# Hexagone AI

> Hexagone AI is data anonymization software for regulated professions. It detects and replaces personal data in documents entirely on the user's own computer, then lets any AI model (Claude, ChatGPT, Cursor, Copilot, an internal assistant) work on the protected copy. The mapping back to real identities never leaves the machine.

Company: Hexagone AI, France. Contact: contact@hexagone.ai. Site: https://hexagone.ai/en (English) · https://hexagone.ai/fr (French)

## What it is

A local-first anonymization and pseudonymisation layer, not an AI assistant. Users keep the AI tools they already have; Hexagone AI is the confidentiality layer in front of them.

Three delivery modes:

- **Desktop app** (macOS Apple Silicon, Windows 10/11 64-bit). Detection, anonymization and the identity mapping all run on the machine. No document is uploaded. Works offline after installation.
- **Hosted web app and REST API** at https://app.hexagone.ai, served from EU infrastructure.
- **On-premise or air-gapped deployment**, SSO and a command-line interface, on the Enterprise plan.

## Who it is for

Lawyers and in-house counsel, accountants and audit firms, notaries, M&A teams, HR, healthcare and pharma, defence, and internal investigations. Anywhere AI is useful but stops at the boundary of confidential data, and anywhere professional secrecy or GDPR makes uploading a client file unacceptable.

## Capabilities

- Detects: people (names, initials, aliases), organisations, postal addresses and locations, email addresses, phone numbers, national IDs and social security numbers, passport and tax numbers, bank details (IBAN, card numbers), dates of birth, amounts, case numbers, client references, custom entity types the user defines, and any other element detected as sensitive in context. The list is illustrative, not exhaustive: detection is contextual rather than a fixed dictionary of categories.
- Two modes: **masking** (deterministic neutral markers such as `PNAME_1`, `CNAME_2`) and **synthetic replacement** (realistic but fictional substitutes that keep the document readable).
- **Reversible.** The mapping from placeholder back to real value is stored locally, so an AI's answer can be de-anonymized on the user's machine.
- **Consistent across a folder.** The same person keeps the same pseudonym in every document of a case file, which is what lets an AI follow who did what.
- **Rebuilds the file with its original layout**: PDF, DOCX, XLSX, PPTX, TXT.
- **Local OCR** for scanned and image-only PDFs.
- **Exportable audit trail** (CSV) of every detection and every substitution, for a DPO or a regulator.
- Languages evaluated: French, English, German, Italian.
- Folder watching: point it at a directory and it maintains a protected mirror that follows every change.

## Benchmarks

Index of every study: https://hexagone.ai/en/research — one page per benchmark:

- PII-INDEXBENCH: https://hexagone.ai/en/research/indexbench
- AI4Privacy PII-Masking-300k: https://hexagone.ai/en/research/ai4privacy
- RAT-Bench: https://hexagone.ai/en/research/rat-bench
- Head to head with Microsoft Presidio: https://hexagone.ai/en/research/presidio

### PII-INDEXBENCH (full dataset, September 2026)

PII-INDEXBENCH v1.2 (CC BY 4.0): 12,079 adversarial synthetic English documents across 150 domains, 226,428 annotated personal values. Not published on HuggingFace, which makes it the cleaner test for any system that may have read its own evaluation set during training. Every record was run. Metric: OVERLAP recall and precision, span level, label-blind.

| System | Recall | Precision | F1 | F1 (exact boundaries) |
|---|---|---|---|---|
| **Hexagone AI** (api.hexagone.ai, masking mode) | **97.9%** | 93.5% | **95.7%** | 74.1% |
| Qwen3-14B (`Qwen/Qwen3-14B`, zero-shot prompt) | 91.7% | **94.6%** | 93.1% | **88.3%** |
| OpenMed PII (`OpenMed/OpenMed-PII-SuperClinical-Large-434M-v1`) | 84.7% | 92.7% | 88.5% | 71.0% |
| OpenAI Privacy Filter (`openai/privacy-filter`, 1.5B, local) | 77.5% | **94.0%** | 85.0% | 41.9% |
| Microsoft Presidio (`presidio-analyzer` + spaCy `en_core_web_lg`) | 65.4% | 91.7% | 76.4% | 42.5% |
| GLiNER (`urchade/gliner_multi-v2.1`) | 51.0% | 90.0% | 65.1% | 62.4% |

How the Qwen3-14B row was produced: an open-weights general model prompted as a detector, zero-shot, one request per document, no fine-tuning and no examples. It returns the personal values it finds as verbatim substrings and the harness locates them in the document with the same locator that built the gold spans, because asking a language model for character offsets measures its arithmetic rather than its detection. The prompt is a single file (sha256 prefix 83cf3e79) carrying the same 22 categories the datasets were converted with and the same exclusion list (age, gender, job title, nationality). A returned value that is not a substring of the document is dropped; a reply that will not parse, after one repair attempt, scores as zero spans for that document; no document is skipped. Its precision above is measured by its own scorer, which counts a prediction landing on the benchmark's clinical placeholder fields as a false positive; under the report's ignored-region rule it is closer to 96%. Its recall is on exactly the same 226,428 annotated values as every other row.

