By · Last updated 2026-04-13

返回博客技术

气隙网络隐私保护:完全离线的个人信息匿名化

FedRAMP和ITAR环境有一个共同点——云端根本不是选项。GDPR第4条第5款规定的可逆假名化、EDPB指南要求的令牌分离……本文介绍气隙环境下的合规解决方案。

April 13, 20269 分钟阅读
air-gapped anonymizationSCIF document processingITAR complianceFedRAMP offline toolsoffline PII detection

气隙规则

有些网络根本没有互联网连接——不是政策规定,而是物理设计使然。

SCIF(敏感分隔信息设施)是法拉第屏蔽室,无线信号无法进出。ITAR(国际武器贩运条例)禁止将受控技术内容发送给未经批准的接收方,而云服务提供商均未获得ITAR许可。对这些机构而言,「云端SaaS」根本不是需要权衡的风险选项。

对于这些场所,云端工具根本行不通,没有例外。

需要实时网络连接的工具无法在此运行,连接许可证服务器的工具会被直接屏蔽,向云端API发送文件进行检测的工具在SCIF内根本无法运作。这些不是边缘情况,而是国防团队每天面对的现实约束。

ITAR场景

一位国防企业的数据科学家持有ITAR受控的人员档案,需要在共享文件前移除姓名和身份标识,而她所在的网络处于气隙隔离状态。

没有云端解决方案可用,唯一的路径是在本地设备上运行的工具,该工具必须在本地存储模型,并在不发起任何外部请求的情况下生成脱敏输出。

基于Tauri 2.0构建的桌面应用程序正是为此而设计:安装完成后,运行过程中不发生任何网络请求。spaCy命名实体识别模型和正则表达式规则均在本地CPU上运行,输出文件始终保留在设备上,直至用户主动导出。

为何可逆性至关重要

涉密工作往往需要可逆假名化:团队用代码替换真实姓名,保持数据的可用性,同时保护真实身份信息。

GDPR第4条第5款将假名化定义为正式的隐私保护措施,可降低合规风险。假名化记录承担的法律义务更少——前提是查找令牌与数据集分开存储。

IAPP 2024年研究发现,仅23%的工具支持真正意义上的可逆处理,大多数工具只提供单向掩码或完全替换,一旦记录被覆写便无法还原。

部分政府团队按照安全隔离区划分工作:一组团队获得假名化文件并进行分析,另一组团队持有查找令牌,仅在法律要求时才进行重新识别。这种分离设计是多团队涉密工作流中唯一安全的处理方式。

零知识模型则更进一步:查找令牌在客户端设备上生成,从不对外传输。即便供应商收到传票,也无法交出令牌——因为他们从未持有过。这一机制满足了许多涉密环境中的证据监管链要求。

EDPB令牌分离要求

EDPB 05/2022号指南规定,假名化令牌必须与假名化记录分离存储,不得由同一方同时持有;或须设置技术控制措施,防止该方同时访问记录和令牌。

以下三项措施组合可同时满足这一要求和气隙约束:

  • 令牌在客户端设备上生成,从不对外传输
  • 所有处理均在本地完成,任何内容不离开气隙环境
  • 输出文件和令牌分开导出,通过两条独立路径分发

这一设计在满足EDPB要求的同时,也完全符合气隙约束。

如需全面了解,请参阅我们的安全概览,了解本地处理如何斩断第三方数据链;参阅我们的合规指南,了解GDPR数据传输规则;以及常见问题,获取配置帮助。

anonym.legal桌面应用程序在本地设备上完成所有个人信息检测,安装后无需互联网连接,支持Windows、macOS和Linux,内置NLP模型覆盖24种语言。

内容更新至2026年

数据来源

准备好保护您的数据了吗?

开始使用 285 种实体类型在 48 种语言中匿名化 PII。

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

Related reading

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.