How BRANE protects
Five guardrails for every prompt.
Real-time detection, reversible masking, context preservation, local vault, policy per data class.
Real-time detection.
Layered detection identifies 23 PII categories — from IBANs to Art. 9 GDPR health data — in under 200 ms, before the prompt ever leaves your network.
Reversible pseudonymisation.
Sensitive entities are replaced with stable tokens. The cloud LLM works on context; BRANE resolves tokens back to cleartext on the response path.
Context preservation.
BRANE keeps the prompt usable. Person, address, account — masked but coherent, so the AI can still reason about relationships.
Local vault.
Token-to-cleartext mapping stays inside your BRANE instance, never in the cloud. The vault is encrypted and EU-sovereign.
Policy per data class.
Different rules for PII, PHI, IP, contracts — per role, per use case. Compliance teams define once, BRANE enforces everywhere.
The decision is made in three phases.
Every message passes through the Guardian Core before it is processed. It decides in real time: process locally, send to the cloud anonymized, or block.
- 1
Hard constraints · under 1 ms
Image content is extracted locally and checked like text. If a chat is already sensitive, the mode is set to local only, or no cloud access exists, processing stays local.
- 2
PII detection · under 200 ms
A regex scan, a local NER model and a context-based LLM scan run together. They cover 23 PII categories across seven groups, from IBAN to the special categories under Art. 9 GDPR.
- 3
Routing decision
No PII found and the cloud is allowed. PII with policy Block forces local processing, PII with policy Anonymize goes to the cloud masked.
Three assurances that cannot be disabled
- 01
When in doubt, processing stays local. Detected PII only leaves the system anonymized.
- 02
Once sensitive means always local. As soon as a chat contains PII, the entire conversation stays on local infrastructure.
- 03
If a core PII detector fails or detection is uncertain, processing stays local.