99.7% of personal data redacted and nothing retained: GDPR document redaction for CVs, subject access requests and AI pipelines

The problem

Every business that holds personal data eventually has to share a document that contains some of it. A recruiter sends a CV to a client. A data protection lead answers a subject access request with emails that name other people. An operations team pastes a customer complaint into an AI assistant. Each time, UK and EU GDPR expect only the personal data the recipient needs to go with it: the data minimisation principle in Article 5(1)(c).

In practice that means someone reading every page with a redaction tool, which is slow and inconsistent, and the common shortcuts make things worse:

• Black boxes over live text. A rectangle drawn on a PDF hides the words on screen while leaving them in the file, where they can be copied out.
• Find and replace. It catches the name you searched for and misses the nickname, the email address and the same name split across two lines.
• Pasting into a public AI tool. The document is redacted only after a third party has already received it.

We built PII Purge so that removing personal data is a single call that is accurate, does not keep what it reads, and works at the volume businesses actually handle.

What we built

PII Purge takes a PDF or block of text and returns a copy with the personal data removed. It is available at pii-purge.com, over a REST API, and as an MCP connector listed in the Claude Directory that anyone can add to Claude.

A multi-step detection pipeline

No single technique finds all personal data, so PII Purge runs several and combines what they find.

• Pattern matching for identifiers with a fixed shape: email addresses, phone numbers, postcodes, National Insurance and passport numbers, sort codes, card numbers and IBANs.
• Natural language processing to recognise people, organisations and places from the structure of the sentence.
• Large language models that read each section in context, catching what rules and NLP miss: a former employer described in passing, a school in a career history, a relative named in a complaint.
• Mention matching that finds every repeated reference to a detected item, including text split across lines, and removes them all.

The pipeline detects ten types of personal data: people, contact details, addresses, locations, businesses, education, other organisations, dates of birth, ID numbers and financial details. Teams can add plain-English redaction instructions to their account to say what to keep or remove, and they apply on the website, the API and in AI assistants alike.

Redaction that leaves nothing underneath

A redacted PDF is not the original file with boxes on it. PII Purge masks the detected areas and embedded images, then rebuilds every page as an image. The original text layer, metadata, bookmarks, form fields and attachments are not carried over. There is no hidden text to copy out, no author name in the document properties, and no tracked history. The output file is renamed, so the original file name, which often contains the person's name, does not travel either.

Fails closed

If any detection step fails on any section, the whole request fails with an error. PII Purge never returns a document it has only partly checked, and failed redactions are not charged.

Private by design

A redaction tool that keeps or forwards what it reads is a new data protection risk, not a fix for one. We designed PII Purge around data protection by design from the first line of code.

• Every step runs on Hexploits Cloud in the EU, including the LLMs. They are open-weight models served on infrastructure Hexploits owns and operates, so no document reaches OpenAI, Google or any other third-party AI service.
• Processed in memory, never stored. The original and the redacted copy are discarded when the request completes.
• Zero training and zero retention. Document content is not used to train any model, and prompts and outputs are not logged.
• Metadata-only records. Usage records hold the account, time, file size, page count, number of items redacted, duration and outcome for billing and support. They never hold text, file names, detected values or redacted copies.
• No personal data in the free tier either. Anonymous daily use is tracked with a one-way hash of the IP address that changes daily and is deleted after two days.

For a data protection officer, that means PII Purge can sit in a DPIA as a processor that holds document content only for the length of a request, in the EU, with no onward transfer.

Built to scale

• One call per document. Each request carries everything it needs and nothing is kept between requests, so capacity scales out on Hexploits Cloud as volume grows.
• Three ways in, one account. The website for occasional use, a REST API for systems, and a remote MCP server for Claude, Claude Code and other AI assistants. Usage, billing and redaction instructions are shared across all three.
• Tiered metered billing on Stripe. One free redaction a day without an account, 50 a month with one, then 30p, 20p and 8p per redaction in published volume bands. Every successful redaction is metered to Stripe whichever way it arrived, failed redactions are never charged, and customers get one monthly bill. It is the same payment integration work we do for clients.
• Clear limits. PDFs up to 50 pages and 25 MB, text up to 1 MB, and errors that say exactly why a document was rejected.

