Data Protection Layer
Pseudonymization before AI processing
Most assistants send your messages to an AI provider exactly as you wrote them. Julia replaces the names, email addresses and phone numbers with tokens first, and puts the real values back in the reply. The model does the reasoning; it does not get your address book.
What the model actually sees
When you tell Julia to "schedule a meeting with Sarah Chen at sarah@company.com", the AI doesn't see those real names and emails. Instead, it sees "schedule a meeting with PERSON_A at EMAIL_A". The AI processes the request, and Julia translates the response back to real names before showing it to you. Your typed messages and the conversation context around them go through this on every turn.
Voice notes are the exception
Pseudonymization works on text. A voice note has no text until it has been transcribed, and transcribing it means sending the recording — so a voice message reaches OpenAI exactly as you spoke it, names and all. The same applies in reverse: when Julia replies with a spoken message, the audio is generated from the finished text with the real names restored, because a voice note saying "PERSON_A" out loud would be useless.
This is a property of how speech recognition works, not something we plan to fix in a later release. If a particular message is sensitive, send it as text and the protection above applies to it.
How the Privacy Layer Works
Every message goes through a sophisticated two-layer protection system before reaching the AI:
Two-Layer Protection System
The privacy layer combines two complementary protection mechanisms to ensure comprehensive coverage:
Pseudonymization
The first layer replaces all known personal data with deterministic pseudonyms. This includes information from your contacts, profile, and connected accounts.
Example Transformation:
Protected Data Types:
- Person names
- Email addresses
- Phone numbers
- Company names
- Addresses
- Profile data
PII Detection
The second layer uses Microsoft Presidio, an enterprise-grade PII detection engine, to catch any personal information that wasn't in your known contacts — like a new phone number or credit card you mention.
Additional Detection:
Detected Patterns:
- Credit card numbers
- Social Security Numbers
- Bank account numbers
- Passport numbers
- Driver's licenses
- IBAN codes
Bidirectional Processing
The privacy layer works in both directions, ensuring data is protected throughout the entire conversation lifecycle:
1. Your Message
When you send a text message, the personal data in it is replaced with pseudonyms before the AI sees it.
2. Tool Execution
When Julia needs to execute a tool (e.g., create a calendar event), pseudonyms are converted back to real values so the tool works correctly.
3. Tool Results
Results from tools are pseudonymized again before being fed back to the AI for context.
4. Final Response
The AI's response is de-pseudonymized before you see it, so you get natural text with real names.
Deterministic Mapping
A key feature of the privacy layer is that pseudonyms are deterministic — the same contact always maps to the same pseudonym within a conversation. This ensures the AI maintains context correctly.
Consistent Mapping Example:
| Real Value | Pseudonym | Category |
|---|---|---|
| Sarah Chen | PERSON_A | Person |
| John Miller | PERSON_B | Person |
| sarah@company.com | EMAIL_A | |
| +1 555-1234 | PHONE_A | Phone |
| Acme Corp | ORG_A | Company |
This mapping persists across multi-turn conversations and even through clarification flows, ensuring consistent context for the AI.
Sensitive Data Warnings
When the PII detection layer detects highly sensitive information like credit card numbers or Social Security Numbers, it generates warnings that are logged for security monitoring. The data is still pseudonymized, but the system recognizes when extra-sensitive information is being processed.
High-Risk Entity Types
The following patterns trigger additional security logging when detected:
- • Social Security Numbers (SSN)
- • Credit card numbers
- • Bank account numbers
- • Passport numbers
- • Driver's license numbers
- • IBAN codes
Technical Architecture
Core Components
PrivacyGatewayService
The orchestrator that manages the full lifecycle of privacy protection. Coordinates between pseudonymization and PII detection, handles map serialization for multi-turn conversations.
PseudonymizationService
Handles deterministic mapping between real values and pseudonyms. Creates maps from user context (contacts, profile, accounts) and performs bidirectional text transformation.
PiiDetectionService
Integrates with Microsoft Presidio Analyzer to detect unknown PII patterns. Uses machine learning models to identify entities not present in the user's known contacts.
Key Features
- Deterministic mapping (consistency across requests)
- Bidirectional transformation (pseudonymize ↔ depseudonymize)
- Deep object traversal (handles nested data)
- Case-insensitive matching (emails, names)
- Word-boundary awareness (avoids partial replacements)
- Multi-turn conversation support
- Clarification flow continuity
- Graceful degradation (works if Presidio is down)
Why This Matters
Most AI assistants send your raw data directly to AI providers like OpenAI. This means your contact names, email addresses, phone numbers, and personal details become part of their systems — subject to their privacy policies and potential data breaches.
Julia's privacy layer changes this for the messages you type. The AI provider sees abstract tokens like PERSON_A and EMAIL_A rather than the people behind them, so a breach at the provider exposes tokens rather than your address book.
It is a meaningful reduction in what leaves our servers, not an absolute one: voice notes are transcribed and spoken by OpenAI in the clear, as described above, and your data is stored on our own infrastructure in France.