Abstract BackgroundThe increasing integration of artificial intelligence (AI) systems into critical societal sectors has created an urgent demand for robust privacy-preserving methods.
This research paper examines a critical privacy challenge related to COMPLEXITY CASCADE — pii protection requires perfection across all layers simultaneously.
cloak.business addresses this through zero-storage in-memory architecture with self-hosted NLP models, simplifying the stack by eliminating storage and third-party dependency layers.
PII protection requires perfection across ALL layers simultaneously. One failure anywhere collapses everything. The attacker needs to find ONE weakness; the defender must protect ALL layers with zero failures.
Irreducible truth: Protection = Layer1 × Layer2 × ... × LayerN. Any zero makes the product zero. The attacker gets to choose which layer to attack. The defender must achieve perfection across all of them simultaneously, forever.
cloak.business identifies 390+ entity types including quasi-identifiers, demographic fields, behavioral attributes, medical records. The dual-layer (317 custom regex + NLP) architecture uses 317 custom regex recognizers with context word analysis and confidence scoring 0.0–1.0 for structured identifiers and spaCy (25 languages) + Stanza (7 languages) + XLM-RoBERTa (16 languages) — all self-hosted for contextual references.
Hash is recommended for this pain point: SHA-256 hashing of identifiers before dataset publication prevents re-identification from external data — the Netflix Prize attack fails when identifiers are hashes. Redact provides an alternative — removing identifiers entirely from shared datasets eliminates re-identification risk at the cost of analytical utility. For scenarios requiring reversibility, Encrypt (AES-256-GCM) enables authorized recovery of original values.
The REST API (Business plan) provides programmatic access to 317 custom regex recognizers and 3 NLP engines. Session-based JWT auth for web/desktop; Bearer API key for MCP/REST integration.
This pain point intersects with GDPR Recital 26 identifiability test, Article 89 research processing safeguards.
cloak.business’s GDPR (Article 25 Privacy by Design), ISO 27001:2022 compliance coverage, combined with Germany only, no third-party transfers, ISO 27001:2022 certified hosting, provides documented technical measures organizations can reference in their compliance documentation and regulatory submissions.
| Specification | Value |
|---|---|
| Platform Version | Analyzer 6.9.1, Image Redactor 5.3.0 |
| Entity Types | 390+ (519 documented) |
| Detection Layers | 317 custom regex + 3 NLP engines (all self-hosted) |
| Languages | 48 UI languages, 37 OCR language packs |
| Anonymization Methods | Replace, Redact, Mask, Hash (SHA-256), Encrypt (AES-256-GCM) |
| Architecture | Zero-storage microservices (in-memory only) |
| Integration Points | Web App, Desktop, Office Add-in, MCP Server (9 tools), REST API |
| Hosting | Germany only, ISO 27001:2022, no third-party transfers |
| Compliance | GDPR Article 25, ISO 27001:2022 |