Let AI work on your company's data without ever seeing it

Your colleagues already work with models that run outside the company, and the text they send carries names, addresses, identifiers and amounts. JANUS-Edge is our answer to that: a gate on your own server, sitting between those users and the external artificial intelligence models, swapping sensitive values for stand-ins before a request goes anywhere.

What most “anonymise the prompt first” pitches leave out is the price. Protection costs something, and the cost lands in the answer. Deußer and colleagues ran five models across eleven benchmarks: on retrieval-augmented generation the score drops by 22 to 48 percentage points, with one model falling from 0.80 to 0.32. The authors call the decline catastrophic. The same paper points at the way out — where they compared techniques head to head, on one model and three of the eleven benchmarks, a stand-in that preserves the uniqueness of each entity lost less than deletion or generalisation did.

So the real question is narrower than “protect your data or get work done”: what you replace, for which request, and what you put back in the answer. Here is how we answer it, what runs today, and what you can check yourself. What actually leaves a company when someone pastes a paragraph into a chatbot is the next article.

What a company wants, in three sentences

Sensitive data does not reach the external model. The provider receives a text in which names, addresses, identifiers and amounts have been swapped out. What gets swapped, and how consistently, is a policy decision rather than fixed product behaviour.

Putting values back does not become a side door. A real value re-enters in one kind of place only: the text of the answer returned to the user who sent the request. Not in a URL inside that answer, not in an image source, not in tool arguments.

You can prove what left. The log line is written before the request leaves, and reports come out without sensitive content, so they can be read by someone who is not cleared for the data itself.

What this looks like on an ordinary workday

Someone in contracts pastes a paragraph carrying a name, an address and an identification number, and asks for a rewrite. The rewrite comes back on their screen with the real values restored in the text. What reached the provider was a version in which those values had been swapped.

A developer points one base URL in a library at the gate, and the chat calls their script makes go through the same rules, without a line of code changing. This is the traffic a browser extension never sees: internal applications, overnight jobs, direct API calls. How much each channel weighs at a given company shows up during a pilot — we do not have that figure.

The third case is the interesting one. A strategy paragraph cannot be masked without losing its meaning: swap the company names and the market and nothing is left to reason about. Here the gate does not block. It sends the request to the model running on your own premises instead. That is a choice between destinations, not between working and being protected.

Why a pattern filter is not enough

REDACT, a benchmark published in June 2026 with 13,427 records across 25 languages, puts a regular-expression detector at 0.07 recall on its most sensitive tier — special categories under Article 9 of the GDPR (General Data Protection Regulation), criminal matters, and identifiers that make a record linkable to a person, date of birth among them. The systems that are not rule-based climb to 0.42 for an entity model, 0.57 for an open filter published by a model vendor, and 0.74 to 0.77 for two large language models; for all four, that tier is their best one. The figures belong to the REDACT authors, measured on a synthetic sample of a thousand records, and Romanian is not among the 25 languages.

A second measure changes how any of those results should be read. The Text Anonymization Benchmark counts an entity as protected only when every one of its mentions has been masked, so a single miss in a long document cancels the rest. On that benchmark, a rule-based detector reaches mention-level recall around 0.70 over direct and quasi-identifiers together, while its entity-level protection of direct identifiers alone sits at 0.45.

Hence layers rather than a filter. Rules handle what has a fixed form and a check digit. An entity model handles what does not. Grey cases go to a model that also runs on your hardware. And the decision is made on data classes — what kind of information this is — rather than on the pattern it happens to be written in.

The answer is where most designs stop looking

For the values that were swapped out, the model is blind. It does not know them, so it cannot leak them. A real value re-enters the text at one point, when it is put back, and that is where the attacks go.

Three public cases from 2025 show the pattern, all demonstrated by researchers and fixed by the vendors. EchoLeak, CVE-2025-32711, showed data leaving an office assistant with no click from the victim; the vendor scored it 9.3 on CVSS (the common vulnerability scoring system), while NVD (the US National Vulnerability Database) gives 7.5 in its own analysis. In CamoLeak, a researcher used GitHub’s own image proxy — allowed by the content security policy precisely to stop arbitrary outbound requests — and pre-generated a legitimate address for every character, so the secret could be reassembled from the order in which images loaded, with nothing sensitive in the addresses themselves. The fix was to turn image rendering off entirely in that chat. In ForcedLeak, the research team read the content security policy, found an allowed domain that had expired, and bought it for five dollars.

All three started with an instruction hidden in content the model was reading. The data, though, did not leave that way — it left through the answer. How little an allowlist buys you also shows in a paper from October 2026: malicious software already running on a user’s machine, with no internet access of its own, hides a secret in a URL the model then fetches as a legitimate one, with a 79.7% success rate across eleven open-parameter models.

