Redacta – Security Data-Protection Summary

Where the data flows

The model receives tokens such as [NHS_NUMBER_1]; the map that reverses them is held in memory inside the boundary service and is never returned in a tool result or API response. Restoration is an explicit act against a session, and sessions expire automatically.

The claim we make, precisely

Redacta can be deployed entirely within your infrastructure. PharmaTools.AI does not need to receive or process the clinical text handled by your Redacta deployment. Detection runs locally in the engine; the self-hosted gateway ships as a container with plain-YAML Kubernetes manifests, so the point where identifiable text becomes tokens sits inside your cluster. Note the scope of the claim: it covers Redacta itself. If your workflow sends the tokenised text to a third-party model provider, that provider remains part of your own processing picture — with the identifiers and the reversal map kept out of what it sees.

Answers for a DPIA or security review

Question	Answer
Where is identifiable clinical data processed?	Identifiable clinical text and the re-identification map remain inside your environment; the engine and gateway run where you deploy them, and no clinical text is sent to PharmaTools.AI. The AI model receives tokenised text only. Tokenisation is pseudonymisation, not anonymisation — whether the tokenised text remains personal data for your particular processing activity should be assessed in your DPIA.
What does the AI model receive?	Tokenised text only — labelled placeholders in place of names, NHS numbers, dates of birth, addresses and other identifiers, with clinical meaning preserved.
Where is the re-identification key?	In the boundary service's process memory, scoped to a session. It is never included in tool results, API responses, or the model's context.
What is retained, and for how long?	Nothing is written to disk by the boundary; token maps live in memory and sessions expire automatically. Restored output is written only to a location you configure.
What is logged?	Method, path, status and duration — no message bodies, no identifiers, no PHI.
How is access controlled?	The gateway supports a bearer-token requirement on every endpoint, supplied via a Kubernetes Secret; network exposure is under your cluster's own controls.
Is output checked as well as input?	Yes — `check_output` screens model output for identifiers that returned verbatim and re-tokenises them without echoing raw values.
What is the licence?	MIT-0, fully open source — the code, design notes and acceptance tests are public and auditable.

Evidence, with its limits

Redacta publishes its evaluation results rather than asserting them. A reproducible accuracy benchmark of the deterministic engine records 100% recall and zero false positives across 300 synthetic UK clinical notes (1,713 gold-labelled identifiers), with every metric identical across 10 independent seeds (method and limits). The Redacta Gauntlet, an adversarial evaluation covering hostile formatting, prompt injection, contextual leakage and downstream consumers, records 91.5% in-scope recall, zero downstream leaks and 100% injection resistance, and runs CI-gated on every change (full results, including what it doesn't solve).

Read this before quoting the numbers. The benchmark uses synthetic notes; the Gauntlet is an adversarial evaluation, not a penetration test, and its published scope notes list the attack classes it does not cover. Redacta is a strong first line of defence, not a guarantee, and does not replace your organisation's formal data-protection processes. We would rather you knew that from us.

Roadmap on request

Encrypted vaults, role-based access, policy files and audit export are planned production capabilities. They will be prioritised in response to the requirements of deploying teams rather than built speculatively. If one is a requirement for your deployment, tell us — design-partner requirements directly shape the production roadmap: info@pharmatools.ai.