05Compliance
Data protection is not a feature — it is the foundation.
How masking relates to the Swiss nDSG, the GDPR and the EU AI Act.
01Compliance
nDSG (Switzerland)
- Privacy by design is mandatory (Art. 7) — masking implements it directly.
- Passing data to LLM providers leaves you responsible. What never leaves the building cannot be lost externally.
- Pseudonymised data still counts as personal data as long as someone can map the placeholders back to the real people. That is why this lookup table («[NAME_1] = Thomas Weber») is kept on TekAI servers exclusively in a database dedicated to you — the LLM only ever sees the placeholders. We keep this mapping strictly separated and specially protected.
02Compliance
GDPR (EU)
- Pseudonymisation is explicitly recognised as a safeguard (Art. 32).
- Masking before the API call is privacy by design (Art. 25) and lowers third-country transfer risk.
- We store your data exclusively on servers in Switzerland.
- You decide how long we keep your data. Once the agreed period ends, we delete it.
03Compliance
EU AI Act
- Risk-based regulation: document data flows, minimise risks for data subjects.
- Masking before foundation models shrinks the attack surface and simplifies documentation.
- A key governance building block — but no substitute for a full conformity assessment.
Our principles in this demo
- Processing happens entirely in memory — nothing is written to disk.
- Logs contain only metadata (file size, runtime, entity count), never content.
- The mapping between original and placeholder never leaves the session and is discarded after the response.
- No external trackers. For your account we store only the email address, a password hash and the expiry date — never your documents.