Swiss-hosted document anonymisation: what leaves, what stays, for how long

This page is addressed to the management and the data protection adviser of an organisation. It describes how the service actually works as of 28 October 2026. Maijin Shield is published by Maijin Sàrl, Geneva (UID CHE-300.778.667). See About and the legal notice. The legal details are in the privacy policy.

A document's journey

A document goes through eight steps; only its text is sent to Infomaniak's AI, in Switzerland, and only the mapping table and the anonymised version are stored, encrypted.

1. Upload

You upload a Word (.docx), Excel (.xlsx), PowerPoint (.pptx), PDF or XML document on the website, or you forward it by email (see below). The file is read in memory on Infomaniak's server in Switzerland. It is not saved to disk, to a database or to logs. By email, the document first passes through your own email service, which may be hosted outside Switzerland.

2. Reading

The server extracts the text: paragraphs, tables, hidden passages and tracked changes for a Word document; cells, comments and shapes for an Excel workbook; one page after another for a PDF. The personal data the document contains is still visible at this stage.

3. Detection by rules

Fixed rules, run on our server, first pick out whatever has a known format: AHV/OASI number, IBAN, email address, phone number, dates, postcodes, GLNs of health professionals, electronic patient record numbers (EPR-SPID), IP addresses and other technical identifiers. They also rely on the structure of the document (table cells, lines of the “Name: value” type) and on official Swiss lists (localities, surnames, first names). Nothing is sent outside for this step.

4. Detection by Infomaniak's AI

Names, addresses, health data or opinions depend on context: a fixed rule cannot see them. The text of the document is therefore sent, over an encrypted connection, to language models hosted by Infomaniak in Switzerland (Infomaniak AI Tools; as of 7 October 2026: Mistral Small and Gemma, whose answers are combined). This text is sent unmasked: the AI reads the document as it is, with the names and values. It returns the list of passages to mask. According to Infomaniak, this data is neither stored nor used to train a model.

A second pass then rereads only the sentences that still look suspicious, with the data already found replaced by its type (for example [PERSON]). If part of the document could not be analysed, the preview tells you.

5. Preview and corrections

You see the document with the data highlighted and the planned label for each item. You can leave an item in plain view, change its type, or select a missed word to mask it. The server keeps nothing between the preview and the generation.

6. Generating the anonymised document

Each item is replaced by a readable label, such as [PERSON_1] or [HEALTH_1]. The same value gets the same label throughout the document, so that the AI keeps the meaning of the text. The Word or Excel document is rewritten while keeping its layout; the thumbnail and the metadata are neutralised. In a PDF, the text is genuinely erased (not just a black rectangle) and the file is delivered only after a check that verifies that no original value remains. The anonymised document is downloaded to your device.

7. Encrypted mapping table and anonymised version

To be able to put the real values back later, the server stores the table that links each label to its real value, the name of the original file and a fingerprint of the anonymised text. It also stores the anonymised version of the document, which only its author can download again from the history. The table, the file name and the anonymised version are encrypted; the fingerprint is computed with a secret key and cannot be used to reconstruct the text (see “Encryption”). The original document is not stored.

8. Restoring the real values

You upload the document the AI returned. The service recognises the original document thanks to the fingerprint, then puts the real values back in place of the labels. This document is also read in memory and is not stored. Only the account that anonymised the document can recover its values, even in a team, and only while it is a member of the team.

What is stored, where, for how long, and who has access

The original document is never stored. What is stored: the mapping table and the anonymised version of the document, encrypted, usage statistics without content, the audit log, account data, billing for subscriptions, the forms you send us and the backups.

Statistics contain only numbers and codes: pages, formats, number of items masked per type, processing time. Page views on the public website are counted without cookies, without IP addresses or visitor identifiers; each demo attempt leaves one statistics row, without content or IP address. Details are in the privacy policy.

Encryption

The mapping table and the anonymised version are encrypted with AES-256-GCM, with a key kept outside the database. This is not end-to-end encryption.

• At rest. The mapping table, the file name and the anonymised version are encrypted with AES-256-GCM, with a random initialisation vector for each encryption. Each encrypted item is bound to its document and its author: copied to another document or another account, it becomes impossible to decrypt.
• Key outside the database. The key lives in the server's configuration, separate from the database. A copy of the database alone does not make it possible to read this data. Daily backups (kept for 14 days) contain tables that are still encrypted.
• Fingerprint. To recognise the original document, we keep a fingerprint of the anonymised text, computed with a secret key: without the key, it can be used neither to reconstruct the text nor to test candidate texts.
• In transit. Connections to the website and to the AI are encrypted (HTTPS). The database is not accessible from the Internet, and a strict content security policy restricts your browser's communications to our domain.
• Server. Firewall leaving only SSH, HTTP (redirect) and HTTPS open; SSH access by key only, with no “root” login; append-only audit log; daily, checked database backup, kept for 14 days on the server, with an alert if it fails; technical logs without IP addresses.

This is not end-to-end encryption: the server holds the key, because it has to put the real values back when you ask it to.

