PII Zero · Platform module
Remove PII to be compliant for model training and distribution sharing
Statements, claim forms, loss photos and dashcam video move between adjusters, vendors, reinsurers and analytics. PII Zero finds the identifying detail in those files and blurs it beyond recovery, then re-reads every output with the same detectors to prove nothing survives. Runs inside your own perimeter.
Drag the divider on any example to wipe the redaction on and off
0 bytes
of your files leave your network
runs on your hardware · no API calls
0
identifiers survived the check
every output re-read before release · 5 flagged for a human
No gaps
between detections
85 regions tracked frame to frame below
28
kinds of identifier, one engine
documents, photos and video
Before a file moves
What gets removed
Identity hides in more than a face: the account number on an attached statement, the plate in a loss photo, the address on a phone screen in a video walkthrough. Each category below has its own detector, and each has an example further down this page.
| In the file | How it is found | Example below |
|---|---|---|
| Human faces | Face detector on every frame, tracked through turns | Face on camera |
| Full names | OCR in three orientations, NER, name lexicon, clip-level consensus | Handwritten name tags |
| Addresses | OCR + address and location recognisers; all text on screens | Phone screen, bank statement |
| SSNs and ID numbers | Format and checksum recognisers (SSN, ITIN, passport, licence, NPI, EIN) | Claim form: member ID, NPI, EIN |
| Email addresses | Pattern recogniser, validated | Bank statement |
| Phone and laptop screens | Device detector; every text line on a screen is treated as PII | Phone screen in frame |
| Licence plates | Plate detector, recall-first threshold, motion-extrapolated tracks | Street footage |
Watch it work
Real footage, real documents, measured output
Every example below is actual output from the PII Zero pipeline. The numbers under each one come from the same run: how many regions were tracked, how many frames were covered, and what a second pass found left behind.
- REGIONS
- 31 blurred
- ENTITIES
- 9 types
- KEPT
- box labels, ICD-10 and CPT codes
- RESIDUAL
- 0 after re-scan
- TRACKS
- 9 license plate
- COVERED
- 270/270 frames, full 9 s clip
- THROUGHPUT
- 1.9 fps · one RTX 3090
- RESIDUAL
- 0 confirmed · 5 for review
- TRACKS
- 1 phone number · 26 screen text
- COVERED
- 120/120 frames, full 5 s clip
- THROUGHPUT
- 0.8 fps · one RTX 3090
- RESIDUAL
- 0 confirmed · 0 for review
- TRACKS
- 2 person
- COVERED
- 107/150 frames, full 5 s clip
- THROUGHPUT
- 1.6 fps · one RTX 3090
- RESIDUAL
- 0 confirmed · 0 for review
- TRACKS
- 1 face
- COVERED
- 208/208 frames, full 8.68 s clip
- THROUGHPUT
- 6.2 fps · one RTX 3090
- RESIDUAL
- 0 confirmed · 0 for review
Street footage, plates in traffic
Dashcam-style clip in moving traffic, cropped square. Several cars, plates at different sizes and angles, one partly hidden behind a truck. Road signs and the courier livery stay readable.
- TRACKS
- 9 license plate
- COVERED
- 270/270 frames, full 9 s clip
- THROUGHPUT
- 1.9 fps · one RTX 3090
- RESIDUAL
- 0 confirmed · 5 for review
Precision is the other half
Over-redaction makes a file useless. On the name-tag clip the OCR layer also read the invitation cards; NER classified that text as non-PII and left it visible. On the statement, every balance, date and field label survives.
- A SPECIAL INVITATION
- bank name
- statement period
- every balance and amount
- transaction dates
- field labels
What was found
Every redaction is logged by entity, never by content
The audit log for the bank statement above. Each entry records the entity type, its coordinates and a masked hint; the full value is never written to disk.
| Entity | Regions | What the log shows |
|---|---|---|
| US_BANK_NUMBER | 2 | •••• •••• •••• 1142 · •••• |
| EMAIL_ADDRESS | 1 | s•••••@pdxmail.com |
| PHONE_NUMBER | 1 | (•••) •••-0173 |
| ADDRESS | 4 | •••• · •••• (street line) |
| PERSON | 2 | S•••• E••••• J••••• · J••••• K••• |
| CREDIT_CARD | 4 | •••• 4242 |
| ABA_ROUTING | 1 | •••••0760 |
Synthetic statement with generated identities; no real customer data appears on this page.
