Choosing document anonymization software: the 8 criteria that matter

Three families of tools, three paths for your files

Document anonymization tools fall into three families; your file does not follow the same path in each.

• Online services. You drop the file on a web page; it goes to the publisher's servers, is processed there, then comes back to you. Nothing to install, but the document leaves your computer. If the publisher claims everything happens in the browser, ask how to verify it.
• Browser extensions. They act on web pages, for example to mask text before it goes to an AI assistant. Depending on their design, processing happens in the browser or on the publisher's server. Look at the permissions requested at installation.
• Desktop software. Installed on the computer, it can process files on the spot. But installed does not mean offline: part of the work may go to a server.

The family is therefore not enough: only the tool's actual behavior counts. For a single PDF, see our comparison anonymizing a PDF online or offline.

The 8 criteria for choosing anonymization software

1. Where the document is processed

Why it matters. On a server, the file has left your computer, if only for the time of processing: it can be logged, backed up or retained there. Processed on the computer, it does not leave the disk. In principle, the GDPR processor question also depends on this location (see below).

The question to ask: does my file, or its text, leave my computer during processing? If so, to which servers, in which country, and for how long?

2. Where the mapping table stays

Why it matters. Replacing “Camille Durand” with [PERSONNE_1] does not cut the link: a table says who is behind each label. Under the GDPR, there is pseudonymization only if this “additional information” is “kept separately” (Article 4(5)). Whoever holds the table can re-identify the whole case file: if it stays with the publisher or travels with the copies, the protection is lost. And as long as it exists, this is pseudonymization, not anonymization.

The question to ask: where is the table stored, who can read it, is it encrypted, and does it travel with the exported copies?

3. What the software sends over the network

Why it matters. Installed software may connect to check a license or an account, send usage statistics (telemetry) or run an AI chat hosted in the cloud. The last case weighs the most: the text of your documents then goes to a server, which may belong to another provider.

The question to ask: what connections does the software open, when, and with what content? Does it work with the network off? If an AI chat is built in, where does the text go?

4. The formats it reads

Why it matters. Each format has its traps. A scanned PDF is an image: without character recognition (OCR), the software sees no names, and a reading error can let one slip through (see anonymizing a scanned PDF). A Word file can contain comments and tracked changes, a spreadsheet columns of names, an email headers and attachments. Start from your real case files: judgments and scanned exhibits in a law firm, trial balances and spreadsheets at a chartered accountant's.

The question to ask: which formats do you really read, scans included, and what happens to a file you cannot read: flagged, ignored or copied as is?

5. Processing an entire case file, with stable labels

Why it matters. Processed file by file, the same name can become [PERSONNE_1] in one document and [PERSONNE_3] in the next: the AI then thinks it is dealing with two people, and its analysis goes wrong. Variants raise the same problem: “Camille Durand”, “Mrs. Durand” and “C. Durand” may refer to the same person. Labels that stay stable across the whole case file keep the logic of the matter; a renamed label, such as [PERSONNE_CLIENTE], makes it easier to read.

The question to ask: does the same person keep the same label in every document, variants included? Can you drop in an entire case file and rename a label?

6. Review before export, and real deletion

Why it matters. No automatic detection is perfect. The tool should show the original and the copy side by side, let you mask a forgotten passage and block export until the document is approved. At export, covering is not enough: a black box placed on a PDF can leave the text underneath, readable by copy and paste (see why a black box is not enough). The file's properties, such as the author, can also contain a name: see a PDF's metadata.

The question to ask: is the masked text deleted from the file, or only covered? Are metadata and annotations removed? Can you export a document that has not been reviewed?

7. Putting the real names back into the AI's answer

Why it matters. If you pseudonymize in order to work with an AI, its answer comes back with [PERSONNE_1] and [ORGANISATION_2]. Putting the real names back by hand is slow and error-prone. The tool should do it with the mapping table, on your computer, with a preview before saving. The AI must still keep the labels intact: an instruction to give it helps, and a modified label should be flagged, not guessed.

The question to ask: can you put the real names back into the AI's answer? Where, in which formats (text, Word, PDF), and what happens if the AI has modified a label?

8. The price and the licensing model

Why it matters. Anonymization software is paid per seat, per page or per document. A per-page price looks modest during a trial, then climbs with a case file of several hundred pages. A per-seat price with no cap is predictable, whatever the volume. And a license checked online brings you back to criterion 3.

The question to ask: what exactly do you pay for, with which caps, and how much over a year with my real volume? Is the license checked online?

GDPR processors: what the place of processing changes

The GDPR calls a processor the body that “processes personal data on behalf of the controller” (Article 4(8)). A service that anonymizes your documents on its servers in principle falls under this definition.

Under Article 28, you may only use processors “providing sufficient guarantees”. The relationship is governed by a written contract, which provides in particular for the deletion or return of the data at the end of the service. And the provider does not engage another processor without your prior written authorization. So ask for this contract, and for the list of its own processors.

With software that processes everything on your computer, the publisher does not receive your documents: for this step, it in principle processes no data on your behalf, and the processor question does not arise. It comes back if the software sends text elsewhere, to a built-in AI for example. As for the copy then given to an AI, it is pseudonymized, not anonymous: according to the CNIL, such data “therefore retain a personal character” (our translation).

The 8 questions, and AnonymFiles' answers

Our answers for AnonymFiles, coming soon for Apple silicon Macs and Windows. Ask other publishers the same questions.

Automatic detection finds names of people, organizations, addresses, emails, phone numbers in French format, IBANs from nine European countries, private dates and ID numbers. Since no detection is perfect, every document is reviewed before export: see how AnonymFiles works, step by step.

Checking the answers during the trial

Four tests, valid for any tool:

• A dummy case file. Test with fake documents, never with a real client file.
• The network off. After a first use, turn off Wi-Fi and run processing again: a local tool works the same way. An application firewall shows the attempted connections.
• Copy and paste. In an exported PDF, select a masked area and paste it into a text editor: nothing should reappear.
• The export folder. No real name should appear in the metadata, the file names or an attached table.

For AnonymFiles, the security and network scope page details these checks.