Watch how a lawyer, an accountant, or a clinician actually uses an AI on a real file, and you notice something the anonymization tools all seem to have missed: nobody works in one pass. They ask a question, read the answer, ask a sharper follow-up, paste a second document, refer back to the first. The work is the conversation. And almost every way of hiding personal data quietly breaks the moment that conversation gets going.
That observation is the whole reason promptShield exists in the shape it does. So let's name the idea plainly, because as far as we can tell, no one else has built around it: conversation-stable anonymization — one entity keeps one code, the whole way through the conversation and across every related file, so the AI reasons about the protected document exactly as it would about the real one, and you can faithfully restore the real values at the end.
The work is multi-turn — so the protection has to be too
Imagine the realistic version of the task. You have a contract and its three amendments. You paste the contract, anonymized, and ask the model to summarize the obligations. It does. You then paste an amendment and ask: "does this change the buyer's payment terms from the original?" Then: "draft a clause that resolves the conflict between section 4 here and section 7 there."
For that to produce anything useful, the model has to know that the "buyer" in the contract and the "buyer" in the amendment are the same legal person, that the address in clause 4 is the same address as the one three turns ago, that "the defendant" and "Ms. Laurent" are one party, not two. Coreference — the thread of identity running through the whole exchange — is not a nice-to-have. It's the substance of professional reasoning. Break it, and the AI's answer is confidently wrong in a way that's hard to even spot.
Anonymization that thinks of a document as "a thing to scrub once" never sees this. It cleans the file and hands it back. But the professional doesn't have a file; they have a case, a matter, a client — a body of related material they reason over together, in dialogue, over time. The unit of work isn't the document. It's the conversation.
Why the obvious approaches fall apart
Once you frame the job as "keep identity coherent across a whole conversation," the common techniques reveal themselves as the wrong tool:
| Approach | What it does | Why the conversation breaks it |
|---|---|---|
| Blackout bars | Paints the text out of the page | The model cannot reason about what it cannot see; every later "the buyer" has nothing to point at |
| Deleting the names | Removes the entity outright | Distinct people collapse into the same gap, and the model quietly invents someone to fill it |
| A fresh label each run | Mints a new pseudonym on every pass | Turn two renames everyone; one person becomes two, and nothing flags the contradiction |
| Find-and-replace | Maps one spelling to one string | Misses inflections, initials and aliases — and knows nothing about the second document you paste |
| Per-document tokenization | Stable codes, but only inside a single file | A contract and its amendment give the same party different codes, so cross-file reasoning fails silently |
The pattern is the same in every row: each approach is fine for "sanitize this one blob of text," and each one fails the moment the work becomes a conversation. They were built for a different unit of work than the one professionals actually have.
What conversation-stable anonymization requires
Naming the gap is easy; closing it has real requirements, and they're why this is a product and not a find-and-replace macro.
Stable identity. The same entity must map to the same code every time it appears — not just within a document but across the whole conversation and every linked file. In promptShield, "John Smith" gets the same code (say [P0ABCD]) whether he's in the contract, the invoice, or the email attachment, because related files share one code registry. Drop them in the same folder and the linking is automatic — no configuration.
Typed, legible codes. A code is [P0ABCD], [A1WXYZ], [B2KLMN] — the first letter carries the type (P for person, A for address, B for IBAN), so the model still knows it's reasoning about a person, an address, an account, and can produce a genuinely useful answer instead of choking on opaque noise. An instruction line travels with the download telling the AI to keep the codes exactly as they are. The structure that helps the AI is preserved; only the identity is hidden.
A faithful round trip. Hiding identity is only half the job. The mapping from code back to original value is held locally, so when the AI's answer comes back full of [P0ABCD] and [B2KLMN], you decode it in one step and get a result that reads as if you'd never anonymized at all. Stable codes are what make this decode unambiguous: one code, one original, every time.
Put those together and you get the property that matters: the AI works on the protected document exactly as it would on the real one. Same reasoning, same cross-references, same multi-turn coherence — with no real identity ever present in the conversation, and a clean restoration at the end.
The loop, end to end
In practice it's one continuous loop, and it matches the rhythm of real work rather than interrupting it:
- Encode. Every entity is replaced with a stable, typed code; linked files share the registry; a human reviews the detections before anything is committed. (On the high-stakes documents, that human review is the whole point — see why a human stays in the loop.)
- Converse. Paste the protected version into ChatGPT, Claude, or any model. Ask follow-ups. Paste more documents from the same matter. Refer back. The identities stay coherent for as long as the conversation runs, because the codes don't drift.
- Decode. Bring the AI's output back and restore every code to its real value in one step — a final document that reads as if the real names had been there all along.
And because the whole loop runs on your machine, no part of the matter — not the originals, not the code map, not a single turn of the conversation's protected text — ever leaves your perimeter.
The category we're claiming
Plenty of tools can hide a name. Some can even hide it consistently if you configure them to. What's missing from the market isn't the capability in isolation — it's a product built around the way professionals actually work with AI: iteratively, across turns, across linked files, with a human vouching for the result and a clean round trip at the end. That's the workflow promptShield is designed for from the ground up, and it's the idea we'd like to put a name on.
Call it conversation-stable anonymization. One entity, one code, all the way through — so you can finally use AI on the documents that matter the way you already think about them: not as files to be scrubbed, but as a case to be worked.
Common questions
Why does the same name need the same code every time?
Because professionals do not anonymize in one pass. They ask a follow-up, paste a second document, and reason across both. If the same person becomes a different code each turn, the AI is reading about two different people.
What breaks if the codes change between documents?
Cross-file reasoning. A contract and its amendment stop referring to the same party, and any conclusion drawn across the pair is wrong. That is why reversible redaction keeps one stable code per entity rather than a fresh label per run.
Is the mapping stored anywhere online?
No. The code-to-value registry stays on the machine that created it, which is the same design decision behind the engine we wrote for exactly that job.