Comparison

How to choose a data anonymization tool

Four families of tools claim to solve this problem, and they are not interchangeable. Below is the criteria list we would use if we were buying rather than selling, with an honest column for each family. Where we do not know how a competitor behaves, the cell says so.

See the measured results

Twelve questions worth asking

Each row explains why the criterion matters before it says who passes. If a criterion is irrelevant to your work, ignore the row.

Capability comparison across anonymization tool families
CriterionHexagone AILocal desktop app + hosted APIMicrosoft PresidioOpen-source libraryAzure AI LanguageCloud PII detection serviceLLM + masking promptPrompt against a cloud modelPDF redactionBlack-box redaction tool
Documents never leave the machineIf the original file is uploaded to anyone, professional secrecy is already broken, whatever happens next.YesDesktop app. Hosted option is opt-in.YesIf you host it yourself.NoNoYes
Output stays readable and usable by an AIA document full of [REDACTED] blocks teaches a model nothing. Realistic placeholders keep the sentence intact.YesBLEU 0.83 on RAT-Bench.PartialPlaceholder tags by default.PartialBLEU 0.55 on RAT-Bench.YesBLEU 0.88 on RAT-Bench.No
Same person gets the same pseudonym everywhereWithout cross-document consistency, an AI cannot follow who did what across a case file.YesConsistent across a whole folder.PartialRequires custom code.NoNoDrifts between calls.No
Reversible: you can restore the real namesYou send the masked file to an AI, get an answer back, then put the real identities back in. The mapping stays on your machine.YesLocal mapping, never uploaded.PartialPossible, you build it.NoNoNoDestructive by design.
Handles indirect identifiers, not just namesAge plus occupation plus city plus marital status can single out one person. GDPR asks whether re-identification is reasonably likely, not whether the name was removed.YesLowest re-id rate measured on RAT-Bench.NoPartialPartial58% re-id at level 2.No
Rebuilds the file with its original layoutA contract that comes back as a wall of plain text is not a contract any more.YesPDF, DOCX, XLSX, PPTX, TXT.NoText in, text out.NoNoYesPDF only.
Reads scanned documents (OCR)Half of a real case file arrives as a scan. A tool that only reads digital text silently misses all of it.YesLocal OCR for image PDFs.NoPartialSeparate paid service.PartialPartial
Exportable audit trail of every substitutionYour DPO or a regulator will ask what was detected, what was replaced, and what was missed.YesLocal log, CSV export.PartialYou build it.PartialNoNo
Works without an internet connectionThe strongest guarantee you can give a client is a tool that physically cannot phone home.YesAfter first install.YesNoNoYes
Usable without an engineering teamA library is not a product. Someone has to install, tune and maintain it.YesNoPython library.NoAPI integration.PartialYes
On-premise or air-gapped deploymentSome firms and public bodies cannot install anything that talks to the outside at all.YesEnterprise plan.YesNoNoYes
Published, independent performance figuresAnyone can claim high accuracy. Ask for the dataset, the metric and the competing systems.YesRAT-Bench + Presidio report, both public.PartialOpen source, evaluate it yourself.PartialNoNo
  • Yes Supported
  • Partial Partial, or requires work
  • No Not supported

When each one is the right answer

Microsoft Presidio

Choose it if you have engineers and want full control.

Presidio is the open-source reference and a genuinely good starting point. It is a Python library, not a product: you build the document handling, the OCR, the cross-document consistency, the audit trail and the interface around it, then you maintain them. On our 5,000-sample evaluation it detected 75.30% of ground-truth entities against our 96.95%, and 65.89% against 93.34% once the text contained typos and abbreviations.

Azure AI Language and cloud PII services

Choose it if uploading the document is acceptable to you.

These are solid, well-supported services with one structural problem for regulated work: the document goes to the vendor. For a lawyer or an accountant, that is the very thing professional secrecy forbids, whatever the contract says. On RAT-Bench, Azure also reached its privacy score by over-redacting, scoring 0.55 BLEU against our 0.83, which leaves text an AI can no longer reason over.

Asking an LLM to mask the text

Choose it for throwaway text you would publish anyway.

It is the cheapest option and it reads well, which is why people try it. Two problems. First, the original document has to reach the model, so the confidentiality question is already settled before the masking begins. Second, robustness: on RAT-Bench a GPT-4.1 purifier prompt left 58% of texts re-identifiable once identifiers appeared in slang or non-standard form. Pseudonyms also drift between calls, so the same person becomes three different people across a case file.

