Pseudonymisation

The two modes

Full context sends your documents to the AI as written. It reads the file in full, recognises the parties, and is ready the moment the upload finishes.

Pseudonymised swaps names, companies, addresses and ID numbers for realistic stand-ins before anything leaves. The model reads every fact of the case but cannot tell whose it is, and its answers come back to you with the real names restored.

Neither mode is the safe one. Both run on the same infrastructure under the same contracts. Pseudonymisation is a second layer on top of safeguards that already apply, for a client who asks, a sensitive or high-profile matter, or when you want to be able to say no names ever left the firm.

The ledger

What the round trip looks like

One sentence of a Dutch letter, through both modes. The last line is what you read on screen, and it is the same either way.

Stand-ins exist only between Mino and the model. They never reach you. Each name keeps the same stand-in throughout the matter, so the model can follow who did what across a whole file without learning who it is about.

What Mino stores, and for how long

Pseudonymisation only works if something, somewhere, can put the real names back. That something is a mapping, and it is the part worth being precise about.

• The mapping is encrypted at rest and is scoped to a single matter. It is not exposed by any API you or a third party can call. Nothing in the product will return it to a caller.
• It lives exactly as long as the document does. The mapping is a child record of the document it belongs to. Delete the document and the mapping goes with it, in the same transaction, because the database enforces it rather than a cleanup job remembering to.
• Delete the matter and everything under it goes, by the same mechanism: the documents, their pseudonymised text, the stored originals and every mapping.
• The engine that does the swapping keeps a short-lived cache so a follow-up question does not have to redo the work. It expires on its own. It is a cache, not a record, and it is not where your data is kept.

That last distinction matters for a retention question. The retention period for your matter data is the retention period you set for the matter. The cache expiry is an implementation detail underneath it and is always shorter.

How accurate is it

Detection is accurate, not perfect. It is a machine reading a document, and Dutch legal writing is full of names that look like ordinary words and ordinary words that look like names.

So we do not ask you to trust it blind. Every document shows you exactly which names were replaced and what they were replaced with. You can add one the engine missed, or remove one it should not have touched. Corrections apply to the whole matter, not just the line you were looking at.

Choosing

Mino asks once, the first time you upload a document to a matter, and nothing is preselected for you. You can change a matter's mode later in its settings, and existing documents can be re-processed under the new one.

For the infrastructure this sits on, see Security at Mino. For how we handle personal data generally, see our Privacy Policy.