How we detect PII with zero cloud dependency

Personal data detection is usually a cloud-native service. You send your text to an API, it returns labeled entities, and you hope the provider's privacy policy aligns with your compliance requirements. We rejected that model entirely.

The challenge of local detection

Building a PII detector that runs on a laptop or browser is not trivial. Cloud services have the advantage of massive compute, large models, and continuous updates. A local system has to be fast, accurate, and lightweight enough to run without fans spinning up.

Our approach combines three layers: pattern-based detection for structured data, heuristic rules for contextual identification, and a lightweight local model for edge cases. Each layer operates independently, and none requires a network connection.

Pattern matching for structured PII

The first and fastest layer uses regular expressions and checksum validation for structured identifiers. Credit card numbers, IBANs, social security numbers, and tax IDs all follow predictable formats. We validate not just the pattern, but the underlying checksum where applicable.

This layer processes text in a single pass and identifies the majority of structured PII in under a millisecond for a typical paragraph.

Contextual detection with heuristics

Not all PII is structured. Names, addresses, and organization mentions require understanding context. Our second layer uses a set of heuristic rules built from linguistic patterns.

For example, a sequence of capitalized words preceded by "Contact:" or "Signed by:" is likely a person name. A number following "Phone:" or "Tel:" is likely a phone number, regardless of format. These rules are not machine learning models; they are fast, deterministic, and fully auditable.

Auditable means you can read the rule, understand why it triggered, and modify it. Black-box models cannot offer that.

Local inference for edge cases

The third layer is a quantized transformer model that runs entirely in the browser or desktop environment using ONNX Runtime. It is small, under 50MB, and handles the cases where patterns and heuristics fall short: ambiguous names in mixed-language text, indirect references to people, and unusual formatting.

Because the model runs locally, it never sees data from other users. There is no training on your inputs, no fine-tuning on your domain, and no risk of cross-contamination between organizations.

Performance benchmarks

On a standard MacBook Pro, Velum processes a 500-word document in under 15 milliseconds. The browser extension adds less than 5 milliseconds of overhead to form submissions. For batch processing, a 10,000-record dataset completes in under two minutes on a consumer laptop.

Why this matters

Speed is not just a convenience. It determines whether a privacy tool gets used or ignored. If masking adds friction, users will bypass it. By keeping everything local and fast, we make the secure path the easy path.

See local detection and masking in action with Velum, or request a demo to try it on your own documents.