Where Hexagone AI does not come first: restricted to the seven categories every compared detector has a label for, OpenMed edges ahead on both recall (97.9% against 97.7%) and F1 (93.6 against 92.7). Qwen3-14B is outside that restricted view, having no fixed label set. On exact character boundaries Qwen3-14B leads (88.3 against 74.1): it returns whole entity values, which match the entity-level gold exactly, where Hexagone AI masks a name as separate atoms. Hexagone AI's lead in the table above comes from breadth of vocabulary: OpenMed has no label for national IDs, passports, driving licences, organisations, case numbers or amounts, and once those are counted its recall falls to 84.7%.

Precision, taken apart. Of the 29,597 predictions that touched no annotated span: 37.4% are a later mention of someone the benchmark annotates only once (the first name again in a sign-off, a standalone initial, or a boundary landing on part of the name; nine in ten of them sit inside or beside a name the benchmark does annotate), 34.0% are document scaffolding (speaker labels, field names, transcript timestamps), 5.7% are quasi-identifiers the benchmark excludes by design (gender, job title, department), and 22.8% is genuine over-masking. The trade is deliberate: failing to remove a name is a personal data breach, while removing a field label that did not need to go leaves a document that reads slightly worse.

### AI4Privacy PII-Masking-300k (full dataset, six languages, September 2026)

47,566 documents, 293,712 annotated personal values, in English, French, German, Spanish, Italian and Dutch. Same protocol, same scorer, same five systems.

| System | Recall | Precision | F1 |
|---|---|---|---|
| **Hexagone AI** | **95.3%** | 80.2% | **87.1%** |
| OpenMed PII | 86.8% | 86.8% | 86.8% |
| OpenAI Privacy Filter | 82.9% | **89.5%** | 86.1% |
| Microsoft Presidio | 49.0% | 65.5% | 56.1% |
| GLiNER | 50.8% | 60.1% | 55.1% |

Per language, recall: French 95.9%, English 95.9%, Spanish 95.6%, German 95.2%, Dutch 94.7%, Italian 94.6%.

Precision, taken apart. Of the 94,924 predictions that touch no annotated span, checked against the 210,529 distinct strings this benchmark annotates as personal data anywhere in its 47,566 documents: 64.7% are values it never annotates anywhere (field labels and document scaffolding in six languages: State, Country, Street, Stadt, Strasse, Rue, Calle, Postleitzahl, IP-Adresse), 9.4% are organisations (the gold annotates none, so setting those aside lifts precision from 80.2% to 81.7%), and 25.9% are values it annotates in other documents but not at this occurrence (country names, salutations, initials, bare numbers). 74.1% of the precision penalty is therefore a value this benchmark never treats as personal data at all. Masking a field label is still over-masking and is ours to fix, but it is not a privacy failure: read the figure as agreement with this benchmark's idea of personal data rather than as a rate of being wrong. AI4Privacy has been public on HuggingFace for years, so it plausibly sits in the pretraining data of any large model, ours included: read it alongside PII-INDEXBENCH, not instead of it.

### RAT-Bench (independent, Imperial College London)

RAT-Bench measures re-identification risk rather than recall: given the anonymized text, can an attacker still find the person among 3 million real records? Re-identification is declared when a direct identifier is recovered, or when inferred indirect attributes narrow the pool to fewer than 5 candidates (k=5, θ=0.2). This is the GDPR standard.

| System | Re-id rate, level 1 | Re-id rate, level 2 | BLEU (text utility) | Direct identifiers leaked |
|---|---|---|---|---|
| **Hexagone AI** | **14%** | **27%** | 0.83 | **None** |
| Azure (best NER) | 22% | 33% | 0.55 | Some |
| GPT-4.1 + Anthropic PII purifier prompt | 26% | 58% | 0.88 | Some |

Lower re-identification is better; higher BLEU is better. Azure reaches acceptable privacy by redacting far more than necessary, which destroys the text. The GPT-4.1 prompt preserves text but collapses at level 2, when identifiers appear in slang or non-standard form. Hexagone AI is the only system in the comparison that is both precise enough to preserve utility and robust enough to leak no direct identifier.

