Pseudonymization means replacing every piece of sensitive information with a neutral token before sending, while keeping the mapping locally so the real values can be shown back to you. Not to be confused with anonymization, which would destroy the information: here everything stays usable, but nothing identifiable leaves.
Three detection layers, all local
Every analysis runs your text through three layers, in priority order:
- The vault dictionary: the terms you added yourself (company name, projects, people). Deterministic: a dictionary term is masked, period.
- Structured patterns: emails, phone numbers, social insurance numbers, monetary amounts. Recognized by their shape, in French and in English.
- The local inference engine: an entity-recognition model built into the app, which spots person names, organizations, places and amounts nothing else caught. It runs entirely on your machine: no cloud detection service.
When layers overlap, the most reliable one wins (dictionary over patterns, patterns over inference). And when in doubt, Trust6 prefers masking too much over too little.
Stable tokens, per vault
Every detected value gets a token: PERSON_001, ORG_002, AMOUNT_001. The mapping is stable within the vault: “Jean Tremblay” gets the same token in all your messages and attached documents. The AI model can follow the thread (“PERSON_001 replied to PERSON_002”) without ever knowing who is who.
The mapping table lives in the vault’s encrypted database, on your machine. When an answer comes back, the app swaps tokens for real values on screen, for you only.
What if detection fails?
Then nothing leaves. That is the fail-closed rule: a failed analysis, an unreadable document or text edited after analysis all block the send, with a clear message and an audit trace. There is no silent fallback to clear text. See “Send blocked”: why and what to do.