Your data should not train someone else's AI

of employees use LLMs at work

68%

of companies ban AI — to little effect

74%

average cost of a data breach in Russia

₽51M

fine under 152-FZ for violating data localization

up to ₽18M

Sources: Gartner 2024, InfoWatch 2024, 152-FZ.

1. 01

   Employee or system

   Writes a request with real data — in the web chat or through the familiar OpenAI/Anthropic SDK.

2. 02

   Aitechestvo

   Finds personal data, company details, amounts and secrets and replaces them with placeholders per company policy.

3. 03

   LLM provider

   Receives placeholders only. The answer flows back through the gateway and the data is put back — including streamed answers.

• Placeholders are restored automatically — even with Russian grammatical cases, e.g. [ФИО_1:род] → “Иванова Сергея”.
• The gateway never stores request or answer content — only metadata for audit.
• If masking fails, the request never reaches the model. Data is never forwarded as is.

• Personal data

  Names, date of birth, passport, SNILS, health insurance policy, driver licence

  Pseudonymization

• Contact details

  Phone numbers, emails, postal addresses, IP addresses

  Pseudonymization

• Financial data

  Bank accounts, BIC, card numbers, IBAN, deal amounts

  Pseudonymization or ranges

• Company identifiers

  INN, OGRN, KPP, organization names

  Pseudonymization

• Trade secrets

  Project and product names, code names — via dictionaries and patterns

  Pseudonymization or blocking

• Medical data

  Diagnoses and ICD-10 codes

  Blocking or pseudonymization

• Credentials

  Passwords, tokens, API keys, private keys, connection strings

  Always blocked

• Geolocation

  Coordinates, place names

  Pseudonymization

• Custom rules

  Anything matching your regular expressions and dictionaries

  Custom rules

4 ways to react

• Pseudonymize

  Replace with [PERSON_1], [INN_1] and restore in the answer.

• Generalize

  Replace with a range: “$480,000” → “$400k–500k”. Not restored.

• Block

  The request never reaches the model; the employee sees why.

• Warn

  The request goes through; the employee and the security team are notified.

• OpenAI-compatible API

  /v1/chat/completions, /v1/embeddings, /v1/models — with streaming, tools and structured output.

• Anthropic-compatible API

  /v1/messages with streaming, tools and thinking — for the Anthropic SDK and compatible clients.

• Web chat for employees

  A familiar chat UI: history stays in the browser only, and “what the model saw” is one click away.

• Mask / unmask API

  Mask and restore text in your own systems: RAG indexes, tickets, documents.

• On-premise

  A Helm chart for your own Kubernetes — for companies with strict security requirements.

• LLM providers in your region

  YandexGPT, GigaChat and your own OpenAI-compatible models (vLLM, Ollama and others). Foreign providers that do not serve Russia are not available in the Russian region.

On the roadmap: Browser extension, Microsoft 365 Copilot plugin, SSO (SAML) and LDAP/AD sync.

• 152-FZ, Art. 12

  Cross-border transfer: real personal data stays inside — the provider receives placeholders.

• 152-FZ, Art. 19

  Technical safeguards: pseudonymization, access control, a request log without content.

• 98-FZ “On Trade Secrets”

  Block or mask names, amounts and company details using your dictionaries and patterns.

• 152-FZ, Art. 18(5)

  The Russian region is a separate installation in Russia with its own database.

Masking reduces risk but does not guarantee legal compliance: no detector is 100% accurate. We list the residual risks openly.