How it works
Detect, track, redact, verify
01
Detect
OCR reads every frame or page in three orientations. NER, checksum recognisers and a vision layer flag names, IDs, faces, plates and codes.
02
Track
Regions are linked frame to frame, interpolated between keyframes and held through misses, so a name never blinks back into view.
03
Redact
Destructive blur: each region is downsampled to a few pixels before it is blurred, so no letter or digit shape survives. Opaque fill is available by policy. Labels and non-PII text stay untouched.
04
Verify
The output is re-scanned with the same detectors. Any surviving hit blocks the release and lands in the audit log.
Coverage
28 entity types, text and visual
Text recognisers combine NER with format checks: a routing number must pass its checksum, a card number must pass Luhn, so a random nine-digit figure is not redacted by mistake. Visual detectors cover what OCR cannot read.
Identity
- Person name
- Date of birth
- SSN
- ITIN
- Passport
- Driver licence
- NPI / DEA
Contact
- Phone
- Street address
- IP address
Financial
- Credit card (Luhn)
- CVV
- US bank account
- ABA routing (checksum)
- IBAN
- SWIFT / BIC
Insurance
- Policy number
- Claim number
- Member ID
- Group number
- EIN
Visual
- Face
- Licence plate
- QR code
- Barcode
- Handwriting
- Signature
Where it runs
Your perimeter, your keys, your audit log
PII Zero ships as containers for a VPC, a private cloud or an air-gapped network, the same packaging as on-prem detection. Originals are opened read-only. The audit log stores entity types, coordinates and confidence; an optional encrypted vault keeps the original for a review window you set, then deletes it.
- Runs on CPU; a single GPU adds real-time video
- Vault key held in memory only, never written to disk
- Per-run audit log with a release gate on residual PII
Built for
The redaction rules you already have
GDPR
Art. 17 erasure, Art. 25 by design
CCPA / CPRA
deletion and minimisation
HIPAA
Safe Harbor 18 identifiers
PCI DSS
PAN masking, req. 3.4
GLBA
NPI safeguarding
FOIA / public records
body-cam and CCTV release
Common questions
Is the blur actually irreversible?
A light Gaussian blur is not: published attacks recover text and faces from it. PII Zero first downsamples each region to a handful of pixels and only then blurs, so the letter and digit shapes are discarded rather than smeared. The leak check then re-reads every output with the same OCR, face and plate detectors and reports what survives. Teams whose policy requires it can switch to an opaque fill; the audit log records entity type, coordinates and a masked hint either way, never the full value.
How is this different from synthetic replacement products?
Replacement tools repaint a name or face with a realistic stand-in so the file stays usable for model training. That is a different goal with a different risk profile: the file still carries a plausible identity. PII Zero is for compliance workflows where the requirement is that the information is gone, provably, with an audit trail: claims intake, KYC archives, call recordings, body-cam and CCTV requests.
What does the leak check actually do?
After redaction, the output image or video is sent back through the same detectors that found the PII in the first place: OCR plus NER, face detection and plate detection. A confident surviving hit is a confirmed leak and blocks the release; a low-confidence hit is routed to a reviewer with the frame and box attached. On the clips on this page the confirmed count is zero. The review items are shown as they came out: on the street clip a courier logo, a headlight and a dark bumper panel that the plate detector second-guessed at low confidence, each checked by hand.
Does any data leave our environment?
No. OCR, NER, face and plate detection all run as local models; there are no API calls during processing. The same package runs in a VPC, a private cloud or an air-gapped network. Originals are read-only and nothing is retained after the run except the audit log you configure.
Which formats are supported?
Native PDF, scanned PDF, TIFF, PNG, JPEG and phone photos for documents; MP4, MOV and frame sequences for video. Video is processed frame by frame with tracking, so a face or plate that is detected on one frame stays covered on the frames between detections.
How do I evaluate a redaction vendor?
Ask for three numbers on your own files: residual PII after the vendor's own re-scan, the share of non-PII pixels left untouched, and throughput on the hardware you will actually run. Then ask how the tool handles a name it only half-reads, a face that turns away for ten frames, and a plate at night. Those are the cases where redaction fails quietly.
See it on your files
Send us a scan, a photo or thirty seconds of video.
We run PII Zero on it inside a sandbox and send back the redacted output with the audit log and the leak-check result.