Early access
Pseudonymization for operational data
Stage names out.
Stage Name pseudonymizes the exports companies run on — email, chat, CRM, tickets, documents — and returns every file in its own format, with every person given a consistent stand-in. The data stays useful. The people in it stay private.
#paymentshey, Daniel Porter's card [PAYMENT_CARD] got declined again. ping him at daniel.porter@cedarridge.example or (212) 555-0147, he's in [CITY] in Idaho till friday
- 30
- kinds of personal data, each with its own rule
- 1 : 1
- same value, same stand-in, across the whole batch
- Native
- every file back in its own format
- 0
- files sent to outside AI or OCR providers
The problem
The most useful data is full of people.
Operational exports show how work really gets done. That is why labs want them, and why they can't be shared as they are.
- 01
Real work lives in exports.
Email threads, chat channels, CRM records and tickets carry the context models need: who asked whom, what happened next, how it was resolved.
- 02
Redaction breaks the data.
Blacking out names destroys who said what to whom. Threads stop making sense and links between files break.
- 03
Manual review doesn't scale.
One company's export can hold millions of files in dozens of formats. Nobody can read it all, and spot checks miss what matters.
The idea
Every person gets a stage name.
Like a performer's stage name, a stand-in replaces the real name wherever it appears — an email header, a chat mention, a spreadsheet cell, a document — and stays the same across the whole batch.
From: Priya RamanLaura Benson <priya.raman@crestview.examplelaura.benson@cedarridge.example>
Can someone check the renewal quote?
#sales
@priya.ramanlaura.benson on it — sending the quote by noon
Signature
— Priya RamanLaura Benson, Account Manager
Consistent
The same value gets the same stand-in in every file, so conversations and joins still work.
Native
Every file comes back in its own format, in the same folders.
Accountable
Every decision is logged and can be explained.
How it works
From a ZIP of exports to a ZIP you can share.
Four stages run over every file. Each one is checkpointed, so a file that fails is held back on its own and never reaches the output raw.
- Step 1
Read
Every file is opened, including email attachments and archives, and its real format is detected from its contents.
- Step 2
Find
Personal data is found from the structure of the export, from patterns such as card and ID numbers, and with a language model for names in free text.
- Step 3
Decide
A written policy picks a treatment for each kind of data. When a value could be read two ways, the stricter rule wins.
- Step 4
Write back
The new text goes back into each original file, every file is checked to open, and you get one ZIP with the same folder structure and a report on every file.
Unreadable or unsupported files are withheld with a reason — never released raw.
Treatments
Four treatments, set per kind of data.
Not everything should be replaced the same way. A written policy decides, and nothing is silently deleted: a hidden value becomes a token, so sentences and tables still parse.
- REPLACE
A realistic stand-in, the same one everywhere in the batch.
- Michael HarringtonbecomesDaniel Porter
- crestview.examplebecomescedarridge.example
- (212) 555-0134becomes(212) 555-0147
- CLASS TOKEN
Never a realistic value.
- 4111 1111 1111 1111becomes[PAYMENT_CARD]
- 4521 Smith Plazabecomes[ADDRESS_NUMBER] [STREET_NAME]
- GENERALIZE
Coarser, keeps the meaning.
- $142,300becomes$100,000–$150,000
- July 14, 1984becomes1984
- Twin Fallsbecomes[CITY] in Idaho
- KEEP
Public names that identify nobody.
- Microsoft
- Seattle
Stand-in names come from public name lists, so they read naturally. Phone stand-ins use fictional number ranges.
Formats
Built for the tools companies run on.
Every file comes back in its own format. Text formats look exactly the same; documents keep their format, with images and macros removed.
Email and chat
- EML with attachmentsHeaders, bodies and attachments; threads stay intact.
- Slack exportssoonMessages and mentions; threads stay intact.
- Microsoft Teams exportssoonChats and channel messages; threads stay intact.
Documents
- PDFSame format; embedded images removed.
- DOCXSame format; embedded images and macros removed.
- Scanned PDFs (OCR)soonRead with OCR on our own machines.
Data
- TXTsoonComes back looking exactly the same.
- CSVsoonSame columns and rows; joins between files still work.
- JSONsoonSame structure; values replaced.
- ParquetsoonSame schema; values replaced.
- XLSXsoonSame format; embedded images, charts and macros removed.
Systems
- HTMLComes back looking exactly the same.
- Calendar (ICS)soonSame events; people replaced.
- Log filessoonSame lines; identifiers replaced.
- Source code commentssoonComments only; code is left as it is.
Archives
- ZIPsoonOpened, processed and repacked with the same folders.
- tar.gzsoonOpened, processed and repacked with the same folders.
Looks the sameSame format, not a 1:1 copy
Security
Built so data doesn't travel.
Stage Name is built for data that can't leave a controlled environment.
Isolated by design Processing is built to run in an isolated cloud account in the agreed region, with no route to the internet.
No outside AI services Every model, including OCR, runs on our own infrastructure. No original data is sent to a third-party AI or OCR provider.
Keys destroyed by default By default, the link between real values and stand-ins is designed to exist for one batch, in a separate store, and to be destroyed when the batch is accepted.
Logs without content Logs record IDs, counts and outcomes, never the text or values they describe.
Never released raw A file that can't be processed is withheld with a reason.
Quality
Measured, not claimed.
Pseudonymization is only as good as what it finds. So we measure it.
- 01
Mark
A sample is marked by hand: every identifier, with its kind.
- 02
Fingerprint
The answer key is fingerprinted before scoring, so it can't be adjusted afterwards.
- 03
Score
Recall, precision and the share of ordinary words changed by mistake, with sample sizes.
We report the outcome of every file in a processing report, and what we measure in a quality report.
Who it's for
For everyone between the data and the model.
AI research labs
Realistic operational data in native formats, with consistency intact and a quality report you can check.
Companies with data to share
Turn the exports you already have into a dataset partners can use, without handing over your people.
Data partners
Pseudonymization as a service behind your data pipeline, on the formats your suppliers actually export.
FAQ
Frequently asked questions.
Is pseudonymized data anonymous?
No. Pseudonymization replaces identifiers with stand-ins, which greatly reduces what can be learned about a person, but under laws such as the GDPR pseudonymized data can still count as personal data. Stage Name documents every decision and measures the result; it is not a legal certification.
Can the stand-ins be reversed?
By default, no. The key that links stand-ins to real values is designed to exist for one batch only and to be destroyed when the batch is accepted.
What does it look for?
Thirty kinds of personal data: names and job titles, contact details such as emails, phone numbers and usernames, addresses and places, ID, card and bank numbers, passwords and tokens, dates of birth, ages and salaries, and organization names. Each kind has its own rule: replaced, tokenized, generalized or kept.
Which languages?
English today. Other languages are on the roadmap.
Which file types?
See Formats above. Text formats come back looking exactly the same. Documents such as DOCX and PDF keep their format, but embedded images, charts and macros are removed.
What about images, audio and video?
Scanned documents are designed to be read with OCR on our own machines; that support is marked soon under Formats. Photos, audio and video aren't processed yet; they are withheld and listed in the report.
Where does processing happen?
Processing is designed to run in an isolated cloud account in the region agreed with you, on infrastructure we control. No original data is sent to an outside AI or OCR provider.
Do you handle health records?
Health data needs additional agreements and a stricter setup. Talk to us before sending any.
How do you know it works?
We measure it against hand-made answer keys, fingerprinted before scoring, and report the results with their sample sizes.
Contact
Talk to us.
Tell us what data you have or need. We reply within two working days.
Or email hello@stagename.ai