anonym.legal

By · Last updated 2026-04-23

Nazaj na blogVarnost malih in srednjih podjetij

Reverzibilno sifriranje za financne revizije

Sodba SDNY iz februarja 2026 je ugotovila, da dokumenti, obdelani z UI, izgubijo privilegij odvetnik-stranka, ce niso anonimiziran pred obdelavo.

April 23, 20268 min branja
financial audit anonymizationreversible encryption auditprivate equity data sharingauditor access controlstime-bounded decryption

Posodobljeno za leto 2026

Problem preverjanja v reviziji

Zunanji pregledovalci morajo preveriti stevila za financnimi porocili. Za to potrebujejo izvorne zapise.

Trdno brisanje te zapise trajno odstrani. Za preverjanje ne ostane nic. Postopek pregleda se zlomi. Orodja za trajno odstranjevanje ustvarijo ta problem: scitijo informacije z unicevanjem njihove koristnosti.

Reverzibilno maskiranje z zetoni resi oba problema. Obcutljiva polja - imena strank, pogoji poslov, ID-ji podjetij - se zamenjajo z zetoni. Pregledovalec dobi ciste datoteke. Prave vrednosti ostanejo dosegljive prek casovno omejenega dostopnega kljuca.

Poglejte nas pregled pravne skladnosti in vodic po sistemu zetonov, da razumete, kako to deluje od zacetka do konca.

Kako deluje obseg dostopa

Model ustreza vsaki revizijski angazi.

Financna ekipa zamenja obcutljiva polja pred delitvijo. Vodilni pregledovalec dobi obseg dostopnega kljuca, vezan na to nalogo. Med pregledom lahko uskladi zetone z resnicnimi vrednostmi. Sledijo stevilkam nazaj do izvornih zapisov.

Ko se pregled zakljuci, se dostopni kljuc rotira in preklic. Kopij pregledovalca ni moc odsifrirati. Nekdanje osebje, ki odide po zakljucku, ne more doseci starih zapisov. Tehnicni nadzori uveljavljajo obseg - ne samo pogodbe.

Rotacija kljucev kot upravljanje

Preklic dostopnega kljuca po vsaki nalogi ustvari evidentiran nadzor. Ta nadzor hkrati izpolnjuje vec pravil upravljanja.

Skladnost SOX: Oddelek SOX 302 zahteva, da uradniki potrdijo delovanje nadzora. Rotacija dostopnega kljuca po vsaki nalogi je taksen nadzor. Preveriti ga je mogoce v pregledu SOX.

ISO 27001 Priloga A.10.1.1: Standard zahteva korake upravljanja kljucev, ki zajemajo potek veljavnosti, rotacijo in preklic. Vezava vsake rotacije na zakljucek naloge to celovito izpolni.

Minimizacija podatkov GDPR: Clen GDPR 5(1)(e) pravi, da zapisov ni dovoljeno hraniti dlje od njihovega namena. Ko se pregled konca, preklic dostopnega kljuca to izpolni. Zapisi se obstajajo. Preprosto so zaklenjeni brez novega kljuca za nov namen.

Poglejte nas pregled zascite, da vidite, kako se ta pravila preslikajo na model zetona.

Sodba SDNY iz februarja 2026

Sodba Heppner (S.D.N.Y. 17. feb. 2026) je ugotovila, da dokumenti, obdelani z UI, izgubijo privilegij. Zascititi jih je treba pred obdelavo. Posredovanje zunanjemu procesorju se steje kot razkritje.

Enaka logika velja za financne zapise. Njihovo posredovanje pregledovalcem brez tehnicnega nadzora se steje kot razkritje. Reverzibilno maskiranje z zetoni je ta nadzor. Omogoca izvedbo pregleda brez izpostavljanja neobdelanih podatkov.

Model petih korakov

Postopek je preprost:

  1. Obcutljiva polja se tokenizirajo pred katerokoli zunanjo delitvijo.
  2. Pregledovalec prejme obseg dostopnega kljuca, ki velja samo za to nalogo.
  3. Pregled poteka na zetonih. Pregledovalec lahko po potrebi preveri prave vrednosti.
  4. Ob zakljucku se dostopni kljuc rotira in evidentira.
  5. Mapa zetonov gre v hrambo. Nov dostop zahteva novo izdajo.

Iz organizacije ne zapusti noben neobdelan zapis v berljivi obliki. Pregledovalec vseeno dobi, kar potrebuje. Organizacija pa hrani zapise, ki hkrati izpolnjujejo SOX, ISO 27001 in GDPR.

Poglejte nas pristop k zaznavanju entitet in nacrti in cene za vec podrobnosti.

Viri

  • United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. 17. feb. 2026) - Debevoise Data Blog
  • Sarbanes-Oxley Act Oddelek 302 - SEC polno besedilo
  • ISO 27001:2022 Priloga A.10.1.1 - Katalog ISO
  • Clen GDPR 5(1)(e) - GDPR-Info
  • IAPP: Upravljanje podatkov v financnih storitvah in reverzibilna anonimizacija - IAPP

Sorodni članki

Varnost malih in srednjih podjetij

Cut Privacy Training: Weeks to Hours

Privacy tool onboarding typically takes 2-4 weeks, with a 22% first-week configuration error rate. Shareable presets reduce training to 1 day and.

Varnost malih in srednjih podjetij

MSPs: Standardize Anonymization

MSPs and compliance consultants serving multiple client organizations cannot manually reconfigure PII tools per client at scale.

Varnost malih in srednjih podjetij

Transparent Pricing in Privacy Software

67% of B2B buyers prefer vendors with transparent pricing. 43% eliminated vendors who required sales contact for pricing information.

Ste pripravljeni zaščititi svoje podatke?

Začnite z anonimizacijo PII z več kot 285 tipi entitet v 48 jezikih.

Začnite brezplačno preizkušnjoOgled funkcij

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

Related reading

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.