So the decision belongs at the place in the answer where a value would land, rather than at whatever the URL contains. That is how we are building the exit gate. That restoration can be its own exit channel is what the three cases above show; it is not an observation of ours.

Masked is not the same as anonymous

Even where masking works well, context gives people away. At ACL 2026, Oh and colleagues showed that with over 90% of personal-data spans masked, subject-level protection drops as low as 33%. On AgentDOXX, after entity masking, at least one attacker succeeds on 85.3% of a sample of transcripts.

The lever you do control is scope: how widely the same stand-in keeps standing for the same value. The EDPB (European Data Protection Board) guidelines of January 2025, adopted as a version for public consultation, recommend defining the sets pseudonymised consistently as small as possible, preferring pseudonyms tied to a single transaction. ENISA (the European Union Agency for Cybersecurity) put the other end of the same trade in 2019: consistent pseudonymisation buys utility and allows records to be linked.

Scope is therefore a policy parameter: a gain in answer quality against a cost in confidentiality, both of them measurable. One more thing deserves watching: what a provider has accumulated from your company over months, across every conversation, and not only what sits in the request in front of you.

If your language is not English, check before you buy

The open personal-data detector published in April 2026 by a model vendor describes itself as “primarily English” and warns that performance drops on text that is not. It carries eight fixed labels and no dedicated label for national identity numbers: identity cards, passports, social-security and tax numbers all fall under one account-number class. Its model card reports F1 (the harmonic mean of precision and recall) between 0.914 and 0.934 on six European languages, and between 0.758 and 0.933 on thirteen others. Romanian appears in neither table. Another open model from 2026 covers seven languages, Romanian not among them.

We build for Romanian, so that is the case we know in detail, and what exists for it exists only in part. The closest public model carrying Romanian labels reports F1 0.827 overall on its authors’ own synthetic benchmark and 0.66 on Romanian; the Romanian national identification number comes out at 1.00 there, while the identity-card series comes out at 0.00, because the model finds the span and mislabels it as a British identifier of similar shape — the authors write this in the model card themselves. Open data does exist: 1.43 million synthetic examples under a Creative Commons attribution licence, in 23 languages including Romanian.

The pieces are on the table, then, and none of them has been measured on real Romanian documents. That is the work we are doing: an evaluation set with identifiers that pass their check digits, categories with no fixed form, grammatical agreement, and an attacker that tries to re-identify. We quote no figures of our own until the measurement exists.

How it can be checked

A product like this is judged by what it can show. The log line is written before the request leaves rather than after, and reports come out without sensitive content so that the proof is not itself a leak. Signing the chain and anchoring it off the machine come with their own stage — they are not shipped today.

We say now what we measure, and we will say what we got once we have it. Coverage gets reported per data class instead of as one global percentage. Protection is counted per entity, with the metrics the literature uses. Re-identification is measured with an attacker. The whole gate gets attacked adversarially against a single target: whether a real value reached the attacker. Today’s public benchmarks measure agent hijacking — prompt injection and unauthorised tool calls; one that measures leakage through a proxy we did not find, so we are building it.

What runs today, what is not new, and what we do not cover

Today the gate covers OpenAI-compatible chat calls: masking on the way out, and restoring values in the text of the answer. Web, desktop, mobile and agents each follow in their own stage. Inspecting the answer, signing the log and role-gated disclosure are designed, not delivered. The browser extension is not shipped.

An intermediary that masks before the model and restores in the answer is available today, free and paid. Routing to a local model exists in open projects and in peer-reviewed work. Shadow mode, with “what would have been stopped” written to a log, is publicly described, including from a real production system; at our end it comes with its own stage. Large data-loss-prevention products already carry a data type for the Romanian national identification number. Stop at that list and we would be one more of the same.

What we did not find put together, from what we checked, is something else: the whole data plane on the client’s machine, coverage for the language and the documents in question, restoration bound to the place in the answer, and proof an outsider can verify. That combination is what we are building. The phrasing stays “we did not find” rather than “it does not exist” — we searched as far as we could, not exhaustively. And the quality loss from masking gets measured on each client’s own tasks.

Where it runs, and the order we ship in

Everything runs at the client: the gate, the place real values are kept, the log. That moves a risk to you as well. Over time that place becomes the register of sensitive values that have passed the gate, and whoever loses the key loses the way back for all of them. So before the first request we agree with you on how long anything is kept and who can reach it.

We ship from the inside out: the gate for internal applications and for models on your own premises is the part running today, because it installs without anyone changing what they do; the remaining channels follow.

For the older context, the May article on the control threshold describes where this product line started; both the literature and what we check before saying anything have moved since.

A pilot at your site

A CAI Technology pilot runs on one channel and on your real traffic. You end up with the log of the run and with coverage measured on your own traffic, on your own data classes. Everything installed stays in your systems, and the figures come out of the run rather than off a slide.

Write to us about a pilot and tell us which channel to start with.