What it detects, what it replaces it with, and under what guarantees

anonimiza.do takes your document, finds the data that identifies a person, replaces it according to the rules you have configured and returns the file in its original format.

Twenty data types across seven families, which you switch on and off one by one or by whole family. Identifiers with a formal structure —NIF, NIE, Social Security, IBAN— are validated by their check digit: nothing that merely looks like one gets redacted.

You can add your own data types by describing them in plain language —«medical record number», «disciplinary case reference»— with no rules to program and nothing to train.

No single method works for everything: a regular expression pins down a NIF exactly but mistakes a surname for a place name, and a language model recognises names but cannot validate a check digit. anonimiza.do combines the two.

References to legislation are deliberately left untouched. «Decreto 45/2019, de 3 de abril» is a date and two numbers, and a naive anonymiser redacts them: the result is an unreadable file with the applicable rule missing from it.

It also groups every way of naming the same person —full name, short form, title plus surname, their role in the procedure— so you decide once and the decision reaches all forty of their mentions.

«The applicant's brother» or «the mayor of a town of 3,000» identify someone without naming them. This is how most anonymisation fails:

When in doubt, it flags: dismissing a false positive takes two clicks in review, whereas a personal data item that slips through is a breach. Thresholds are configurable per data type. If you want the layer-by-layer detail, we cover it in this article.

They are not synonyms, and what you can do with the document afterwards depends on which you pick. anonimiza.do implements both and asks you to choose.

A single run can produce two results if you need them: a pseudonymised version for the internal file and an anonymous one for publication. The mapping table has its own retention period and is destroyed when it expires.

What a data item is replaced with depends on what you need the document for: publishing it, processing it or using it as a test set. You can combine them per data type within the same document.

In a Word file the personal data is usually outside the body —the footer, an endnote, a tracked comment— which is precisely where it survives most anonymisation processes.

Where there is no text layer —a scan, a photo, a fax— it is read with optical recognition and the substitution is applied to the pixels themselves: not an overlaid rectangle of the kind anyone can remove with a PDF viewer.

Spreadsheets and listings

Here the data type of the entire column is inferred, outliers included, so the same person is treated the same way throughout the table. And before a statistical transfer or an open data release k-anonymity is verified: you set the value of k and the system tells you which combinations fall below it, following the AEPD technical note and ISO/IEC 20889.

The whole cycle runs in the browser: you upload the document, pick a template, review, approve and download. For volume, a batch takes several files or a single archive, processes them in parallel and downloads in one go.

Review before publishing

The review screen puts the document next to the detections panel so that checking it takes minutes. You can work detection by detection or by unique value, clearing every occurrence of one value in a single step. Each approval is kept as a numbered version of the document.

Templates, allow list and block list

A template stores the active data types, the mode for each one and the thresholds, and applies to a whole batch: one for grant decisions, another for procurement files. The allow list protects what must never be redacted —your own organisation, its programmes, its regulations— and the block list forces the opposite.

REST API

The API covers the full cycle: asynchronous document submission and synchronous text submission, status queries, downloads and template management. It authenticates per application token —revoking one integration does not affect the others—, notifies by webhook on completion and has a test environment.

CEDESA DIGITAL, S.L. holds a certificate of conformity with the Spanish National Security Framework (ENS) at MEDIUM category, under Royal Decree 311/2022. For a public sector body that removes the work of verifying on its own that the supplier meets what is required of it.

Your organisation is the controller and CEDESA DIGITAL, S.L. acts as processor (article 28 GDPR). Processing is automated: the content is not reviewed, not disclosed and not used to train models. The detail is in the Privacy Policy.

Regulatory framework