In the Claude Directory

PII Purge is listed in the Claude Directory, Anthropic's catalogue of connectors for Claude. Anyone can add it to Claude or Claude Code, sign in once in the browser, and ask Claude to redact a document in the conversation.

Getting there meant building a production MCP server, not a demo:

• A remote MCP server over Streamable HTTP at pii-purge.com/mcp, with three tools: redact text, redact a file, and redact a file on the user's own machine.
• OAuth sign-in from inside the assistant, discovered from the authentication challenge, with API keys for developer clients that prefer them.
• Local files without uploading them to the chat. In Claude Code, the local-file tool returns a single-use upload link valid for ten minutes, and the redacted copy is saved beside the original. The unredacted file never enters the conversation.
• Safe URL handling. Files can be passed by public HTTPS link; private-network addresses are refused.
• Metered like everything else. Connector usage counts against the same Stripe allowance as the website and API, and listing tools is never charged.
• Review. Documentation, setup guides and a privacy policy written for the directory, and the connector taken through Anthropic's review to a public listing.

Where it is used

Recruitment: anonymised and blind CVs

Agencies share candidate profiles with clients before an introduction, and in-house teams shortlist without names, schools or addresses to reduce bias. CVs are full of exactly the details PII Purge detects: names, contact details, employers, universities and schools. CVs are also what the benchmark measured.

Subject access requests

A response to a subject access request is due within one month and is usually a pack of emails, notes and reports that name other people. Article 15(4) says the copy must not adversely affect others, so their personal data is redacted unless they consent or disclosure is reasonable. PII Purge removes it from each document in the pack; the data protection lead reviews the output and restores anything the requester is entitled to see.

Before documents reach an AI model

Teams use AI assistants to summarise contracts, triage tickets and draft replies. Running the document through PII Purge first means the assistant sees the substance without the personal data, whether that assistant is ChatGPT, Copilot or an in-house model.

HR, legal and employment cases

Grievance reports, investigation notes and tribunal bundles need witnesses and colleagues redacted before they are circulated beyond the people who must see them.

Freedom of information requests

Public bodies releasing documents under the Freedom of Information Act withhold third-party personal data under section 40. PII Purge redacts it before release.

Support tickets, complaints and supplier hand-offs

Customer emails and complaint files shared with an outsourced team, an insurer or a software vendor carry account numbers, addresses and phone numbers the recipient does not need.

Research, training and test data

Real documents make the best examples for training staff, testing software and evaluating AI. Redacting them first means teams can use realistic material without copying personal data into new systems.

Results

The benchmark counts an item as redacted only if every letter and digit of it is hidden. The full method is on the PII Purge trust page.

What we publish about the limits

Accuracy claims in redaction are only worth something with their limits attached, so these are stated on the product as well as here.

• The benchmark uses synthetic CVs and default settings. Real documents and custom instructions can score differently.
• Automated detection can miss personal data or remove details you meant to keep, so output should be reviewed before it is shared.
• Redaction removes identifiers; it does not on its own make a document anonymous, and it is not legal advice.
• Scanned and image-only PDFs are not supported yet, because there is no OCR step.

Why this matters for your systems

PII Purge is the same work we do for clients, applied to a product we run ourselves:

• AI document processing measured against a labelled sample.
• Private LLMs on EU infrastructure, so sensitive data never reaches a third-party AI service.
• Data protection engineering that makes GDPR obligations a routine job rather than a project.
• MCP servers and Claude connectors that put a product inside AI assistants, from tool design to a directory listing.
• Stripe integrations, including tiered, usage-based billing across every channel a customer uses.

Try it free at pii-purge.com, or talk to us about redaction inside your own pipeline.