Data re-identification methods are becoming increasingly sophisticated and can lead to disastrous data breaches. Re-identification is a key research topic for computer scientists as it can be used to reveal vulnerabilities of de-identification methods such as anonymisation or pseudonymisation. However, re-identification, even for research purposes, involves processing personal data.
This research paper examines a critical privacy challenge related to LINKABILITY — the ability to connect two pieces of information to the same person.
cloak.business addresses this through 390+ entity types with 317 custom regex recognizers, processed in-memory on German servers with zero third-party data sharing.
The ability to connect two pieces of information to the same person. This is the foundational operation that makes PII dangerous. Nearly every pain point is an expression of linkability being created, exploited, or failing to be broken.
Irreducible truth: You cannot have useful data that is completely unlinkable AND completely useful. The very features that make data informative make it linkable. This is not a bug — it is information theory. The information content of a dataset and its linkability are the same property measured differently.
cloak.business identifies 390+ entity types including advertising IDs, cookie identifiers, browsing interests, location markers, bid request parameters. The dual-layer (317 custom regex + NLP) architecture uses 317 custom regex recognizers with context word analysis and confidence scoring 0.0–1.0 for structured identifiers and spaCy (25 languages) + Stanza (7 languages) + XLM-RoBERTa (16 languages) — all self-hosted for contextual references.
Redact is recommended for this pain point: removing PII before it enters advertising pipelines prevents the 376-times-daily broadcast of personal information. Replace provides an alternative — substituting identifiers with non-trackable alternatives enables advertising analytics without individual targeting. For scenarios requiring reversibility, Encrypt (AES-256-GCM) enables authorized recovery of original values.
The REST API (Business plan) provides programmatic access to 317 custom regex recognizers and 3 NLP engines. Session-based JWT auth for web/desktop; Bearer API key for MCP/REST integration.
This pain point intersects with GDPR Article 6 lawful basis, ePrivacy Directive consent for tracking, Article 7 consent conditions.
cloak.business’s GDPR (Article 25 Privacy by Design), ISO 27001:2022 compliance coverage, combined with Germany only, no third-party transfers, ISO 27001:2022 certified hosting, provides documented technical measures organizations can reference in their compliance documentation and regulatory submissions.
| Specification | Value |
|---|---|
| Platform Version | Analyzer 6.9.1, Image Redactor 5.3.0 |
| Entity Types | 390+ (519 documented) |
| Detection Layers | 317 custom regex + 3 NLP engines (all self-hosted) |
| Languages | 48 UI languages, 37 OCR language packs |
| Anonymization Methods | Replace, Redact, Mask, Hash (SHA-256), Encrypt (AES-256-GCM) |
| Architecture | Zero-storage microservices (in-memory only) |
| Integration Points | Web App, Desktop, Office Add-in, MCP Server (9 tools), REST API |
| Hosting | Germany only, ISO 27001:2022, no third-party transfers |
| Compliance | GDPR Article 25, ISO 27001:2022 |