> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ainomos.ch/llms.txt
> Use this file to discover all available pages before exploring further.

# Personal data

> How Ainomos finds personal data, when it masks or withholds it, and how platform admins tune what counts.

Ainomos checks text for personal data, such as names, email addresses, phone numbers and bank account numbers. The app also calls this a PII check (PII: personally identifiable information). What happens on a match depends on where the text is used and on the room's [data class](https://docs.ainomos.ch/privacy/data-classes.md).

In rooms meant for internal content with a low protection need, C1 by default, Ainomos keeps personal data out. It withholds answers that contain personal data and masks it in imported documents. In rooms classified for personal data, it lets the data through and records what it saw. The rule behind this is the guardrail DAT-03, "No personal data in rooms with low protection needs".

## When Ainomos checks

| Where | What happens |
| - | - |
| An answer in the chat, or an answer to a connected app | Checked before anyone sees it. In C1 rooms, an answer with personal data is withheld. In other rooms it is delivered, and the evidence record notes which kinds of personal data it contained. |
| A file you import | Checked while Ainomos reads it. In C1 rooms, personal data is masked before any model reads the text, and the original file is not kept. In other rooms it is kept, and the file's note lists what was found. |
| Knowledge a connected app submits | Shown to the reviewer in the Inbox as **Personal-data hints**. The reviewer decides. |
| A planned action that a connected app asks Ainomos to check | In C0 and C1 rooms, personal data makes the result a caution. In C2 and C3 rooms it is reported for information only. Names of the room's own members and role words such as "product owner" do not count here. |
| A document read again | In C1 rooms, personal data is masked again. |

Your question itself is not checked for personal data. It is checked for credentials: a question that contains a password, an API key or a token is blocked and not processed, and no exception is possible.

C1 is the default for the whole installation. Whoever runs your installation can extend it to other classes. It is not a setting in the app.

## What counts as personal data

Platform admins choose the kinds of personal data Ainomos looks for. These are on by default:

* Person names
* Email addresses
* Phone numbers
* International bank account numbers (IBAN)

These can be switched on:

* Credit card number
* Swiss social security number (AHV)

A first and last name together counts as a name. A single word counts only when a cue stands shortly before it, such as a title ("Dr.", "Frau") or a label ("Contact:"). Colour words that are also surnames, and lists of things, do not count without such a cue.

## When an answer is withheld

In a C1 room, an answer with personal data does not reach you. Instead you see a card titled "Blocked by DAT-03". It shows:

* the rule's title and what it requires, and that the answer to your question was withheld;
* **Detected in the answer**, with the kinds found, such as "Person reference" or "Email address". The withheld text itself is not shown;
* a suggested next step: rephrase the question without personal details, or ask the room owners which context is allowed;
* the **Policy owner**, **View rule** and **Show evidence**.

### Request an exception

If the room's work really needs this data for a limited time, you can ask for an exception. For a one-off question, rephrase it instead.

Who can do this: members of the room. An owner of the rule's room decides.

**1. Open the request**

On the card, choose **Request exception (time-limited)**.

**2. Explain and limit it**

Write the **Justification** and choose a **Time limit** in days.

**3. Send it**

Choose **Submit request**. The policy owner decides and sets the final end date.

Once the exception is approved, answers in that room with personal data are delivered until it ends. See [Exceptions](https://docs.ainomos.ch/knowledge/exceptions.md).

### When the check is unavailable

If the personal-data check cannot be reached, Ainomos does not guess. In C1 rooms it withholds the answer as a precaution, and the card says plainly that the check was unreachable and that no personal data was detected. No exception is offered, because nothing was found. Files imported into C1 rooms fail for the same reason, and nothing from them is stored. Other rooms work as usual. **System status** shows the outage. See [System status](https://docs.ainomos.ch/admin/system-status.md).

## Masked text in imported documents

In a C1 room, each piece of personal data in an imported file is replaced by a marker that names its kind, for example `[PII:EMAIL_ADDRESS]`. Masking happens before any model reads the text and before anything is stored. The import result notes "Personal data found and masked", with the kinds.

Ainomos keeps no original of such a file, so the masked data cannot be recovered from Ainomos. If a room needs the personal data, import the file into a C2 or C3 room instead.

## Privacy settings

The **Privacy settings** page decides what counts as a match for the whole organisation. It does not decide what happens on a match: that follows from the room's data class.

Who can do this: platform admins.

Open **Settings**, then **Privacy settings** (under **AI & data**).

| Option | What it does |
| - | - |
| **Confidence threshold** | A number from 0 to 1. A higher value gives fewer, more certain matches. A lower value finds more possible personal data and more false alarms. The default is shown under the field. Valid email addresses and IBANs still count when the threshold is set high. |
| **Enforced PII entities** | The kinds of personal data Ainomos looks for. At least one stays on. The technical name beside each kind is the one that appears in evidence records and warnings. If a kind cannot be detected in your installation, the page warns you and refuses to save it. |
| **Your own email domains** | Addresses at these domains and their subdomains do not count as personal data. Enter one per line or separate them with commas. Leave it empty to check every address. |
| **Save** | Applies the values to every room. Each save writes an evidence record. |
| **Reset to default** | Returns all three values to the installation's defaults. |

### Test before you save

Under **Test detection**, enter a sample in **Test text** and choose **Check text**. The test uses the values currently entered, even before you save them. Each match shows the text found, its technical type and its score. The test text is not stored and creates no evidence record.

### What these settings do not change

* Which data classes withhold personal data. This is set for the installation.
* Whether the rule DAT-03 is in force. If DAT-03 is retired under **Rules**, Ainomos still checks answers and records what it found, but withholds no answer. Imports into C1 rooms still mask personal data. See [Rules](https://docs.ainomos.ch/knowledge/rules.md).

## Related

* [Data classes](https://docs.ainomos.ch/privacy/data-classes.md)
* [Import documents](https://docs.ainomos.ch/import/documents.md)
* [Exceptions](https://docs.ainomos.ch/knowledge/exceptions.md)
* [Audit log](https://docs.ainomos.ch/privacy/audit-log.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.