Local Data Protection:
14-Day Sandbox Pilot Request Pilot
OmitPII - Local AI Data Protection OmitPII
Request Pilot
Local Workstation Proxy • Zero Cloud Data Custody

Let your team use AI on client work.
Without confidential records ever leaving the firm.

Give fee-earners the drafting power of Claude, ChatGPT, and Gemini. OmitPII strips names, bank details, and personal records directly in workstation RAM before prompts leave the desk, then restores real data on screen. Zero cloud storage. Zero data leaks.

Start 14-Day Free Pilot Watch 2-Min Demo
100% On-Device RAM (Zero Cloud Storage) Direct Claude 3.7, ChatGPT & Gemini Free 14-Day Pilot (Zero Card Required)
Watch our 2-minute walkthrough of local redaction and automatic rehydration
Encrypted Local Audit Log
Want to see this running on your own files? Test with your team on a free 14-day evaluation sandbox. 3-minute setup.
Request Workstation Pilot →
Compliant AI Gateway for Regulated Practices:
SRA Standards & Regs FCA Operational Resilience UK GDPR / ICO Jersey DPL / JOIC
Local Workstation Flow

How your firm gets 5x AI speed with 0% data liability

Your fee-earners want the drafting power of Claude and ChatGPT. Your compliance committee cannot permit client data to leave the building. Here is how OmitPII solves both instantly on your local Windows workstations:

01 Zero-Leak Local Masking

Automatic Quarantine

Before any text touches your browser or leaves your computer, OmitPII intercepts client names, bank numbers, addresses, and NI/tax figures directly in local RAM. Unmasked data physically never reaches the wire.

The "So What?": No shadow AI data breaches
Cloud data payload: 0 bytes sent
02 Semantic Preservation

AI Reasonings Intact

Blacking out words breaks AI reasoning. OmitPII replaces sensitive entities with grammatical pseudonyms (e.g., [CLIENT_A], [ACCOUNT_1]). The frontier AI draft is perfect, and your real client figures are rehydrated on your screen in milliseconds.

The "So What?": Full AI quality, zero manual work
Rehydration latency: < 15 milliseconds
03 Regulatory Evidence

Instant Compliance Proof

Every processed query produces an immutable, locally encrypted audit log. If the ICO, SRA, or an institutional client asks for your AI policy enforcement, export a signed compliance certificate in 10 seconds.

The "So What?": Bulletproof defense against fines
Audit storage: 100% on workstation
Regulatory & Commercial Risk

One leaked client prompt can cost your partnership millions.

When an employee pastes confidential client files into an external AI, it triggers statutory breach disclosures under UK GDPR and SRA reporting duties. Beyond regulatory fines, firms face client contract cancellations and skyrocketing professional indemnity premiums.

£5M £50M £100M
Eliminate breach risk across your team with a 14-day sandbox pilot →
UK GDPR

Information Commissioner

Up to 4% of turnover or £17.5M statutory limit.

Max Fine Liability:
£800,000
EU AI Act

European Commission

Up to 7% of turnover or €35M statutory limit.

Max Fine Liability:
€1,400,000
Jersey DPL

Jersey Authority

Up to 10% of turnover or £10M statutory limit.

Max Fine Liability:
£2,000,000
* Statutory fine liability figures represent maximum statutory limits under UK GDPR (Art. 83), EU AI Act (Art. 99/101), and Jersey DPL 2018 for illustrative assessment. Actual regulatory sanctions are evaluated independently by supervisory authorities based on the nature, gravity, and mitigation of the data incident. EU AI Act applicability dates were amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026): Article 5 prohibitions and Article 4 AI literacy already apply, Article 50 transparency duties apply from 2 August 2026, and high-risk obligations were deferred to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Extraterritorial Jurisdiction & Subpoena Risk

The EU Cloud Illusion: Why European servers don't stop US subpoenas

Most businesses assume that because their Microsoft, Google, or AWS data is hosted in London, Dublin, or Frankfurt, foreign courts cannot touch it. Under the US CLOUD Act (18 U.S.C. § 2713), that assumption is legally false.

