numbers keep the same placeholders, so the conversation can go on.
- 03
Removes only personal data
99.9% of what it masks is personal data. Labels such as "Party A" and Companies House numbers stay visible, so the AI still understands the document.
Is it safe to put client data into ChatGPT?
- UK GDPR. Sharing a client's personal data with a third-party AI service needs a lawful basis, and health data needs an Article 9 condition as well. Taking the identifiers out before you paste reduces what you disclose.
- Works offline. The models are part of the app, which makes no network requests.
- Encrypted. The mapping between placeholders and data is kept in an encrypted vault (AES-256), with its key in your Mac's Keychain.
- Open source. Every line can be inspected; Apache 2.0 licence.
What to know before you start.
- Built for documents. On short chat messages it masks more unnecessary text than pii-guard.
- Context stays. A rare diagnosis, a job title or unusual circumstances are not removed.
- Scans. A PDF without a text layer cannot be read, and the app says so.
- Synthetic test documents. The benchmark results come from synthetic documents modelled on real ones.
- Check the result. No detector is perfect. Read the cleaned text before you send it: the app tells you how much data of each kind it removed.
An open product by Besk Tech.
- pii-roundtrip is developed by Vladimir Beskorovainyi, founder of Besk Tech (besk.tech).
- The app, the benchmark and all results are open source. The method and its limits are described in the report.
- Vulnerabilities can be reported privately under the security policy.
Questions
Is it safe to put client data into ChatGPT?
Sharing personal data with a third-party AI service needs a lawful basis under UK GDPR, and health data needs an Article 9 condition as well. The safer route is not to share it at all: pii-roundtrip removes it from the text before you paste.
Does any data leave my computer?
No. pii-roundtrip works offline. Only the cleaned text, which you copy yourself, goes to the AI tool.
Does this make my use of AI UK GDPR compliant?
pii-roundtrip pseudonymises the text: you keep the key, so for you it is still personal data (UK GDPR, Recital 26). The AI service receives text without direct identifiers. Context such as a rare diagnosis or a job title is not removed. Whether this is enough for your organisation is for your DPO, Caldicott Guardian or solicitor to decide.
Can I use it with patient data?
It removes direct identifiers before anything leaves your Mac. Follow your organisation's information governance policy and the Caldicott Principles; pii-roundtrip does not replace them.
Which AI tools does it work with?
Any of them: ChatGPT, Claude, Microsoft Copilot, Gemini. pii-roundtrip does not connect to them; it prepares the text and restores the answer.
Can I redact a PDF?
Yes, if the PDF has a text layer. A scanned PDF without text cannot be read, and the app says so. Word (.docx) and plain text are supported too.
What doesn't it catch?
Indirect details such as a diagnosis, a job title or unusual circumstances, and text in scans without a text layer. Read the cleaned text before you send it.
How do I open the app the first time?
The app is not yet signed with an Apple certificate, so on first launch macOS warns about an unidentified developer and does not open it. Open System Settings, go to Privacy & Security, and click Open Anyway next to the message about pii-roundtrip. You only need to do this once.
Do I need admin rights?
No. You can drag the app into the Applications folder inside your home folder. On a managed work Mac, check with your IT team first.
Is there a Windows version?
It is in development. The Mac app is available now, as are a command-line tool and a Python library for any system.
How much does it cost?
Nothing. The code is open source under the Apache 2.0 licence.
AI help with client files, without the personal data.
Free. Windows version in development.