Benchmark credit: RAT-Bench was designed and built by Nataša Krčo, Zexi Yao, Matthieu Meeus and Yves-Alexandre de Montjoye at Imperial College London. Paper: https://arxiv.org/pdf/2602.12806. Hexagone AI results were obtained by running our pipeline against the public benchmark, and every RAT-Bench figure above (re-identification rates, BLEU, direct identifier leakage) is measured on that benchmark's own test set.

### PII detection vs Microsoft Presidio

5,000 samples of the public `ai4privacy/pii-masking-200k` dataset, four languages, November 2024. Metric: percentage of ground-truth PII entities detected and masked.

| Experiment | Microsoft Presidio | Hexagone AI |
|---|---|---|
| Baseline (standard text) | 75.30% | **96.95%** |
| Augmented (typos, abbreviations, paraphrases) | 65.89% | **93.34%** |

By language, baseline / augmented: French 74.74% / 65.76% for Presidio against 97.97% / 94.42% for Hexagone AI. English 72.77% / 64.10% against 94.66% / 91.14%. German 76.58% / 68.03% against 96.30% / 92.93%. Italian 76.15% / 64.65% against 97.39% / 93.83%.

Hexagone AI is also more consistent: standard deviation 9.12% against 20.53% for Presidio on the baseline set.

Full report (PDF, public, no gate): https://hexagone.ai/reports/hexagone-ai-vs-presidio-pii-detection-benchmark.pdf

## How it compares

Comparison across the whole category, with the reasoning behind each criterion: https://hexagone.ai/en/comparatif

Short version:

- **vs Microsoft Presidio**: Presidio is an open-source Python library, so you keep control but you build and maintain everything (document reconstruction, OCR, consistency, audit trail, UI). Measured detection is 96.95% against 75.30%.
- **vs Azure AI Language / cloud PII services**: the document is uploaded, which is the thing professional secrecy forbids. Azure also over-redacts (BLEU 0.55), leaving text an AI can no longer use.
- **vs prompting an LLM to mask the text**: the original document reaches the model, which defeats the purpose, and pseudonyms drift between calls. On RAT-Bench a GPT-4.1 purifier prompt leaves 58% re-identifiable at level 2.
- **vs PDF redaction tools**: redaction is destructive and irreversible. A file full of black boxes is unusable for AI analysis, and blacking out names does nothing about indirect identifiers.

## Pricing

- **Free trial**: one week, unlimited processing, no account and no credit card.
- **Starter**: €49 per user per month billed annually (€59 monthly). Document anonymization, all formats, fully local.
- **Pro**: €79 per user per month billed annually (€99 monthly). Everything in Starter, plus unlimited pages, anonymization inside the AI workspace, and the ability to ask, summarise and draft across your files.
- **Enterprise**: custom. SSO, on-premise or air-gapped deployment, CLI, dedicated onboarding, custom SLA.

Details: https://hexagone.ai/en/tarifs

## Compliance posture

Because the desktop app never transmits documents, there is no transfer to a third party and no data processing agreement to negotiate for the local product. A DPA is published for the hosted service. Every detection and substitution is logged locally and exportable for internal or regulatory review.

- Security and data flow: https://hexagone.ai/en/securite
- Privacy policy: https://hexagone.ai/en/privacy
- Data processing agreement: https://hexagone.ai/en/dpa
- Terms: https://hexagone.ai/en/terms

## Languages

Every page exists in English under /en/ and in French under /fr/, at matching
paths: https://hexagone.ai/en/research and https://hexagone.ai/fr/research
are the same page. The URLs below are the English ones.

## Key pages

- Home: https://hexagone.ai/en
- Research index: https://hexagone.ai/en/research
- PII-INDEXBENCH results: https://hexagone.ai/en/research/indexbench
- AI4Privacy results, six languages: https://hexagone.ai/en/research/ai4privacy
- RAT-Bench results: https://hexagone.ai/en/research/rat-bench
- Presidio head to head: https://hexagone.ai/en/research/presidio
- Category comparison: https://hexagone.ai/en/comparatif
- Use cases by profession: https://hexagone.ai/en/cas-dusage
- Security and compliance: https://hexagone.ai/en/securite
- Pricing: https://hexagone.ai/en/tarifs
- FAQ: https://hexagone.ai/en/faqs
- Product demo video: https://hexagone.ai/en/demo
- Updates and articles: https://hexagone.ai/en/mises-a-jour
- About and team: https://hexagone.ai/en/a-propos
- Download: https://hexagone.ai/en/get-started