Watch a lawyer or an accountant use an AI on a real file and you notice something the anonymization tools have all missed. Nobody works in one pass. They ask a question, read the answer, ask a sharper follow-up, paste a second document, refer back to the first. The work is the conversation. And almost every way of hiding personal data breaks the moment that conversation gets going.
That observation is why promptShield has the shape it does. As far as we can tell, nobody else has built around it, so the idea needs a name: conversation-stable anonymization. One entity keeps one code, all the way through the conversation and across every related file. The AI then reasons about the protected document the way it would about the real one, and at the end you restore the real values.
The work is multi-turn, so the protection has to be too
Take the realistic version of the task. You have a contract and its three amendments. You paste the contract, anonymized, and ask the model to summarize the obligations. It does. You then paste an amendment and ask: "does this change the buyer's payment terms from the original?" Then: "draft a clause that resolves the conflict between section 4 here and section 7 there."
For any of that to produce something useful, the model has to know that the "buyer" in the contract and the "buyer" in the amendment are the same legal person, and that "the defendant" and "Ms. Laurent" are one party rather than two. Coreference, the thread of identity running through the whole exchange, is the substance of professional reasoning. Break it and the AI's answer is confidently wrong in a way that is hard to spot.
Anonymization that treats a document as a thing to scrub once never sees this. It cleans the file and hands it back. But the professional does not have a file. They have a matter: a body of related material they reason over together, in dialogue, over weeks. The unit of work is the conversation.
Why the obvious approaches fall apart
Once you frame the job as "keep identity coherent across a whole conversation," the common techniques reveal themselves as the wrong tool:
| Approach | What it does | Why the conversation breaks it |
|---|---|---|
| Blackout bars | Paints the text out of the page | The model cannot reason about what it cannot see; every later "the buyer" has nothing to point at |
| Deleting the names | Removes the entity outright | Distinct people collapse into the same gap, and the model quietly invents someone to fill it |
| A fresh label each run | Mints a new pseudonym on every pass | Turn two renames everyone; one person becomes two, and nothing flags the contradiction |
| Find-and-replace | Maps one spelling to one string | Misses inflections, initials and aliases, and knows nothing about the second document you paste |
| Per-document tokenization | Stable codes, but only inside a single file | A contract and its amendment give the same party different codes, so cross-file reasoning fails silently |
The pattern repeats down every row. Each approach handles one blob of text well enough, and each one fails the moment the work becomes a conversation, because each was built for a unit of work professionals do not have.
What conversation-stable anonymization requires
Naming the gap is easy. Closing it takes three things, and each one is more than a find-and-replace macro can do.
Stable identity. The same entity has to map to the same code every time it appears, not only inside one document but across the whole conversation and every linked file. In promptShield, "John Smith" gets the same code, say [P0ABCD], whether he turns up in the contract, the invoice or the email attachment, because related files share one code registry. Drop them in the same folder and the linking is automatic, with nothing to configure.
Typed, legible codes. Codes look like [P0ABCD], [A1WXYZ] and [B2KLMN]. The first letter carries the type: P for person, A for address, B for IBAN. So the model still knows it is reasoning about a person, an address, an account, and it can give you a useful answer instead of choking on opaque noise. An instruction line travels with the download, telling the AI to keep the codes as they are. The structure that helps the AI survives; only the identity is hidden.
A faithful round trip. Hiding identity is only half the job. The mapping from code back to original value is held locally, so when the AI's answer comes back full of [P0ABCD] and [B2KLMN], you decode it in one step and get a result that reads as if you'd never anonymized at all. Stable codes are what make this decode unambiguous: one code, one original, every time.
Put the three together and you get the property that matters: the AI works on the protected document exactly as it would on the real one. Same reasoning, same cross-references, same multi-turn coherence, with no real identity anywhere in the conversation and a clean restoration at the end.
The loop, end to end
In practice it is one loop, and it follows the rhythm of real work instead of interrupting it:
- Encode. Every entity is replaced with a stable, typed code; linked files share the registry; a human reviews the detections before anything is committed. (On a high-stakes document that review is the point: see why a human stays in the loop.)
- Converse. Paste the protected version into ChatGPT, Claude, or any model. Ask follow-ups. Paste more documents from the same matter. Refer back. The identities stay coherent for as long as the conversation runs, because the codes don't drift.
- Decode. Bring the AI's output back and restore every code to its real value in one step: a final document that reads as if the real names had been there all along.
And because the loop runs on your machine, no part of the matter ever leaves it: not the originals, not the code map, not one turn of the protected text.
The category we're claiming
Plenty of tools can hide a name. Some can hide it consistently if you configure them to. What the market lacks is a product built around the way professionals work with AI: iteratively, across turns, across linked files, with a human vouching for the result and a clean round trip at the end. That is the workflow promptShield was designed for from the ground up, and it is the idea we would like to put a name on.
Call it conversation-stable anonymization. One entity, one code, all the way through, so you can finally use AI on the documents that matter the way you already think about them: not as files to be scrubbed, but as a case to be worked.
Common questions
Why does the same name need the same code every time?
Because professionals do not anonymize in one pass. They ask a follow-up, paste a second document, and reason across both. If the same person becomes a different code each turn, the AI is reading about two different people.
What breaks if the codes change between documents?
Cross-file reasoning. A contract and its amendment stop referring to the same party, and any conclusion drawn across the pair is wrong. That is why reversible redaction keeps one stable code per entity rather than a fresh label per run.
Is the mapping stored anywhere online?
No. The code-to-value registry stays on the machine that created it, which is the same thinking behind the detection engine we wrote ourselves.