For business · Redactor
Personal data out. Everything else intact.
Redactor finds the personal data in any text and replaces it, in one API call: names, contact details, ID and card numbers, and the sensitive kinds GDPR protects most. Your text is never stored.
See it work
The same message, without the person in it
This is Redactor’s actual answer to a made-up support message. What it found is marked on the left; on the right, each find has a placeholder, numbered by kind.
Hi, this is Alex Chen. My card 4111 1111 1111 1111 was charged twice for the same order. I am diabetic and the order was my insulin, so please refund it soon. You can reach me on +1 555 0100 or at [email protected].
Hi, this is [PERSON_1]. My card [PAN_1] was charged twice for the same order. I am [HEALTH_1] and the order was my [HEALTH_2], so please refund it soon. You can reach me on [PHONE_1] or at [EMAIL_1].
Found: a name, a card number, two health details, a phone number and an email address.
What it finds
The personal data GDPR is about
It reads every official EU language and English, and sees past disguises such as an email address written as alex(at)example(dot)com, or invisible characters slipped between letters. Remove everything, or pick the kinds to remove and the kinds to keep.
How it comes back
Placeholders, labels or masks
Placeholders keep the text readable, for people and for AI models: [PERSON_1] and [PERSON_2] are still two different people.
Put the values back on your side. Ask for the mapping and you get each placeholder with its original value. Send the redacted text to an AI model, then put the real values back into its answer yourself. We keep no copy.
Placeholder
Call [PERSON_1] on [PHONE_1]
The default. Numbered by kind, and the same value gets the same placeholder everywhere in the request.
Label
Call [PERSON] on [PHONE]
Only the kind of data that was there.
Mask
Call ********* on ***********
Every character replaced, so lengths and layout stay as they were.
Easy to add
Send it the way you already have it
- One text or a batch. Placeholders are numbered across the whole request, so a person keeps one placeholder in every text.
- Whole JSON documents. Every string value is checked, and keys and structure come back as you sent them. Limit it to the keys you choose.
- Find without changing. Get each find’s kind and position, and leave the text as it is.
- Plain HTTPS. Works from any language, including plain text in and plain text out for scripts.
Request
curl https://redactor.heysec.com/v1/redact \
-H "Authorization: Bearer $HEYSEC_REDACTOR_KEY" \
-H "Content-Type: application/json" \
-d '{"text": "Call Alex Chen on +1 555 0100"}'Answer
{
"text": "Call [PERSON_1] on [PHONE_1]",
"entities": [
{"category": "PERSON", "start": 5, "end": 14,
"placeholder": "[PERSON_1]"},
{"category": "PHONE", "start": 18, "end": 29,
"placeholder": "[PHONE_1]"}
],
"usage": {"characters_in": 29, "characters_out": 28,
"entities": 2}
}Private first
We keep the numbers. Never the words.
The text you send and the text we return are never written anywhere: not to a log, a database, a cache or a file, and not into an error message.
- Metadata only. Who called and from where, when, how much was sent, which kinds of data were found, the options used, how long it took and the outcome. Your request log in the portal shows you these records.
- Tested on every release. A test sends a unique marker through every endpoint and every error, then searches every log and database for it. If it turns up anywhere, the release fails.
- Checked only by heySec’s own systems. On EU servers only. No other company’s AI sees your text.
Where it runs
In our cloud, or inside your walls
Cloud API
Nothing to install
Order Redactor in the heySec portal, create a key and send your first request. Try it in the portal’s playground before you write any code, and follow your usage and request log there. It runs on EU servers only and grows with your traffic.
Join the waitlistEnterprise
Inside your own network
The same detection, installed on your own servers. It needs no connection to the outside world, so it also runs air-gapped: on networks cut off from the internet. Nothing calls home, and your text never leaves the building. Standard servers are enough, with no graphics card.
Contact our teamQuestions, answered
Does it find everything?
No tool does. Card numbers, IBANs and most ID numbers have fixed formats, so they are found by their shape. Names, addresses and health details are recognised from context, so an unusual name or wording can slip through. It leans towards removing, so a word that only looks sensitive may be replaced too. Where a miss would matter, keep a person in the loop.
Which languages does it read?
Every official EU language, and English. You don’t need to say which one is coming; a language hint is there if you know it.
Can it read PDFs or Word files?
It reads text and JSON. Take the text out of the file first, then send it.
How is usage counted?
In characters sent, per calendar month, and you see it live in the portal. Requests we refuse, and requests that fail on our side, are not counted.
Send the text, not the person
Redactor is in private testing. Join the waitlist, or talk to our team about running it inside your own network.