Technology
We explain the principles VERLON is built on and the decisions behind them. The finer points of detection we keep to ourselves; they are the part we are measured by.
Most providers govern where your data is stored. We start one step earlier: what never leaves in the first place does not need protecting. This is a technical measure, not a contractual promise — and it still works if a contract ever fails to hold.
A single method always misses something. With us, fixed rules with check digits, your own master data and a language model work together — each stage catches what the other lets through.
The model that decides what needs protecting runs in your environment. Only then does a request go out — and without the protected details.
An overlooked name is a data protection incident; a term replaced unnecessarily is only a loss of quality. The thresholds are set accordingly, and uncertain matches are put to you for a decision rather than silently let through.
Detection quality can be claimed or it can be tested. We test.
Every change to detection is run against a fixed test set. What counts is how much of what must be found is actually found — broken down by persons, companies, contact details and bank details. Improvements that cannot be measured do not count as improvements with us.
From practice: an obvious way of making a detection model smaller led, in our measurements, to it finding nothing at all — without a single error message. That is exactly why we measure rather than rely on plausibility.
VERLON runs on its own infrastructure, separate from everything else. That is the prerequisite for operations to be audited properly at all.
The link between placeholder and original value is the only place with sensitive content — stored encrypted and given a retention period, after which it is deleted.
Entries are chained to one another. Later changes stand out instead of going unnoticed.
Even an administrator sees the number, type and time of replacements — never the value. Otherwise administration would be the biggest gap in our own product.
Two things we have announced and are currently working on.
On-device detection. As long as detection runs on a server, the plain text is there at the moment of processing. Only once it runs entirely on the user's device is the statement "we cannot see your data ourselves" literally true. We are working on this; until then, we do not say it.
Guided workflows. Beyond the individual chat: recurring processes such as a customer enquiry from receipt through to quotation, with defined steps, templates and approval by a person at the right point.
If you have an IT department that wants to take a closer look: we are happy to answer technical questions in a direct conversation, including with your data protection officer.