Local, in-browser or cloud pseudonymization: how to choose

Every pseudonymisation tool promises the same result: a copy of your file that an AI can read without identifying your client. Where the work happens is what differs, and it decides what leaves your computer, which contract you need, and which professional rule you can point to.

1. Three architectures

The tools on the market for lawyers fall into three families. Our guide to choosing pseudonymization software sets out what each one implies. See the guide.

• Desktop application. Detection models are installed on the computer. The document is read, pseudonymised and rebuilt on the machine; the mapping between pseudonyms and real identities is stored there too.
• Browser extension. The extension sits between you and the AI's web interface. Depending on the product, detection runs in the browser itself or is delegated to the vendor's servers; the mapping is often kept in the browser.
• Hosted platform. You upload the document to the vendor's service, usually hosted in France or the EU, which returns the pseudonymised version. The mapping is kept on the server, or sent back to you, depending on the product.

2. What leaves the machine, in each case

Two objects matter: the original document, with the real identities in it, and the mapping table, which is the key that undoes the pseudonymisation. Whoever holds both holds the file.

Read each vendor's documentation on these two points rather than its tagline: "French hosting" says where the server is, not whether the original document goes there.

3. The contractual consequence

As soon as a provider processes the original document on your behalf, it acts as a processor under article 28 of the GDPR. The controller, meaning the firm, may only use processors "providing sufficient guarantees to implement appropriate technical and organisational measures", and must sign a processing agreement (often called a DPA) setting out the subject matter, duration, location and deletion of the data. It is doable, and many vendors offer one; it is one more piece of diligence, to complete before the first document is sent.

When detection and the mapping stay on your own computer, no third party processes the original document for the pseudonymisation step. The AI provider you then use is a separate question, and it only ever receives the pseudonymised copy.

4. What the professional texts say

The CNB guide "Ethics and artificial intelligence" (adopted March 2026) is explicit about sovereignty: "the only ways to eliminate sovereignty risks […] are prior anonymisation or pseudonymisation of the data, or installing the LLM on the firm's own information systems" (our translation). It adds that a provider's promise not to reuse data "is generally neither provable nor verifiable" (our translation).

The Paris Bar's white paper on AI considers both routes: a lawyer may use anonymisation or pseudonymisation, and "may also use a locally deployed tool, with no external transmission of data to third-party servers" (our translation). The CNIL, in its first guidance on deploying generative AI, also recommends favouring "local, secure and specialised systems" (our translation).

A local pseudonymisation tool is the one setup that matches both readings at once: the pseudonymisation is done beforehand, by a tool deployed on the firm's own machines.

5. The honest trade-offs

Local is not free of constraints, and the cloud has real advantages. Before choosing, weigh these:

• Installation. A desktop app has to be installed on each workstation, sometimes through the IT department. A web platform or an extension is running in minutes.
• Machine power. Detection models running locally use the computer's memory and processor. On an older laptop, a long file takes longer than on a server. Our measured processing times by machine.
• Working as a team. A hosted platform shares a file and its pseudonyms between several people natively. Locally, the protected copy and the mapping live on one machine unless the firm organises shared storage.
• Updates. A cloud service improves for everyone at once. A desktop app has to be updated on each machine.

6. Where Hexagone AI sits

Hexagone AI is a desktop application for macOS (Apple Silicon) and Windows 10/11. Detection, pseudonymisation and the mapping all run on the computer; no document is uploaded, and it works offline after installation. The trade-offs above apply to it: it has to be installed, and its speed depends on the machine. For firms that prefer a hosted service, a web app and an API served from EU infrastructure also exist, with a published DPA. Security and data flow.