§ 2713
The Loophole

The US CLOUD Act

If the parent cloud provider is an American corporation, US federal courts can compel them to produce customer files regardless of where the physical hard drive sits. Your local data residency promises do not block an extraterritorial federal warrant.

Physical server location: Legally Irrelevant
Parent jurisdiction: United States
Art. 48
The Compliance Trap

GDPR Article 48 Breach

UK & EU GDPR Article 48 explicitly prohibits transferring personal data under foreign court orders unless backed by a formal mutual legal assistance treaty (MLAT). If your cloud vendor complies with a unilateral US subpoena, your firm faces Tier 2 statutory fines (up to £17.5M / €20M or 4% turnover).

Foreign court orders: Unlawful under Art. 48
Controller fine risk: Up to 4% Global Turnover
0 B
The Defense

Zero-Data Subpoena Immunity

OmitPII executes 100% on the local CPU with zero cloud databases. We hold zero prompt logs, zero customer files, and zero decryption keys. If a foreign or domestic authority serves OmitPII with a subpoena, our legal answer is mathematical: we do not possess the data.

Data held on servers: 0 Bytes (Zero-Storage)
Subpoena exposure: 100% Immune

You cannot subpoena or leak what was never collected

When using external AI models, OmitPII replaces all client names, account numbers, and confidential details on your local machine before the prompt is transmitted. Even if third-party endpoints or cloud providers are intercepted, your clients' real identities remain strictly on your physical device.

Verify Local Protection
Comparison

Why professional firms choose OmitPII

Compare local on-device redaction against cloud scrubbers and manual editing.

Key Requirement
OmitPII On-Device
Cloud Sanitizers (APIs) Manual Redaction
Where data is cleaned
✓ 100% on local workstation RAM
× Uploaded to third-party cloud
Local workstation (Manual copy-paste)
US CLOUD Act & Subpoena Risk
✓ 100% Immune (Zero cloud data)
× Exposed (US parent warrants compel data)
Immune, but high human error rate
Automatic rehydration
✓ Real data restored in <15ms
× Permanent blackouts only
× Tedious manual re-typing
Signed compliance audit logs
✓ Local encrypted audit database
Temporary vendor cloud logs
× Zero verifiable proof
GDPR Supplier Status
✓ Non-Processor (No DPA required)
× Data Processor (Requires full DPA review)
Internal only (High staff cost)
Onboarding & Pilot Terms
✓ 14-Day Free Sandbox (Zero card required)
Complex API integration & cloud lock-in
× Lost billable fee-earner hours

Why firms can deploy without months of vendor review

Under UK GDPR Article 4(8) and EU GDPR Article 28, a data processor is an outside supplier that holds or handles personal data on your behalf. Because OmitPII runs locally in computer memory on your own machines with no central cloud storage, raw client files never touch our systems. Your practice remains the sole data controller. You do not need to draft a bespoke Data Processing Agreement (DPA) or run lengthy vendor reviews just to test the software.

!

The "Cloud Redaction Trap" (Why Web-Based Redaction Fails Compliance)

Most AI redaction tools (and web PDF scrubbers) require you to upload your client's unredacted document to their cloud servers in the US or EU before their algorithms can mask it. For regulated UK and offshore practices, the act of uploading unredacted client files to a third-party server is already a cross-border data transfer violation under UK GDPR Article 44 and SRA confidentiality rules. OmitPII eliminates this trap entirely: redaction executes 100% inside local workstation RAM. Raw files never touch an external server.

Ready to test on your own files?

Install the lightweight desktop proxy on up to 10 staff computers with our 14-day zero-risk pilot. No credit card, no deposit, no IT disruption.

Start 14-Day Free Pilot
Enterprise AI Reality Check

Already paying for Microsoft 365 or Copilot? Here is why your practice is still exposed.

