We'd rather hold
a file back than
ship a name.
We build CORPUS on three rules: every measured number names its scope, every output is re-scanned before it is written, and your documents never come to us.
Why we built it
Companies are sitting on years of email, chat, documents and scans, and AI labs will pay to license data like it. The deals stall at the same step: the archive is full of people, customers, patients and employees, and nobody can sign off on selling their identities.
De-identification is what makes that archive licensable. The people come out; the knowledge stays. Done well, a thread still reads like a conversation, a form keeps its fields, and a model can still learn from all of it.
The law is specific about what counts. Under GDPR, data that can still be linked to a person is personal data: swapping names for consistent fakes is pseudonymization, and the result still needs a lawful basis to share. Fines reach €20 million or 4% of worldwide annual turnover. For health data, HIPAA accepts two routes: remove 18 listed identifiers, or have an expert determine that the risk of re-identification is very small. California's CCPA asks for reasonable technical measures, a public commitment not to re-identify, and the same promise in every contract downstream. A buyer's lawyers will ask which route you took, and for proof, file by file.
And it fails quietly. One name missed in one file out of a thousand is enough. So is a black box drawn over text that is still selectable, a name left in a document's properties or tracked changes, or a letterhead on a scanned page. Even with names gone, a few details together can point to one person: Latanya Sweeney found that ZIP code, birth date and sex alone uniquely identify about 87% of Americans. Manual review does not scale to millions of files, and a job that calls one person two different names wrecks the data's value.
So CORPUS swaps each person it finds for one consistent fake, or burns them out of PDFs and scans. It links names only on evidence in your files, then reopens each output and checks again. If a value it found is still there, the file stays behind with a reason, and every file comes with its report. All of it runs inside your own cloud account, and nothing comes to us. Whether a dataset meets the law is your counsel's decision; CORPUS gives them the evidence to make it.
How we decide what ships
Measure before claiming
Every measured number on this site names its scope and says whether it was an internal run. What we haven't measured, we don't claim.
Fail closed
A file in which a found value survives the re-scan is held back with its reason, and nothing is released without independent verifier approval. Silence is never counted as a pass.
Never take the data
CORPUS runs inside your own cloud account. You apply our Terraform; we never hold credentials there, and your files never come to us.
Invest in CORPUS.
De-identification at the source, for the data AI labs want to buy. Request the deck and we'll send it to you directly.