How BRANE protects
Five guardrails for every prompt.
Real-time detection, reversible masking, context preservation, local vault, policy per data class.
Real-time detection.
Layered detection from patterns, NER models and an address model finds personal data — from names and IBANs to Art. 9 GDPR health data — before the prompt leaves your network.
Reversible pseudonymisation.
Sensitive entities are replaced with stable tokens. The cloud LLM works on context; BRANE resolves tokens back to cleartext on the response path.
Context preservation.
BRANE keeps the prompt usable. Person, address, account — masked but coherent, so the AI can still reason about relationships.
Local vault.
Token-to-cleartext mapping stays inside your BRANE instance, never in the cloud. The vault is encrypted and EU-sovereign.
Policy per data class.
Different rules for PII, PHI, IP, contracts — per role, per use case. Compliance teams define once, BRANE enforces everywhere.
The decision is made in three phases.
Every message passes through the Guardian Core before it is processed. It decides in real time: process locally, send to the cloud anonymized, or block.
- 1
Hard constraints · under 1 ms
Image content is extracted locally and checked like text. If a chat is already sensitive, the mode is set to local only, or no cloud access exists, processing stays local.
- 2
PII detection · milliseconds to seconds
Pattern checks, local NER models and a context-based check by the local language model run together, from IBAN to the special categories under Art. 9 GDPR.
- 3
Routing decision
No PII found and the cloud is allowed. PII with policy Block forces local processing, PII with policy Anonymize goes to the cloud masked.
Three ground rules of the Guardian
- 01
When in doubt, processing stays local. If the semantic check returns no usable verdict, for example after a timeout, the local model answers.
- 02
Once a chat collects personal data from several categories, it stays local for the rest of the conversation.
- 03
If a core detector for names, addresses or identifiers fails during the routing check, processing stays local.