Capabilities

Removing personal data

De-identification has one step that must see the identifiers it removes, which makes it the one step that cannot be somebody else's service. llamay redact and POST /v1/redact replace personal identifiers with their kind, on this machine, with no model involved.

Over HTTP

curl -s localhost:11435/v1/redact \
  -d '{"text": "Refund 4111 1111 1111 1111 to [email protected], call +44 20 7946 0958"}'

{"findings":[{"type":"card_number","start":7,"end":26},{"type":"email","start":30,"end":46},
  {"type":"phone","start":53,"end":69}],
 "text":"Refund [CARD_NUMBER] to [EMAIL], call [PHONE]"}

findings gives each identifier's kind and byte offsets in the original text — never the identifier itself, so a response that lands in a log does not put back what it removed. Send "types": ["email", "phone"] to look for only some kinds.

From the command line

llamay redact notes.txt > notes.redacted.txt      # or read standard input
llamay redact -types card_number,iban -json notes.txt

Checked the way each identifier is issued — which is why the second card number below is left alone:

$ cat notes.txt
Card 4111 1111 1111 1111 and 4111 1111 1111 1112.
NHS 943 476 5919, SSN 078-05-1120.

$ llamay redact notes.txt
Card [CARD_NUMBER] and 4111 1111 1111 1112.
NHS [NHS_NUMBER], SSN [US_SSN].
redacted 3 identifier(s)

What it finds

Kind	Replaced with	Counts as one only if
`card_number`	`[CARD_NUMBER]`	13 to 19 digits that pass the Luhn check and are not all one digit
`iban`	`[IBAN]`	15 to 34 characters, uppercase, passing the ISO 13616 mod-97 check
`us_ssn`	`[US_SSN]`	Written `ddd-dd-dddd`, with an area, group and serial that are ever issued (not 000, 666 or 9xx; not 00; not 0000)
`uk_nino`	`[UK_NINO]`	A National Insurance number whose prefix is ever allocated, with a suffix A to D
`nhs_number`	`[NHS_NUMBER]`	10 digits passing the modulus-11 check
`email`	`[EMAIL]`	The shape of an address
`ipv4`	`[IPV4]`	Four octets that parse as an address
`phone`	`[PHONE]`	Written in groups — an optional `+` country code, a 2–4 digit prefix (or one in brackets), then two groups of 3–4 digits separated by spaces, dots or dashes — with 9 to 15 digits in all, not part of a longer run of digits. `+44 20 7946 0958` is found; `+44 7700 900123`, whose last six digits are one group, is not.

What it does not do

It does not understand language. A name, a street address or a diagnosis written in prose is not a pattern. Finding those is a model's job; this is the reliable floor underneath it.
It is not reversible. There is no token vault: the original values are not kept anywhere.
IPv6, dates of birth and other national identifiers are not detected.

Using it in front of a hosted model

A local server is the only kind you can put in front of a hosted one: redact here, send the redacted text on, and the identifiers never left. The local-first pattern is built around exactly this step.