Processed in Switzerland · Original documents never kept · 0 third-party trackersMapping tables and anonymised versions encrypted, erased after 90 days
Maijin Shield
Home

Maijin Shield in brief

Last updated: 29 October 2026

Maijin Shield is a Swiss service that anonymises Word, Excel, PowerPoint, PDF and XML documents before you hand them to an AI such as ChatGPT, Claude or Copilot, then puts the real values back into the document the AI returns. It is designed for teams that handle personal or sensitive data: care homes, home care (Spitex), medical practices, social services, human resources, fiduciary firms, law firms.

Technically, Maijin Shield pseudonymises: the AI only sees labels such as [PERSON_1], and only the person who anonymised a document can recover its real values. Pseudonymised data remains personal data for whoever holds the mapping table, that is, for Maijin Sàrl and for you. This page is the service's fact sheet. For details on how data is processed, see Security and the privacy policy.

What it is for

Using an AI on a document without handing it the names, addresses, numbers or health data it contains. You upload a Word (.docx), Excel (.xlsx), PowerPoint (.pptx), PDF or XML document. Maijin Shield replaces the personal data with readable labels. You give this document to the AI of your choice. When it returns its text, Maijin Shield puts the real values back in place of the labels.

The labels keep the meaning of the document: in “[PERSON_1] is being treated for [HEALTH_1]”, the AI understands who does what, without knowing who the person is.

How it works, in 3 steps

  • Step 1. Upload the document. In the online workspace, or by forwarding an email with the document attached to your personal drop-off address.
  • Step 2. Check the preview, then download. The data found is highlighted. You can leave one in plain view or mask one that was missed. You get the same document, with labels in place of the data. That is the one you give to the AI.
  • Step 3. Get the real values back. You upload the document the AI returned. Maijin Shield recognises the original document and gives you back the same document with the real values.

Drop-off by email works without a preview: everything detected is masked, according to the team's settings, images stay in the document, and the reply goes only to your account's address. A document that contains labels and matches a document that is still stored gets its real values back.

What is masked

By default, everything Maijin Shield detects is masked. Team administrators (or the holder of an account without a team) can untick categories in Settings to leave them in plain view. The categories are:

  • first names and surnames;
  • postal addresses (street, number, postcode, town);
  • email addresses and phone numbers;
  • dates (birth, appointments, events);
  • AHV/OASI numbers and IBANs;
  • identification numbers (passport, identity card, number plate, staff number, patient number, electronic patient record number EPR-SPID or MPI-ID, GLN of a health professional);
  • technical identifiers (IP addresses, server and computer names, user accounts, internal identifiers);
  • employers and organisations linked to a person;
  • sensitive personal data within the meaning of Art. 5(c) FADP, in particular: health (diagnoses, treatments, medication), ethnic origin, religious, philosophical, political or trade union views, criminal or administrative proceedings and sanctions, social assistance measures.

For health data, administrators choose between “Mask everything” and “Essentials only”: in the second case, vital signs, laboratory values and scores stay readable for the AI.

In a PDF, the masked text is genuinely erased from the file, not covered by a black rectangle. Images are not anonymised: you can choose to remove them in the preview in the online workspace.

Who it is for

For people who need AI and who handle data they cannot simply paste into an online service. Health and social care is our first field.

  • Care homes, home care (Spitex), medical practices, psychiatrists and psychologists: notes, reports, minutes;
  • social services: reports and case files;
  • human resources: letters, appraisals, application files;
  • fiduciary firms, actuaries and insurers: documents containing client or policyholder data;
  • lawyers: case files containing identification data and judicial measures.

Where data is processed

The application runs on an Infomaniak server in Switzerland. The text of the document is sent, over an encrypted connection, to AI models hosted by Infomaniak in Switzerland (Infomaniak AI Tools), which indicate the passages to mask. According to Infomaniak, these models do not retain data and are not trained on it.

