Pseudonymization software for financial services, 100% local.
Hexagone AI is French, 100% local pseudonymization software for banks, asset managers, insurers and M&A teams. It replaces client names, company names, IBANs, amounts and references in a file on the user's own machine, before Claude, ChatGPT, Mistral, Copilot or an internal assistant reads it, then re-identifies the answer locally. Data covered by professional secrecy never leaves the firm.
KYC files, credit memos, due diligence reports, client complaints, contracts: generative AI saves hours on these documents, and every one of them holds information covered by professional secrecy. Hexagone AI lets you keep the models you already use, on a copy where nothing identifies your clients any more, without adding one more provider that receives your data.
What your profession's rules say about AI
- French Monetary and Financial Code, article L511-33
Anyone who takes part in running a credit institution "or who is employed by one of them is bound by professional secrecy". (our translation)
Banking secrecy binds every employee, not only management. The article lists exceptions (supervisors, the courts, certain transactions), but none for an AI provider.
- French Monetary and Financial Code, article L531-12
Anyone who takes part in running "an investment firm or a portfolio management company, or who is employed by it, is bound by professional secrecy". (our translation)
Asset managers and investment firms are in the same position as banks when it comes to generative AI.
- French Monetary and Financial Code, article L571-4
For persons covered by article L. 511-33, "breaching professional secrecy is punished by the penalties provided for in article 226-13 of the Penal Code". (our translation)
That is one year's imprisonment and a 15,000 euro fine: the exposure is not only regulatory.
- DORA Regulation (EU) 2022/2554, article 28
Financial entities using third-party ICT services "remain fully responsible at all times for complying with, and discharging, all obligations under this Regulation and applicable financial services law". (our translation)
An AI provider that receives your documents is one more third-party ICT provider to register and manage. Pseudonymising on your own machines creates no new outbound data flow.
- AMF, "The use of AI by financial market participants in France" (February 2026)
"Financial entities mostly rely on off-the-shelf solutions supplied by specialised third-party providers, with a strong dependence on a small number of non-European players." (our translation)
In the study, respondents rank data governance and protection as the top AI risk, and the AMF notes that confidentiality constraints "require specific precautions".
- CNIL, Q&A on generative AI (18 July 2024)
With a consumer service, "never share confidential information such as personal data, company data or government data"; for deployment, "favour on-premise solutions". (our translation)
The data protection regulator recommends local deployment by default. Hexagone AI applies that principle to the most sensitive step: preparing the documents.
Teams already use generative AI, often through commercial models from a few non-European providers: that is the finding of the AMF's February 2026 study. Every client document pasted into one of those tools hands information covered by secrecy to a third party, and adds one more flow to justify under DORA.
Banning AI solves nothing: usage moves to personal accounts. Redacting by hand does not scale to a hundred-page KYC file or a whole data room, where the same client appears under their name, IBAN, company name and initials.
Hosted pseudonymisation services solve the volume problem, but they receive the original document, real identities included. That is one more third-party provider, with its own contract, audit and entry in the register of information.
How it works
Point Hexagone AI at the file
PDF (scanned ones too, with local OCR), Word, Excel, PowerPoint, text. One document or a whole directory: a KYC file, a data room, a batch of complaints.
Detection runs on the machine
Hexagone AI's models find identifying data and replace it with neutral markers or realistic substitutes. The same client keeps the same pseudonym across every document.
Review and audit trail
Every detection appears in the preview pane and can be corrected before export. Every detection and substitution is logged, and the log exports as CSV for compliance.
Your AI works on the copy
Claude, ChatGPT, Mistral, Copilot or an internal assistant: you keep your tools. They read a file where nothing identifies your clients any more.
The answer is re-identified locally
The mapping stays on the machine. Hexagone AI puts the real values back into the AI's answer, on the user's computer.
What gets replaced
- Names of clients, beneficial owners and directors, initials and aliases
- Company names, subsidiaries and counterparties
- IBANs and card numbers
- Amounts
- National IDs, passport and tax numbers
- Postal addresses, emails and phone numbers
- Dates of birth and other identifying dates
- Case numbers and client references
- Your own entity types (internal account numbers, product codes…)
Frequently asked questions
- Can a bank use ChatGPT, Claude or Copilot on client documents?
- Not on raw documents without addressing the professional secrecy of article L511-33 of the Monetary and Financial Code, whose breach carries the penalties of article 226-13 of the Penal Code, and without treating the tool as a third-party ICT provider under DORA. Pseudonymising beforehand, on the machine, lets you use those tools on a copy that no longer contains information identifying clients.
- Is Hexagone AI a third-party ICT provider under DORA?
- We publish software, which your risk function assesses like any installed software. But the desktop application receives no documents: detection, replacement and the mapping run on your machines and work offline after installation. No client data passes through our servers.
- Can Hexagone AI be deployed on our own infrastructure?
- Yes. The Enterprise plan offers on-premise or air-gapped deployment, SSO and a command-line interface to build pseudonymisation into your processing pipelines. The desktop app runs on macOS Apple Silicon and Windows 10/11 64-bit.
- How do we show compliance what was masked?
- Every detection and substitution is logged locally, and the audit trail exports as CSV for compliance, the DPO or an inspection. The mapping stays on the user's machine.
- Does pseudonymisation take the data out of the GDPR?
- No. As long as the firm holds the mapping, pseudonymised data remain personal data for it. Pseudonymisation is a security measure the GDPR names explicitly (articles 25 and 32): it reduces what can leak to the AI provider, it does not remove your obligations.
- How much does Hexagone AI cost?
- €49 excl. VAT per user per month billed annually (€59 monthly) for Starter, €79 (€99 monthly) for Pro, and a custom-quoted Enterprise plan for on-premise deployment and SSO. One week's free trial, no credit card.
Try it on a real file.
One week free, no credit card. Nothing is uploaded, so you can run it on a real file without asking anyone's permission.
macOS Apple Silicon and Windows 10/11