GDPR data redaction and data minimization

Sanitext is an EU-based API that detects and masks personal data in text to support GDPR data minimization. It flags names, emails, phones, addresses, dates, and IDs, then replaces them with labels like [EMAIL]. Data stays in the EU and is not sent to a third-party LLM. It is an aid, not a compliance guarantee.

What problem does GDPR data minimization solve?

GDPR Article 5(1)(c) says you should only keep personal data you actually need. Most teams keep too much. Names, emails, and phone numbers leak into logs, analytics events, support tickets, and prompts sent to AI models. Each copy is a new place a breach can happen and a new thing you must explain to a regulator.

The hard part is the same data shows up in free text. A support reply, a chat message, a server log line. You cannot drop a whole column. You have to find the personal data inside the text and remove it while keeping the rest readable.

There is also a second trap. Many teams reach for a US AI service to remove personal data. That means they ship the raw personal data to a third-party model in another jurisdiction first, just to clean it. You have now made an international transfer of the exact data you were trying to minimize.

How do you redact personal data for GDPR?

The pattern is simple. Run text through a detector before you store, log, or forward it. The detector returns spans (label, position, score, matched text). You then mask each span with a placeholder like [FIRSTNAME] or [EMAIL]. The cleaned text moves on. The raw text never lands in the downstream system.

Sanitext gives you two endpoints. POST /v1/detect returns the entity spans so you can decide what to mask. POST /v1/redact returns the text already masked. Use detect when you want control, redact when you want a one-call clean.

Apply this at the edges: before writing logs, before indexing analytics, before sending a prompt to any LLM, and before archiving old records you no longer need in full.

—Detect first, then mask: keep audit counts without keeping raw values
—Mask at ingest, not after the data has already spread
—Redact prompts before they leave your VPC for any model
—Keep document structure so cleaned text is still useful

Why does Sanitext fit GDPR work?

We are based in Spain. We run our own open-weights model (Apache-2.0, from the OpenAI privacy-filter family) on our own Cloudflare infrastructure. Your text is not forwarded to OpenAI, AWS, Azure, or any third-party LLM to be processed. That removes one whole layer of sub-processors and cross-border transfer questions.

Because we own the model, there is no per-token AI cost. Pricing is flat and transparent, so you can redact high volumes without metered surprises. Overage runs $0.35 to $0.60 per 1M characters, up to about 2x cheaper than metered hyperscalers at $1.00 per 1M.

We do not retain raw text. We log counts and timings only, not the content you send. Enterprise plans add EU data residency and a signed DPA. Detection covers 30+ languages, so multilingual EU data does not slip through.

—EU-based vendor, no third-party LLM in the path
—Own model on own infra: zero per-token AI cost
—No raw-text retention: we log counts and timings only
—EU data residency and DPA available on Enterprise
—30+ languages for cross-border EU text

How do you integrate it?

Sign up, pay through Stripe, and get an API key. You can be running a curl in about 60 seconds. There is no SDK lock-in: it is a plain HTTPS POST with a JSON body.

Wrap the redact call in a small helper and put it in front of every sink that should not hold raw personal data. A logging middleware, a queue consumer, an LLM client wrapper. Send text, get masked text back, forward only the masked version.

For testing, the playground lets you paste sample records and see the spans before you wire anything up. Read the docs for the full label list, score thresholds, and byte-offset format.

Is redaction the same as GDPR compliance?

No. This is the honest part. Sanitext is a data-minimization and redaction aid. It reduces how much personal data you store and move. It does not, by itself, make data anonymous under GDPR, and it does not make you compliant.

True anonymization under GDPR is a high bar: data that can no longer be linked to a person by any reasonable means. Masking spans in text reduces risk but residual or contextual data can still re-identify someone. Treat output as pseudonymized at best unless you have assessed it yourself.

Use Sanitext as one control inside your program, alongside legal review, access controls, retention policies, and a DPIA where needed. We give you a strong, EU-hosted tool. Your DPO and counsel decide what counts as compliant.

python

import os
import requests

API = "https://api.sanitext.app/v1"
KEY = os.environ["SANITEXT_API_KEY"]


def redact(text: str) -> str:
    """Mask personal data before storing or forwarding. EU-hosted, no LLM tax."""
    r = requests.post(
        f"{API}/redact",
        headers={"Authorization": f"Bearer {KEY}"},
        json={"text": text},
        timeout=10,
    )
    r.raise_for_status()
    return r.json()["text"]


# Example: minimize a support record before it lands in your warehouse
record = (
    "Cliente Marta Ruiz (marta.ruiz@example.es, +34 612 345 678) "
    "pide reembolso del pedido del 14/03/2026."
)

clean = redact(record)
print(clean)
# Cliente [FIRSTNAME] [LASTNAME] ([EMAIL], [PHONE])
# pide reembolso del pedido del [DATE].

# Reminder: this reduces stored personal data. It is an aid,
# not an anonymization or GDPR compliance guarantee.
store_in_warehouse(clean)

FAQ

Does Sanitext make my data GDPR compliant?+

No. Sanitext is a data-minimization and redaction aid that lowers how much personal data you store and move. It does not anonymize data under GDPR or make you compliant on its own. Use it alongside legal review, retention rules, access controls, and a DPIA where needed.

Is my text sent to a third-party AI like OpenAI or AWS?+

No. We run our own open-weights model on our own Cloudflare infrastructure. Your text is never forwarded to a third-party LLM to be processed, which removes a layer of sub-processors and cross-border transfer questions. We also do not retain raw text; we log counts and timings only.

Do you offer EU data residency and a DPA?+

Yes, on Enterprise plans. Sanitext is a Spain-based vendor, EU data residency is available, and we will sign a Data Processing Agreement. We do not store the raw text you send. All plans run on our own infrastructure with no third-party LLM in the processing path.

What personal data can it detect for GDPR?+

Sanitext detects first and last names, emails, phone numbers, postal addresses, dates, URLs, account and card numbers, and secrets like API keys, across 30+ languages. Labels include FIRSTNAME, LASTNAME, EMAIL, PHONE, ADDRESS, DATE, URL, ACCOUNT, and SECRET, plus prefixes like Dr.

Redaction or anonymization: which does this give me?+

Redaction. Masking spans in text reduces risk but is best treated as pseudonymization, not anonymization. GDPR anonymization means data can no longer be linked to a person by reasonable means, which is a higher bar. Residual or contextual details can still re-identify someone, so assess output yourself.

Minimize personal data without shipping it abroad

Get an API key and start redacting in 60 seconds. EU-hosted, no third-party LLM, no raw-text retention. Free tier gives you 300K characters with no card. Try it in the playground or read the docs.

Get your free API key