The hidden risk of cloud PII scrubbers

A growing class of tools makes a clean sounding promise. They say they will remove personal data from your text before it ever reaches the AI model. Names, emails, account numbers, health details, all stripped out, so you can use AI without exposing anyone. It sounds like the responsible choice. For many of these tools, it is not.

The catch sits in one word that is easy to miss: where. Most of these scrubbers run in their own cloud. To remove your sensitive data, that service first has to receive your sensitive data. The raw, unredacted text leaves your machine, travels to a server you do not control, and only then gets cleaned. You did not reduce the number of companies that can see your confidential information. You added one.

The promise hides a round trip

Picture the path your text actually takes. You paste a contract, a support transcript, or a patient note into a tool. The tool sends that text to its cloud. The cloud finds the personal data, masks it, and returns a cleaner version. Then the cleaner version goes on to the AI provider.

Read that again. The masking happens after the data arrives at the scrubbing company. So the order of events is: your raw text leaves your device, lands on their server, and the protection is applied there. The whole reason you reached for the tool was to keep that raw text private, yet the raw text is exactly what you handed over to get the job done.

This is not a small detail. It is the difference between a promise of secrecy and a promise of process. "We strip your PII" describes what they do with your data. It does not say your data was never exposed. It cannot, because they had to hold the original to strip anything from it.

Why "never leaves your machine" is the stronger claim

Compare two statements.

The first says: send us your raw data and we will clean it before passing it along. The second says: your raw data never leaves your device, because the cleaning happens on the device itself.

The first asks you to trust a chain. Trust their network. Trust their storage. Trust their logging settings. Trust that no one on their side keeps a copy, and that their next policy update does not quietly change the rules. Every link in that chain is a place where your confidential text exists in full, readable form, outside your walls.

The second removes the chain. If the masking runs locally, there is no server in the middle that ever holds the original. The text is processed where it already lives. Nothing readable crosses the network until the personal data is already gone. You are not trusting a vendor to handle your secrets well. You are arranging things so the vendor never holds your secrets at all.

A promise you can verify by design beats a promise you have to take on faith. Local processing is verifiable by design. The data simply has no path to a third party.

The questions to ask any privacy tool

Marketing language blurs the line on purpose. So put the burden on the tool to be specific. Before you trust anything that claims to protect your data, get plain answers to these:

• Where does the scrubbing happen, on my device or on your server? If the answer is anything other than "on your device", the raw text is leaving your control.
• Who can see the raw text before it is masked? Your staff, your subprocessors, your AI provider, anyone?
• Is the raw text or the masked output logged, cached, or retained at any point, and for how long?
• Can the tool work fully offline, with no network access, and still do its job?
• Can I inspect the code or the process, or am I taking the privacy claim entirely on your word?

The offline question is the sharpest one. A tool that can run with the network switched off is a tool that physically cannot send your raw data anywhere. If a scrubber stops working the moment you cut its internet, you have your answer about where the work was happening.

How Adimen Velum is built

Velum was designed around the simple rule that the safest data is the data that never leaves. It runs locally and offline. The masking happens on your own device, before anything is sent onward. There is no Adimen server sitting in the path, reading your raw text on the way through, because there is no path through us at all.

That changes what you are being asked to trust. You are not trusting a privacy policy or a retention setting. The original text stays on your machine because the only place it gets processed is your machine.

Velum is also open source. The claim that nothing leaves your device is not a slogan you have to believe. It is something you, or anyone on your team, can read in the code and confirm. A privacy tool that asks you to take its word for it is asking for the one thing a privacy buyer should never give freely. We would rather you check.

The point

Cloud PII scrubbers can be useful, but be honest about what they are. A service that strips your data in its cloud has seen your data. It moved the exposure, it did not remove it. The stronger position is the boring one: keep the raw text on the device, do the work there, and let anyone audit that it is true.

If that is the standard you want, see how Velum handles it, or request a demo and put the offline test to it yourself.