Bundled office assistants rarely satisfy fee earners working on complex drafting. When staff turn to Claude, ChatGPT, or Gemini in web browsers to meet deadlines, confidential client files leave your firm unprotected.

01 / The Reasoning Gap Staff Behavior

Staff Demand Frontier Reasoning

“Partners and fee earners bypass bundled tools for Claude 3.7 Sonnet and GPT-4o.”
  • Complex contracts, suitability reports, and litigation analysis require frontier LLMs.
  • Blanket IT bans fail: staff quietly paste documents into web tabs to finish work faster.
The Shadow AI Reality in Regulated Firms
02 / The Data Leak Plain-Text PII

Client Records Leave the Firm

“Every browser paste transmits unredacted client names, NINOs, and finances.”
  • Direct prompt inputs travel across international borders to US data centres.
  • Directly conflicts with SRA confidentiality, FCA senior management rules & UK GDPR.
Unmonitored Prompts Breach Statutory Privacy
03 / The Statutory Law Art. 4(7) GDPR

You Remain The Data Controller

“The vendor provides the cloud. Your firm carries 100% of the regulatory fines.”
  • Statutory fines cannot be transferred by contract or waived by vendor disclaimers.
  • If unmasked client files leave your computers, your firm answers to the ICO, JOIC or FCA.
Personal Accountability for Senior Management
The Commercial Reality

Don't fight AI adoption. Direct it through a secure gateway.

Banning AI slows fee earners down and forces usage underground. What your partners and fee earners need is a legitimate, compliant way to use the world’s most capable models without risking your client data or reputation.

The OmitPII Solution

Empower staff to use Claude, ChatGPT and Gemini safely.

OmitPII runs directly on local Windows workstations. It strips client names, NI numbers, bank details, and confidential figures in workstation RAM before transmission, then rehydrates real client data on screen. Zero personal data leaves your network.

Request 14-Day Pilot
Regulated UK & Channel Islands Practices: Local RAM pseudonymisation eliminates Article 44 cross-border transfer exposure before data touches any external network.
UK GDPR | Jersey DPL 2018 | SRA | FCA
14-Day Free Evaluation

Request your 14-day workstation pilot

Test on real client files across your fee-earners with zero risk. Pre-configured for UK GDPR and SRA confidentiality guidelines.

14-Day Team Pilot

What is included in your evaluation:

  • ✓ 100% Local On-Device MSI: Lightweight Windows package that strips client PII directly in workstation RAM. Zero cloud storage.
  • ✓ Direct Frontier Model Access: Anthropic Claude 3.7, OpenAI ChatGPT, and Google Gemini with automatic local rehydration.
  • ✓ Encrypted Local Audit Log: Immutable proof of compliance for the SRA, ICO, or institutional audit requests.
  • ✓ GDPR Non-Processor Status: Zero vendor data custody. No lengthy Data Processing Agreements (DPA) required.
Standard Pilot: Up to 10 Machines No credit card required. No automatic renewal. Zero disruption to existing practice workflows.

Evaluation requests reviewed within 3 working days. No payment details required.

MSP & Consultant Program

Partner with OmitPII as an MSP or IT Consultant

Law firms and wealth managers rely on their Managed Service Providers and IT consultants to manage data compliance. Provide local AI data protection across your client base with centralized fleet deployment, audit-ready logs, and recurring margin share.

01

Managed Service Providers (MSPs)

Deploy local proxy packages silently via Intune, NinjaOne, or Datto across your legal and financial clients. Centralized license management with zero cloud storage liabilities for your MSP.

✓ Silent RMM / MDM Deployment
02

vCISOs and IT Consultants

Provide client audit logs that prove compliance with UK GDPR and regulatory confidentiality rules. Turn blanket AI bans into safe, compliant client adoption.

