Як дати ШІ-агенту базу клієнтів і не сказати йому, хто ваші клієнти

Every business facing the challenge of giving SHI agents client databases and not revealing who the clients are struggles with a common issue. The most pressing questions involve which clients owe money, who is waiting for a response, and what complaints are most common. To answer these, the agent needs a client database, invoices, and email addresses.

However, this cannot be given to a cloud model, as it contains personal data of individuals who did not consent to it. Either you don't ask, or you share the data and hope for better results.

I developed Aura, a desktop application that gives SHI tools privacy and keeps the data on your computer. I needed a third option, and I tested it. To verify, I recorded whether each test passed or failed before running, and failures appeared as failures. When a public test set existed, I used it. The idea is that the agent sees markers, while you see names.

Before an agent touches the table, Aura creates a local copy where each name, email, phone number, and account number is replaced with a static marker. What you have is what the agent sees, such as "Call Kovalski to check the account at jan@firma.pl." "Called Mr. Kovalski, requesting the invoice at email_1." The same person always receives the same marker, allowing the agent to continue calculating, grouping, merging tables, and tracking clients across rows.

When you ask for a list ("give me the debtors"), the result is written to a file on your computer with real names. The agent only knows the file name. A straightforward question is whether SHI works worse when it doesn't see names. The answer is almost none. I took BIRD, a public test where SHI writes SQL queries to real databases: 179 questions, 4 databases, queries generated by Gemini-3.8-flash from Google.

The agent sees correct answers, names, emails, and IDs in the cloud. 68.2% correct, 849 markers in place of names (Aura), 67.6% correct, 0 with just table structures, and 35.2% with no data sent at all. The difference with full access is only 0.6 points, within acceptable error margins. With another model (Qwen: 67.0% with markers versus 64.8% with real data), the result is the same.

The obvious alternative, "everything locally," is much worse: a small model on your computer gave twice as many correct answers. The hardest part is the text table, a simple case where the "Name" column is the name. However, real business data is mostly text: notes, comments, letter texts. Names can appear anywhere, in any language, in any case.

Aura hides the sender and recipient and over 750 names, addresses, numbers, and links in the letters. It then checks itself by searching for all 254 values it hid. Only a few words (city, name without surname) remained. This check is now built into the application, so you don't have to take my word for it. What it doesn't do is completely anonymize.

It's pseudonymization, not anonymity. The agent sees the content, including themes, amounts, dates, company names. If a person is identified by the content ("director of our largest client"), the markers won't hide it. In free text, the coverage depends on what you have. Some words, like names without surnames or locations, might remain.

Names in different alphabets remain distinct; they can only be caught by a model (with permission). Texts in Cyrillic differ from Latin signatures; a model (with permission) can only detect unknown individuals mentioned out of the blue. Text is hidden from people who are not in your data. Financial documents in 7 languages had 95% accuracy, court decisions were close to 95% (82% of all mentions; the rest were initials like "A.", which the court had already anonymized), and EU texts in 21 languages had 55% accuracy.

Then I verified everything on 85 real letters from my inbox. Aura masked the sender and recipient and over 750 names, addresses, numbers, and links in the texts. Then it checked itself: it searched for all 254 values it hid. No full names, addresses, or numbers remained. Only three separate words (city, name without surname) remained.

This verification is performed after each upload. It is not meant to be completely anonymous; it is pseudonymization, not anonymity. The agent sees the content: themes, amounts, dates, company names. If you reveal the person by the content ("director of our largest client"), the markers won't hide it. In free text, coverage depends on what you have.

Some words, like names without surnames or locations, might remain. Names in different alphabets remain distinct; they can only be caught by a model. The text hides people, financial documents in 7 languages had 95% accuracy, court decisions were near 95% (82% of all mentions; the rest were initials like "A.", which the court had already anonymized), and EU texts in 21 languages had 55% accuracy.