Your documents stay with you.

Only your question and the few quoted snippets ever reach an external AI model.

In plain words

Provenize keeps your documents and its memory on your own computer. We do not host your files.

If you want an answer from an AI model running in the cloud, only your question goes out, plus the few text fragments that serve as the source. Names, email addresses and national ID numbers are stripped out first — as well as that can be done automatically. Your full file never leaves your computer.

What never leaves your computer

Privacy here is built in, not a setting.

Guide figure pointing at the answer in the scene

Your files stay home.

Removing personal details

The model never sees real names.

  • Everything on your own computerBuilteverything runs on your own machine
  • Personal details removed before sendingBuiltnational ID checks too — it does not always work, and we say so
  • Erase without breaking the proofBuiltdelete the key, keep the proof
Deep dive: GDPR & data rightsDeep dive: what we do and do not protect

Designed to support compliance with the confidentiality obligations of regulated professions.

Your data rights

Access, erasure, restriction — and proof that it happened.

A request, step by step

Answer the request. Keep the proof.

Rights, mapped

Each capability mapped to the principle it serves.

Access

Art. 15
  • Only with the right permissionBuiltexports are permission-checked and audited
  • Signed exportBuiltintegrity an external party can check
  • export_user_dataBuiltone call, full subject bundle

Consent

Art. 7
  • People as a code, not a nameBuiltnever a real name in the consent register
  • record_consentBuiltconsents are only added, never overwritten
  • Every consent change is an audit eventBuilt

Erasure

Art. 17
  • erase_userBuilterasure via per-subject key deletion: delete the key, content becomes permanently unreadable, the audit chain stays mathematically verifiable
  • Immediate on requestBuilta legal request does not wait for a recycle-bin period
  • Erase single items about a personBuiltitems about a person, not just by them; an item about several people stays
  • Signed proof of erasureBuiltproof the key is destroyed
  • Finish erasing whole documentsPlanned

Restriction & objection

Art. 21
  • Retention-hold roleBuiltblocks erasure while retention applies
  • Left out of search resultsBuilta paused subject is excluded from search
  • set_processing_pausedBuiltrestriction stored and audited

Records of processing

Art. 30
  • generate_ropaBuiltthe register comes from the system itself, not a spreadsheet
  • Richer purposes & categories · PDF exportPlanned

Storage limitation

Art. 5(1)(e)
  • Expired log entries markedBuiltthe log gets a dated note that entries are past their period — they are not deleted, because that would break the chain
  • A retention period per type of dataBuiltfor sessions and the log today; corrections and documents still to follow
  • Retention finished everywherePlanned

Minimisation & privacy by design

Art. 5 / 25
  • Removing personal detailsBuiltbefore anything goes to an external model — a step your own software calls, not an automatic gateway
  • Only the quoted snippetsBuiltan external model sees loose fragments, never your files
  • Test for leaks yourselfBuiltrunnable by you or your client
  • Everything on your own computerBuilteverything runs on your own machine

Security of processing

Art. 32
  • Continuous security checksBuiltcode, keys and known holes checked automatically
  • A log where tampering showsBuiltplus a check you can run yourself
  • Rights per roleBuiltengagement-bound, enforced in the database
  • Signed check number over the whole chainBuiltof the whole chain, checkable by outsiders
  • Encrypted local storagePlanned
Replacing names with codes

Pseudonymised by default. Erasable by key deletion.

  • A separate key per personBuiltin the log entries
  • Erasing means throwing away the keyBuiltchain intact
Evidence instead of promises

Every right comes with proof an auditor can check.

  • Signed evidence filesBuiltexports, erasure receipts, conflict resolutions
  • Every rights action is an audit event on the chainBuilt
  • Proof from leak testsBuiltactively looking for leaked personal details
  • Recheck it yourself (verify())Builtshows whether anything was edited, inserted or deleted
What it does not do

What this does not do — said out loud.

  • Compliance document set (DPA, TOMs) is Planned — drafted with counsel
  • Removing personal details is best effort, not perfect — we publish the known gaps
  • Software supports compliance; compliance itself is organisational
  • At-rest disk encryption is Planned, not built

This page describes product capabilities. It is not legal advice, and using Provenize does not by itself make an organisation compliant.

Shape v1.0 with us.

Become a design partner