✓ Audit Log Export for Compliance
03

Partner Margin and Internal Licenses

Receive recurring margins on annual seat licenses, direct technical escalation with our engineering team, and internal licenses for your own IT operations.

✓ Recurring Partner Margin

Interested in an MSP or IT consultancy partnership?

Speak directly with founding engineering to review multi-tenant deployment and pilot kits.

Architecture & Deployment

Frequently Asked Questions

Direct answers on data privacy, deployment footprint, and sandbox evaluation terms.

Does sensitive client data ever leave our company environment? −

No. OmitPII runs entirely inside your trusted perimeter. All detection and word replacement happen directly in local computer memory. Unredacted information never leaves your machines or touches external third-party servers.

What are the system requirements? Can this run on our own company servers? −

OmitPII runs very light with near-zero CPU impact on standard employee laptops or desktops. If your IT team prefers centralized management instead of desktop installations, OmitPII can also run as a private container on your company's own internal servers. Both options keep 100% of your data inside your firm.

Does tokenizing text reduce the quality of ChatGPT or Claude's answers? −

No. Unlike tools that simply erase text, OmitPII uses clean contextual placeholders. The AI model understands the full grammatical meaning of your document, and your real information is put back in place as soon as the answer returns.

How difficult is it to roll out across our team? −

Desktop installation takes under 5 minutes per computer. For IT teams managing multiple users, OmitPII can also be deployed quietly across your fleet through standard enterprise device management tools.

What happens after the 14-Day Sandbox Pilot? −

You receive full feature access for 14 days on designated staff machines with dedicated founding engineering support. There is zero automatic renewal, no credit card required, and no hidden fee. At the end of the 14 days, you simply decide whether to roll out an annual team license or keep your existing workflows.

Does hosting our cloud data in London or Dublin protect us from US court subpoenas? −

No. Under the US CLOUD Act (18 U.S.C. § 2713), US-headquartered cloud providers (including Microsoft, Google, and AWS) are legally compelled to disclose customer data under their custody or control, regardless of whether the physical server is located in London, Dublin, or Frankfurt. Furthermore, complying with a unilateral US subpoena without an international treaty violates UK and EU GDPR Article 48, exposing your firm to statutory fines up to £17.5M / €20M or 4% of global turnover. Because OmitPII executes 100% locally on employee workstations with zero central cloud databases, unmasked client data never sits on a server to be subpoenaed.

We already have Microsoft Copilot included in our enterprise licence. Why do we need OmitPII? −

While Microsoft Copilot provides office productivity features, fee earners and partners frequently turn to frontier models like Claude 3.7 Sonnet and ChatGPT for complex legal drafting and wealth planning where standard tools fall short. Pasting client bundles into web AI sends plain-text personal data to external cloud servers. OmitPII provides an on-device desktop gateway to frontier models (Anthropic Claude, OpenAI, Google Gemini), stripping client names, NI numbers, bank details, and portfolio figures in local workstation RAM before prompts leave your desk. Your team gets the drafting power they need; your practice ensures zero unmasked client records leave the premises.

Did the EU AI Act deadlines not move? What actually applies to us now? −

The Digital Omnibus on AI deferred high-risk AI system deadlines to December 2027. However, the Article 5 ban on prohibited AI practices and the Article 4 AI literacy requirements are already fully in force. Furthermore, Article 50 transparency requirements take effect in August 2026. Data governance controls under Article 10 remain essential for all regulated deployments.

Is OmitPII a Data Processor under UK or EU GDPR? Do we need to sign a DPA? −

No. Under UK GDPR Article 4(8) and EU GDPR Article 28, a data processor is an external supplier that holds or processes personal data on your behalf. Because OmitPII runs on your own computers, unmasked client files never touch our servers or databases. We never take custody of your matter files. Your practice remains the sole data controller, meaning your compliance team does not need to negotiate a separate Data Processing Agreement (DPA) or run lengthy vendor risk assessments before starting a pilot.
14-Day Free Pilot Zero Cloud Storage
Request Pilot