AI in administration with citizens’ data staying inside the authority.

The DPO is mandatory and asks

Every public body has a DPO (Art. 37 GDPR). The first question for any AI tool is “where does citizens’ data go?”.

Staff already use AI

Usually with personal free accounts. A policy is not enough without a tool that makes protection the default.

Hosting requirements

Many bodies need EU infrastructure, a dedicated server, or even an air-gapped install. The same tool has to run there too.

What gets detected

What gets detected in your documents

Greek-specific identifiers

• Tax ID (ΑΦΜ) — Greek tax identification number with modulo-11 check digit validation, not a bare 9-digit match. (check: modulo 11)
• Social security (ΑΜΚΑ) — Greek social-security number with Luhn and birth-date validation. (check: Luhn)
• ID card number — Greek police ID card, old and new formats (letters and digits). (check: μορφή)
• Vehicle plates — Greek registration plates, restricted to the letters Greek plates actually use. (check: μορφή)
• Court case numbers (ΓΑΚ, ΕΑΚ, ΑΒΜ) — Greek court case and docket numbers, context-gated with NLP. (check: συμφραζόμενα)
• Cadastre code (ΚΑΕΚ) — National Cadastre property code, 12-digit and full 18-digit forms, with prefecture-code validation. (check: κωδικός νομού)
• Property references (ΑΤΑΚ, ΠΕΑ) — E9 property identifier and energy-performance certificate security numbers. (check: συμφραζόμενα)
• Greek places — Greek gazetteer of cities, municipalities and regions, in every grammatical case.

European and international

• IBAN — Bank accounts of every EU/EEA country with MOD-97 validation. (check: MOD-97)
• National IDs (EU, US, UK) — DNI, PESEL, Codice Fiscale, NIR, SSN/ITIN/EIN, National Insurance and more. (check: εθνικοί έλεγχοι)
• Passports — Passport numbers, context-gated in 24 EU languages. (check: συμφραζόμενα)
• Driving licences — Driving-licence numbers, context-gated. (check: συμφραζόμενα)
• Phone numbers — Landlines and mobiles for the EU, UK, US/Canada and Switzerland, validated per country. (check: libphonenumber)
• Chassis number (VIN) — 17-character vehicle identification number per ISO 3779, context-gated. (check: ISO 3779)
• Postal codes — Greek postcodes, US ZIP codes and UK postcodes. (check: συμφραζόμενα)

People and contact details

• Names across grammatical cases — Greek NER that follows inflection, greeklish spellings and links the forms of the same person.
• Email addresses — Email addresses. (check: μορφή)
• Street addresses — Street, number and area, in Greek and Latin-script text.

Health and special categories

• Special categories — Religion, nationality, political and trade-union references, marital status, profession.

In scanned PDFs and images, signatures and stamps are covered by visual redaction, with a preview before it is applied.

Every category and the accuracy measurements

How it works, in three steps

Paste or upload

A citizen’s application, a brief, a scanned document through OCR. The clerk sees the findings before anything leaves.

The AI sees placeholders

“The applicant [NAME_1] (tax id [AFM_1]), resident at [ADDRESS_1], requests.”. The substance stays for the summary or the reply.

The answer returns complete

The draft reply comes back with the real data in the authority’s account, with a record of what was masked.

Policy per authority

The administrator sets which types are always masked, which models are allowed and whether LLM providers are restricted to the EU.

Audit trail and evidence pack

Per conversation and per document. What the DPO needs for the record of processing and for an impact assessment.

Desktop agent with central enforcement

On the authority’s Windows machines it masks ChatGPT, Claude, other AI chats and applications. Settings from the console, not the user.

Five hosting models

Shared EU service, dedicated server, zero-knowledge relay, air-gapped with a local model, confidential computing.

What you answer the DPO

• Pseudonymisation under Art. 4(5) and a security measure under Art. 32 GDPR; Greek law 4624/2019.
• Mapping encrypted on EU infrastructure or on the authority’s own server; your own key.
• A residency policy for LLM providers: EU only, or a local model with no network.
• Documentation per hosting model with a DPO annex: flows, processors, measures, residual risk.

Guides for the GDPR file

GDPR checklist for AI tools in a Greek office

12 points with the articles next to each, a one-page AI-use policy template, what to mask. Greek.

Read PDF

Frequently asked

Can it run on our own servers?

Yes. There is a dedicated-server edition and an air-gapped edition with a local model. Same software, same rules, same record.

What about protocol numbers?

By default they stay, because the tax id is recognised by its checksum rather than its length. If the authority treats them as links to persons, a rule masks them.

How do we prove what left?

Every conversation and document has a record of the types masked, when and by whom. The evidence pack collects it for an audit.

Ask for a demo for your authority

With your own workflows and your DPO at the table. Or start free with one account.

Start free