Keep the secret on the device: local anonymisation before AI

Portfolio managers, lawyers, trustees and public administrations already use ChatGPT and Claude, often with client data. The legal question is not whether staff should use generative AI, but how they can use it without disclosing what they are bound to keep secret. Our thesis: if identifiers are removed on the user's own device and the key to restore them never leaves it, the AI provider receives neither personal data nor a protected secret. Swiss and EU law support that result, within limits this article sets out.

Shadow AI turns a productivity tool into a secrecy problem

In the 2025 global study by the University of Melbourne and KPMG, covering more than 48,000 people in 47 countries, almost half of employees admitted using AI against company policy, including uploading sensitive information into free public tools. The FDPIC and the NCSC dedicated their joint Cyber Security Month campaign in October 2026 to exactly this kind of oversharing at work.

The consequences differ by profession. Portfolio managers and trustees are bound by professional secrecy under Art. 69 FinIA; intentional breach carries up to three years' imprisonment, negligent breach a fine of up to CHF 250,000. Lawyers are bound by Art. 321 SCC and Art. 13 BGFA. Public administrations are bound by official secrecy under Art. 320 SCC. Other professionals who learn secret personal data in their work, such as fiduciaries, fall under Art. 62 FADP. A ban rarely ends the practice; it moves it to private devices.

The Desktop Anonymizer keeps the key on the device

The Desktop Anonymizer runs on the user's computer and handles PDF files, including scanned pages, Word documents and text entered in its chat. Text recognition and detection both run locally. A language model on the laptop detects names, companies, places and addresses; structured numbers such as IBANs and AHV numbers are additionally verified by their checksum. Identifiers are replaced by consistent placeholders such as «Client 1» or «Account 1». Within a project, the same name always receives the same placeholder, across documents and chats, so the model can still work with relationships, dates and amounts.

The mapping between placeholders and real values, in effect the key, never leaves the computer and is kept separately for each project. It is protected by the operating system's disk encryption (FileVault on macOS, BitLocker on Windows), which firms should therefore have enabled. The placeholder text cannot be reversed on its own: the original values can be restored only with this locally held mapping. Redaction works fully offline once the models have been downloaded. When the chat is used, only pseudonymised text is sent to the AI model, and the real values are reinserted on the computer for display. For documents, the Desktop Anonymizer saves a redacted copy next to the original, which remains unchanged; removed values are highlighted so the user can review and adjust them before export. We describe the workflow step by step in anonymising documents before ChatGPT or Claude.

Detection errs on the side of hiding too much

In our tests, the Desktop Anonymizer finds 99 of every 100 personal details such as names, places and addresses. In legal terms, this recall is the decisive figure: a missed identifier is a disclosure, whereas an unnecessary replacement only costs readability. Detection is therefore set to hide too much rather than too little. Every redacted file is read back before release; if personal data is still readable, the file is refused rather than handed out. The same applies to files that cannot be processed safely, such as scans too blurred to read. They are never released half-redacted.

In a test on 95 real client documents (65 PDF, 30 Word), all Word files were redacted correctly; the PDF results are still being evaluated. Because no detection reaches 100 %, human review remains a fixed part of the workflow rather than an option.

Anonymisation profiles reflect what each profession must protect

Removing too little breaches secrecy; removing too much makes the output useless. A lawyer needs deadlines intact, a portfolio manager needs ISINs intact. The Desktop Anonymizer therefore works with anonymisation profiles that define which categories are replaced and which are kept. Firms can use standard profiles or create their own for each use case.

• Legal. Replaces parties, opposing counsel, witnesses, addresses and case numbers. Keeps statutory references, case law and procedural dates. Typical use: summarising a file or reviewing a draft submission without revealing who is involved.
• Trusts and fiduciaries. Replaces settlors, beneficiaries, protectors, company names, UID and tax numbers. Keeps jurisdictions, structure types and tax rates. Typical use: a structuring memo or tax correspondence.
• Public administration. Replaces citizens' names, AHV numbers, addresses, dates of birth and file numbers. Keeps legal bases and procedural steps. Typical use: drafting a decision or answering an enquiry.
• Wealth management. Replaces client names, IBANs, custody and portfolio numbers and addresses. Keeps ISINs, asset classes, allocations and performance. Typical use: a quarterly commentary or a meeting dossier in which the model sees the portfolio but not whose it is.

Profiles also turn an individual judgement into a documented firm rule that can be explained to clients, audit firms and supervisors.

Swiss data protection follows a relative approach

Personal data is information relating to an identified or identifiable person (Art. 5 let. a FADP). Identifiability is assessed relatively: if identification would require effort that, on general experience, no one would undertake, the data is not personal data. The Zurich Commercial Court held in 2021 (HG190107) that pseudonymised data is not personal data for a recipient without the key or other means of attribution, so transferring it is not a disclosure abroad within the meaning of Art. 16 FADP.

The position is not uncontested. The FDPIC's guide on technical and organisational measures still treats pseudonymised data as personal data, and in Logistep (BGE 136 II 508) the Federal Supreme Court looked at what the recipient could do with the data. The firm itself remains the controller, and its own processing must meet privacy by design (Art. 7 FADP) and data security (Art. 8 FADP). A key that never leaves the device implements both directly.

The CJEU now looks at the recipient's perspective

For EEA clients, the GDPR applies in parallel. Anonymous data is outside its scope (Recital 26), and pseudonymisation requires that the additional information is kept separately (Art. 4(5) GDPR). In EDPS v SRB (C-413/23 P, 4 September 2025), the CJEU held that pseudonymised data is not personal data for a recipient who has no means reasonably likely to be used to re-identify the person. The controller's own obligations remain unchanged.

No disclosure without knowledge

Secrecy offences require disclosure: a third party must be able to learn the secret. Swiss legal writing holds that information which is anonymised or encrypted for the recipient is not disclosed. That is the decisive difference to the alternatives. The Swiss Bar Association's AI guideline of 14 June 2024 allows confidential data in AI tools only on-premises, under the rules on auxiliary persons, or with the client's informed consent. Local anonymisation removes the secret before that question arises.

FINMA Guidance 08/2024 sets out supervisory expectations on AI governance: an inventory, clear responsibilities and independent review. It is not a binding instrument, and portfolio managers are supervised by a supervisory organisation rather than directly by FINMA, but it is reasonable to assume it will serve as a benchmark. Where third parties are used, Art. 14 FinIA and Art. 15 to 17 FinIO apply. Anonymisation profiles and the review step fit this framework as documented controls.

Context can still identify

Placeholders do not neutralise context. A unique transaction, a rare profession or a publicly reported dispute can point to one person without a name. Anonymisation also does not legitimise unlimited processing within the firm. The tool reduces what leaves the device; responsibility stays with the firm and the professional.

The Desktop Anonymizer by Unplex

Unplex builds the Desktop Anonymizer for portfolio managers, law firms, fiduciaries and administrations that want to use Claude, ChatGPT or other models with sensitive documents. Detection and the mapping run on the user's device, on macOS and Windows. The information security management system behind Unplex is certified to ISO/IEC 27001:2022 by SQS.

Keep the key, use the model

In our view, local anonymisation with a key held only on the device is currently the most defensible way for regulated professions to use frontier AI models. In practice, that means making anonymisation mandatory before any AI use, defining a profile for each use case, enabling disk encryption, documenting the re-identification assessment and keeping the review step.

Request a demo

As of November 2026. General information, not legal advice.