Agents can read anything. Models see only what you allow.

TraceMem looks inside everything your agents send, scanned PDFs and photos included, and handles each sensitive value the way you decide before it reaches a model. The work carries on. Your customers’ data stays yours.

An illustration with made-up data. Three things an agent sends pass through TraceMem in turn. A prompt: the customer’s name and IBAN become reversible tokens and the card number is masked. A scanned claim form: the face photo and signature are redacted, the name is tokenized, the national ID number removed and the date of birth reduced to the year. A photo of a driving licence: it is recognised as an identity document and held until Claims leadership approves.

Illustrative data


Prompt text is the easy part. Attachments are where the data is.

TraceMem reads scanned pages, screenshots and photos as well as text, and finds faces, identity documents and signatures, not just the words on them. A file it can’t read is refused, never passed on unchecked.

As sentTraceMem seesModel gets

Found in this scanned form

  • Face photographBlacked out
  • Name, read from the scanTokenized
  • Irish PPS numberRemoved
  • Date of birthReduced to the year
  • Handwritten signatureBlacked out
  • Photo metadataStripped

Reads prompts, model replies, images, and PDFs whether they were typed or scanned. Illustrative documents.


Every value, handled its own way.

You decide what happens to each kind of data, not to the request as a whole. So the agent still gets its work done with the parts it’s allowed to use. Try it.

claims-agent asked

Draft the settlement letter for Aoife Brennan, card 4539 1488 0343 4417, about her whiplash injury on claim CLM-20931.

The model receivesProceeds

Draft the settlement letter for tok_name_7f3a, card •••• 4417, about her diagnosis on claim CLM-20931.

Sent. The claim reference went through as it was and was logged; the rest was changed before it left.

Tokens go out. Real values come back, to the right people.

The model works with stand-ins it can’t read. When the answer comes back, TraceMem checks the reply too, then puts the real values back only for people whose role allows it.

Your sideTraceMemThe model’s side

claims-agent sends

Confirm the refund for Aoife Brennan to IE29 AIBK 9311 5212 3456 78.

The model receives

Confirm the refund for tok_name_7f3a to tok_iban_0d44.

Maya Okafor readsRole allows it

Refund confirmed for Aoife Brennan to IE29 AIBK 9311 5212 3456 78.

The model replies

Refund confirmed for tok_name_7f3a to tok_iban_0d44.
Who is reading the reply?

Tokens point back to your own records; TraceMem keeps no copy of the original. Roles come from verified identity.

The claims handler sees the real name and IBAN.


Built for where you operate.

Finland, Sweden, Norway, Denmark, Germany, France, the Netherlands, Spain, Italy, Ireland, the United Kingdom and the United States.

Each country’s own identifiers are recognised, with their check digits where they have them, whatever language the text around them is in. Add what matters in healthcare, legal, law enforcement or finance, describe your own kinds of sensitive data in plain words, and see which columns in your own databases hold personal data, for the people who own that data to confirm.


Bring a prompt, a scanned case file and a schema. We will show you what comes out.