De-identifying company data without breaking it

October 23, 2026 · 8 min read

Company records are worth licensing because they show how work moves between people: who asked, who decided, who followed up. The same records are full of names, email addresses and phone numbers. This piece explains how personal information is transformed before any AI lab sees a record, and why identities are replaced instead of blacked out.

Why redaction isn’t enough

The simplest approach is to delete or black out every name and email. That protects people, but it wrecks the data. In a support thread where everyone becomes [REDACTED], you can no longer tell who escalated to whom. In a project history where the same manager is masked differently each time, one person reads like a crowd of strangers. Labs pay for the links between records, so a dataset stripped of them is worth far less.

Swapping each name for a random fake one fails the other way. “Dana Ruiz” in one email and “D. Ruiz” in the next turn into two different invented people, and the thread falls apart.

What the transformation has to do

• Protect identity. Anything that could identify a real person, on its own or combined with other details, is replaced: names, emails, usernames, employee IDs, phone numbers, addresses and account numbers. The delivered data no longer points back to them.
• Keep the meaning. Text that isn’t sensitive stays as it was, and each replacement fits its place. A name becomes a plausible name, and an email becomes a well-formed address on a consistent domain.
• Stay consistent. The same real person maps to the same stand-in in every file and format, and two different people never collapse into one.

From: Dana Ruiz <dana.ruiz@northwind.example>
To: Sam Okafor

Sam, can you approve the Henderson quote before Friday? Call me on 415 555 0142 if anything looks off.
Dana

From: Maya Lindqvist <maya.lindqvist@harborline.example>
To: Theo Brandt

Theo, can you approve the Callister quote before Friday? Call me on 415 555 0188 if anything looks off.
Maya

How it works, step by step

1. 01

   Inventory

   Every file, mailbox, table and recording in scope is listed before anything changes, along with what’s needed to rebuild it. Large files are split into pieces. The final check counts against this list, so a file that fails or goes missing can’t quietly drop out.

2. 02

   Find and link

   Detectors flag candidate personal information. A second pass across the whole dataset then links the different ways one person shows up (full name, first name, email, username, initials in a signature) to a single identity record.

3. 03

   Replace consistently

   Each real identity gets one synthetic profile: a name, email, username and any other details allowed to appear, generated together so they fit each other. The mapping stays fixed for the whole job, so every piece of every file gets the same stand-in.

4. 04

   Rebuild and check

   The pieces go back into their original formats. Checks confirm every file was delivered and that its structure survived: rows and columns, sheet names, page counts, timestamps. A file can open fine and still carry the wrong stand-in, so content is checked separately.

Where automated review helps

Fixed detectors make yes-or-no calls, and they miss things that only make sense in context: a nickname, a name split across a line break, an account number typed with odd spacing. An AI review step looks at the uncertain cases alongside the surrounding text and the identity records. It can confirm or reject a match, merge two aliases of one person, or separate two people who were wrongly merged.

A wider review catches more, but it costs more and can make mistakes of its own, such as linking two people who share a first name. It works best when it settles uncertain cases and rechecks high-risk files, with the identity records as its reference.

Where people still review

Most company datasets don’t come with an answer key, and they’re too big to check by hand. Reviewers check a sample instead, drawn from the original inventory rather than from the files that came out the other end, so failed and missing files are counted too. They look for:

• personal information that slipped through
• details that were changed but didn’t need to be
• one person split into two, or two people merged into one
• replacements that don’t fit their context or break a document’s layout

Repeated mistakes, such as bank details leaking from one corner of an invoice template, go back into the rules and tests for the next run.

How the approaches compare

Our general assessment of each approach. These are qualitative ratings, not benchmark scores.

What gets measured

Finding personal information is only part of the job, so the finished dataset is judged as a whole. Privacy means no real identity is left. Usefulness means the meaning is intact. Fidelity means files and formats still work. Coverage means every file in scope was processed and none were dropped. Consistency means one person has one stand-in everywhere. How much weight each one gets depends on the data and on what the agreement allows.

What this means for your company

Your data is useful to a lab because it shows how work flows between people, and that survives with the people themselves replaced. Before anything is licensed:

• You choose what’s in scope, and you can leave out any system, folder or record type.
• Identifying details are replaced before any lab sees a record, and raw files are deleted once processing is done.
• If a source holds information you can’t risk sharing in any form, leave it out. No method is perfect, and the agreement can say so.

On our deals, de-identification is carried out by an independent specialist firm under the signed agreement. This page describes the standard we hold that work to. For the full picture, see how we handle company data.