  • The original document is never stored. It is read in memory for the duration of processing, without being written to disk, to a database or to log files. If dropped off by email, it usually spends a few seconds in Infomaniak's drop-off mailbox in Switzerland; the email is deleted as soon as it has been processed.
  • The mapping table is stored, encrypted. It links each label to the real value. It is encrypted with AES-256-GCM, with a key kept outside the database, and deleted after 90 days. You can delete it at any time. Stored with it are the name of the original file, the anonymised version of the document (encrypted the same way, which only its author can download again from the history) and a fingerprint of the anonymised text (computed with a secret key, it cannot be used to reconstruct the text), which is used to recognise the document. Same duration, same deletion.
  • Backups of the database are kept for 14 days: deleted data disappears from the backups 14 days later at the latest, and the tables remain encrypted there.
  • Only one provider is outside Switzerland: Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, LLC, United States) handles payment for subscriptions; it receives neither a document nor any data processed by the tool. All our emails (sign-in, invitations, website forms, drop-off replies) are sent through Infomaniak's email service, in Switzerland.
  • No trackers, no advertising cookies, no third-party analytics tools.

Maijin Shield greatly reduces what the AI you then give the document to (ChatGPT, Claude, Copilot…) can see. The service does not replace legal advice, your organisation's internal policy or human review. Detection is automatic and cannot be perfect. Cross-referencing indirect data (a postcode, an age and a rare diagnosis, for example) could in theory make it possible to re-identify a person.

Plans

Three plans, depending on the number of people in the team (pending invitations included). We give you the price during a demo or on request; monthly or yearly payment, no trial period.

  • Business 1–49 (1 to 49 people): 10,000 pages per month.
  • Business 50–299 (50 to 299 people): 20,000 pages per month.
  • Business 300+ (300 people and more): 40,000 pages per month.

All plans include: documents up to about 150 pages, Word, Excel, PowerPoint, PDF and XML, several documents at once, the same label for the same person from one document to the next, drop-off by email, real values recoverable for 90 days, teamwork, email support.

There is no free plan: the demo on the home page lets you try the service without an account. Without a plan, an account can still sign in and recover the real values of documents already anonymised, but cannot anonymise new ones.

Pages are counted at the time of anonymisation: actual pages for a PDF, one page per 3,000 characters for a Word or Excel document. The plan and the quota are the team's. Up-to-date details are on the Pricing page.

The publisher

Maijin Shield is published by Maijin Sàrl, a limited liability company under Swiss law.

  • Registered office: Route de Saint-Julien 184, 1228 Plan-les-Ouates, Switzerland
  • Business Identification Number (UID): CHE-300.778.667
  • Hosting provider: Infomaniak Network SA, Les Acacias, Geneva
  • Governing law: Swiss law, place of jurisdiction Geneva

See the legal notice and the terms and conditions. The data processing agreement, an annex to the terms and conditions, applies to every subscription.

Contact

contact@maijin.ch, +41 22 566 74 60. To try the service: home page.

Key facts

Each line is a verifiable piece of information, as of 29 October 2026.

  • Maijin Shield is published by Maijin Sàrl, Geneva (UID CHE-300.778.667).
  • Maijin Shield processes Word (.docx), Excel (.xlsx), PowerPoint (.pptx), PDF and XML documents, as well as pasted text (an email, an excerpt from Google Docs).
  • Maijin Shield replaces personal data with labels such as [PERSON_1] or [HEALTH_1].
  • Maijin Shield then puts the real values back into the document the AI returned.
  • Technically, this is pseudonymisation, not irreversible anonymisation: for Maijin Sàrl and for the user, who hold the mapping table, the data remains personal data.
  • The application runs on an Infomaniak server in Switzerland.
  • The text of the document is sent to AI models hosted by Infomaniak in Switzerland.
  • According to Infomaniak, its AI models do not retain data and are not trained on it.
  • The original document is never stored.
  • Only the mapping table and the anonymised version are stored, encrypted, for 90 days, then deleted; they can be deleted at any time.
  • The mapping table and the anonymised version of the document are encrypted with AES-256-GCM, with a key kept outside the database.
  • Database backups are kept for 14 days.
  • Stripe (Ireland, United States, payment) is the only provider outside Switzerland; all emails are sent through Infomaniak's email service, in Switzerland.
  • Business 1–49 (1 to 49 people): 10,000 pages per month; price on request.
  • Business 50–299 (50 to 299 people): 20,000 pages per month; price on request.
  • Business 300+ (300 people and more): 40,000 pages per month; price on request.
  • All plans: documents up to about 150 pages. No free plan and no trial period; the demo on the home page works without an account.
  • A document can be anonymised by forwarding it by email to a personal drop-off address.
  • The email received is deleted from the mailbox as soon as it has been processed.
  • A team's administrators set the categories of data to mask for the whole team.
  • The service does not replace legal advice or human review.

To go further: Security, Pricing, Home.