Sub-processors

Infomaniak, in Switzerland, processes your documents and sends all our emails. Stripe, outside Switzerland, never receives a document.

• Infomaniak Network SA (Geneva, Switzerland): hosting of the website and the database (server in Geneva), language models for detection, mailbox for drop-off by email and sending of all our emails (sign-in links, invitations, notifications, drop-off replies). All of this takes place in Switzerland.
• Stripe Payments Europe, Ltd. (Ireland) and Stripe, LLC (United States), outside Switzerland: payment and billing for subscriptions. Card details are entered at Stripe and never reach us. Stripe never receives a document or any data processed by the tool.

On the website, the document and the analysis by the AI stay in Switzerland. By email, the document also passes through your own email service, on the way out and on the way back (the restored document then contains the real values): check where it is hosted. Only payment goes through a provider located outside Switzerland, without any document content being passed on to it. When you are the controller, the data processing agreement, an annex to the terms and conditions, applies to every subscription. Questions: contact@maijin.ch.

Drop-off by email

Forwarding a Word, Excel, PowerPoint, PDF or XML document to your personal drop-off address anonymises it; the reply arrives in your mailbox, without a preview.

Each person has a personal drop-off address of the form …@depot.maijinshield.ch, with a random token of 10 characters. Forwarding a Word, Excel, PowerPoint, PDF or XML document to this address (up to 5 attachments) anonymises it; forwarding a document that contains labels such as [PERSON_1] and matches a stored document gives it its real values back.

• The email arrives in an Infomaniak mailbox, in Switzerland. Our server collects it, processes the attachments in memory, then permanently deletes it from the mailbox, whether or not it was processed; the spam folder and the bin are emptied every hour. In the event of a temporary failure, the email stays in the mailbox for three attempts, then it is deleted. The body of the message is not used; only its subject is repeated in the reply.
• Only emails sent from your account's address and authenticated (DMARC, DKIM and SPF checks aligned with that address) are processed; all others are discarded. The reply always goes to this address, never to another, and it is sent through Infomaniak's email service, in Switzerland.
• As there is no preview by email, everything detected is masked, with no option to leave an item in plain view or to remove images from the document. Same engine, same quotas, same masking settings and same retention period as on the website.
• The document passes through your own email service (Microsoft 365, Gmail, etc.), on the way out and on the way back, sometimes outside Switzerland. The restored document contains the real values: once it has arrived in your email service, the reply is kept by your email provider, according to its own rules.
• For a PDF that mixes text and scanned pages, upload it in your workspace instead: the reply by email does not yet flag scanned pages (see “Limits”).

Limits, honestly

Maijin Shield greatly reduces what the AI sees, but detection is imperfect and the service does not replace legal advice or human review.

• This is pseudonymisation. The AI only sees labels, but the account that holds the table can recover the real values. For whoever holds this table, the data remains personal data.
• Cross-referencing remains possible. A postcode, an age and a rare diagnosis, even if left in plain view, can make it possible to recognise a person. Mask generously if in doubt.
• Detection is automatic and imperfect. It may miss a name or mask one too many. We do not publish a detection rate.
• Scanned PDFs are not processed. A PDF made only of page images is refused. In a PDF that mixes text and scanned pages, the content of the scanned pages is not anonymised. In your workspace, the preview warns you and offers to remove the images; the reply by email does not yet flag this: for such a document, upload it in your workspace instead. The content of images (photo, scanned text) is in any case never analysed.
• Always check the preview. It is your last check before downloading. For a drop-off by email, check the document you receive before giving it to an AI.
• The service receives your document in plain text. During processing, Maijin Shield and Infomaniak's AI model read the text as it is. If your organisation is subject to a rule (cantonal law, internal policy, professional secrecy) that forbids entrusting such data to an external service, this page does not settle the question: it is for your DPO or your lawyer.
• After anonymisation, the responsibility is yours. Use of the AI to which you give the anonymised document is up to you and subject to its terms. Maijin Shield greatly reduces what this AI provider sees, but does not replace legal advice, an internal policy or human review.

How to delete your data

You can delete a table and the anonymised version at any time from your workspace; otherwise they delete themselves after 90 days.

• A mapping table and the anonymised version: from “My documents” in your workspace, delete the document. In a team, an administrator can also delete the team's documents.
• Your whole account: from Settings, delete your account. Your tables and anonymised versions are deleted, and your usage statistics are permanently detached from you. If you own a team that has other members, first transfer ownership to another member (Settings, Team), or delete the team.
• Without doing anything: each table and its anonymised version delete themselves after 90 days.
• Time limits to know about.Deleted data disappears from the backups no later than 14 days afterwards. The audit log, which has no content, is kept for 13 months. Subscription billing data is kept for 10 years, as required by Swiss law.
• Any other request (access, rectification, erasure, objection): we reply within 30 days. Your account data can be downloaded with “Download my data” in your Settings. Write to contact@maijin.ch.

Plans, quotas and retention periods are detailed on the Pricing page.