PDF redaction tools

Choose it when the document is for a human, not an AI.

Redaction is the right tool for filing a document in court or handing it to a third party. It is the wrong tool for AI work: it is destructive and irreversible, the output is unreadable for a model, and blacking out names does nothing about the combination of age, occupation, city and marital status that actually identifies someone.

Hexagone AI

Choose it if the documents cannot leave the building and you still want to use Claude or ChatGPT on them.

Detection, anonymization and the mapping back to real identities all run on your own Mac or PC. The masked copy is what reaches the AI, the mapping never leaves the machine, and you can restore the real names on the answer that comes back. It rebuilds PDF, Word, Excel and PowerPoint files with their layout intact, reads scanned documents, keeps the same pseudonym for the same person across a whole folder, and logs every substitution for your DPO. On the Enterprise plan it deploys on-premise or air-gapped.

The trade-off is honest: it is a paid product, and it is not a legal-document management system. If what you need is a case library with workflows, buy that instead. If what you need is for confidential files to be usable by the AI tools your team already has, this is what we built.

Straight answers

The questions people actually ask

What is the best data anonymization tool for a lawyer or an accountant?
The deciding criterion is whether the original document leaves the machine. A cloud PII detection service, or a masking prompt sent to an LLM, requires uploading the file to a third party, which is what professional secrecy forbids. A local tool is therefore the only coherent choice. Hexagone AI runs detection, anonymization and the mapping back to real identities entirely on the user's Mac or PC, rebuilds PDF, Word, Excel and PowerPoint files with their layout intact, reads scanned documents, and keeps the same pseudonym for the same person across a whole case file. On the RAT-Bench benchmark from Imperial College London it records the lowest re-identification rate measured, 14% at level 1 and 27% at level 2, with no direct identifier recovered.
Hexagone AI or Microsoft Presidio: which should I choose?
Presidio is an open-source Python library, not a finished product. It fits if you have an engineering team that will build and maintain the document handling, OCR, cross-document consistency, audit trail and interface around it. On 5,000 samples of the public ai4privacy/pii-masking-200k dataset in French, English, German and Italian, Presidio detects 75.30% of ground-truth entities against 96.95% for Hexagone AI. On an augmented set containing typos, abbreviations and paraphrases the gap widens: 65.89% against 93.34%. The full report is downloadable without a form at hexagone.ai/research.
Why not simply ask ChatGPT or Claude to anonymize the document?
Because the original document has to reach the model first, so confidentiality is already broken before the masking begins. There is also a robustness problem. On RAT-Bench, a GPT-4.1 purifier prompt leaves 58% of texts re-identifiable at level 2, when identifiers appear in slang or non-standard form. Pseudonyms also drift between calls, so the same person becomes several different people over the course of a case file.
What is the difference between anonymization, pseudonymisation and redaction?
Redaction deletes the information: the text becomes unreadable and the operation is irreversible. Pseudonymisation replaces each identifying element with a consistent substitute, keeping a mapping that allows a return to the real values. Anonymization aims at a text where re-identification is no longer reasonably likely, including by combining indirect attributes such as age, occupation and city. Hexagone AI produces a reversible pseudonymised copy whose mapping stays on your machine, and measures the residual re-identification risk against the GDPR criterion.
Can an anonymization tool work without an internet connection?
Yes, if the detection models run locally. The Hexagone AI desktop app downloads its models on first install, then works offline: you can cut the network and keep processing documents. Cloud PII detection services and LLM prompt approaches cannot, by construction. On the Enterprise plan, an on-premise or air-gapped deployment is available.
How do I check an anonymization vendor's accuracy claim?
Ask three questions. Which dataset, and is it public? Which metric, and does it measure re-identification risk or merely recall on entities the vendor chose? Which systems were compared, and were they configured fairly? A recall figure on a private dataset with no comparison point is unverifiable. Hexagone AI publishes both: an independent benchmark (RAT-Bench, Imperial College London) and a head-to-head evaluation against Microsoft Presidio on a public dataset, with the full report downloadable without a form.

Compare on your own files.

One week free, no credit card. Nothing is uploaded, so you can test on a real case file without asking anyone's permission.

Download for MacBook a demo