An on-premise system that prepares sensitive documents for processing by external language models. What it does and how.
Kalypto is an on-premise system that prepares sensitive documents for processing by external language models without the original data leaving the appliance it is installed on.
The core mechanism is reversible pseudonymisation: Kalypto locates the sensitive information contained in the document and replaces it with alternative values that remain consistent with the context. The resulting version can be used for external processing, while the original data and everything needed to trace the surrogates back to the real identities stay local.
Work is organised into Cases. A Case holds together the original documents, their internal representations, the substitutions made, the map required for restoration, the artefacts extracted and the processed documents that later return to the system.
By structural principle of the system, all processing that involves sensitive data happens offline and on-premise, entirely inside the Kalypto appliance.
The models used to analyse the document, the tools of the processing chain, the pseudonymisation system, the vault — the local store of correspondences — and the management interface all run on the appliance.
The appliance has no connection to external services. The user extracts the pseudonymised material through the dedicated interface and hands it over, by their own decision, to whichever service or container they intend to use.
When a document enters a Case, Kalypto builds a structured representation of it: not only the words it contains, but their position and their relation to the structure of the document.
On that representation, the information that may require protection is identified. Analysis proceeds in layers: deterministic rules for data recognisable by a precise structure, entity recognisers for information identifiable by meaning and, in the cases that remain ambiguous, a language model executed locally. The findings of the different layers are then composed into a single outcome before any substitution is treated as final.
The local language model does not rewrite the document. It intervenes only where information has to be classified or told apart and the earlier layers cannot resolve it with sufficient reliability; the final substitution remains deterministic.
Kalypto also handles quasi-identifiers: information that on its own may not be enough to identify a person, but which combined with other elements increases the risk of re-identification. Quasi-identifiers are signalled through notices and remain under the operator's control.
Removing a name or blanking out a series of values protects the information, but impoverishes the document to the point of compromising its usefulness: the text loses the references it rests on, and with them the possibility of being processed.
Kalypto takes a different approach. Sensitive information is replaced with surrogates that are realistic and consistent with the context: a name with another plausible name, an organisation with another organisation, a structured identifier with a formally compatible value.
Where necessary, characteristics such as gender, number, abbreviated form, title, given-name/surname structure, date format and identifier-specific properties are preserved. The text therefore retains the grammatical and documentary relations its processing requires.
Surrogate generation also happens locally and is deterministic: the same entity is treated consistently within the same Case, and the relation between surrogate and original data remains available for restoration.
The result is not a sanitised document, but a version that has lost direct access to the original information without losing the context the work requires.
During pseudonymisation Kalypto records in the vault, for every replaced item, its correspondence with the surrogate that stands for it. The vault belongs to the Case and stays on the appliance.
The artefact the user extracts contains only the pseudonymised version of the document: no original data, no portion of the map, no element that would allow surrogates to be traced back automatically to the real identities. Restoration is possible only by returning to the Case.
The pseudonymised version can be used with an external model for tasks that do not require knowledge of the real identities: analysis, summarisation, translation, comparison, reorganisation of content and other document transformations.
Kalypto does not assume, however, that the external service returns the text, the order and the form of the surrogates as it received them. A language model may paraphrase a sentence, shorten a name, alter a reference, move a piece of information, merge several passages into one or change the format of the document.
The external service is therefore treated as an unreliable transformation channel: restoration cannot depend on the model preserving markers or following instructions. It must work regardless of the form in which the document comes back; the task falls entirely on the mechanism for returning to the Case.
The document processed externally is uploaded by the user back into the same Case it came from.
Kalypto then recognises the pseudonymised references and associates them with the entities held in the vault. The operation is a constrained reconciliation: every reference must be associated with one of the entities known to the Case, or declared not sufficiently recognisable. Attribution to entities that do not belong to the Case is not provided for.
Reconciliation proceeds from the simplest methods towards those that require more complex processing. An exact match is resolved immediately. Where the external service has altered the text, aliases, morphological information, document structure, block alignment and similarity measures come into play. Only the residual cases call for more complex instruments.
When a match reaches sufficient reliability, the vault allows the inverse substitution: the surrogate becomes the original data again. The content produced by the external system is left as it is; what is restored are the references that make it usable in the real context.
The complete cycle, from the original document to restoration:
The dashed vertical line separates what happens on the appliance from what happens outside: only the two coloured paths cross it. The dashed box in the middle is the vault, which never crosses it.
Of these steps only one happens outside the appliance, and it is the one that does not require the sensitive information. All the others take place inside it; the original data and the map associated with the Case also remain there.
Kalypto thus separates two problems that are normally handled together: where sensitive information must remain, and where the processing of content that does not need that information may take place.
For reversible artefacts the correct term is pseudonymisation. As long as a map exists that allows surrogates to be traced back to the original data, the document cannot be considered anonymous in any absolute sense. Reversibility is an intentional property of the system: it is what allows the processed result to return to the real context it was temporarily separated from.
Nor is restoration infallible. An external system may alter a reference to the point of preventing a sufficiently reliable match; in that case Kalypto performs a partial restoration and flags it, rather than arbitrarily attributing an original value.
The quality of the system is therefore not measured only on how well it identifies sensitive information, but also on what escapes substitution, on the survival of surrogates through external transformations, on the share of references restored and on the cases where restoration degrades.
Anonymisation — processing that makes it impossible to trace a piece of data back to the subject it refers to. It is not the operation Kalypto performs.
Appliance — the apparatus Kalypto is installed and executed on, located at the user's premises (on-premise) and without any connection to external services.
Artefact — a file produced from a Case and intended for external use; it contains only the pseudonymised version of the document.
Case — the unit of work that holds together the original documents, the substitutions made, the vault, the artefacts extracted and the documents that return after external processing.
Constrained reconciliation — the association of each reference in the returned document with one of the entities known to the Case, or the declaration that the reference is not sufficiently recognisable. It corresponds to what the literature calls constrained entity linking.
Deterministic — behaviour in which the same input data always produces the same outcome, with no margin of variation.
Inverse substitution — the exchange of a single surrogate for its corresponding original data.
LLM — a language model trained on large quantities of text. It appears in this document in two distinct roles: locally, to classify information the earlier layers do not resolve; externally, to process the already pseudonymised document.
Pseudonymisation — the replacement of sensitive information with alternative values, keeping separately what is needed to trace those values back to the originals.
Quasi-identifier — information that does not identify a person on its own, but which combined with other elements may allow re-identification.
Restoration — the overall operation that brings the externally processed document back to the original data of the Case. It is partial and flagged when some references cannot be reconciled.
Surrogate — the value that replaces a piece of sensitive information in the pseudonymised document, chosen to be plausible and consistent with the context.
Vault — the local store, belonging to the Case, in which the correspondence between every original item and its surrogate is recorded. Its content is also referred to in the text as the map of correspondences.