aitrainingdatabroker/business-pii-detector

Business PII Detector

Finds personal details in everyday business text: support tickets, emails, chat logs, CRM notes, order notes and handover notes. It marks names, client companies, emails, phone numbers, street addresses, dates, amounts, order and ID numbers, card numbers, IP addresses, URLs and quasi-identifiers (details such as a job title plus a small town that point to one person together).

Every name, number and address it was trained on is made up. Nothing comes from a real person, patient, customer or business.

Try it in your browser: Business PII Detector demo (the model runs locally in the page, so the text is not sent anywhere).

Why it exists

De-identification means removing who and where from a record while keeping what happened. Before a company licenses its records to an AI lab, every direct identifier, quasi-identifier and business identifier has to be found, including the ones hiding in free text, attachments and signatures. This model is a first pass that finds candidates for a person to review and replace.

Use it

from transformers import pipeline

tagger = pipeline("token-classification", model="aitrainingdatabroker/business-pii-detector", aggregation_strategy="simple")
for hit in tagger("Hi Omar, thanks for the quote for Meridian Roofing. Call me on (696) 555-0199 or reply to nadia.pruitt@example.com."):
    print(hit["entity_group"], hit["word"], round(hit["score"], 3))

How it was trained

Fine-tuned from distilroberta-base for 8 epochs on one RTX 3070. Training data: synthetic-deidentification-pairs, pii-span-benchmark-hard (1500 rows), all invented. The scripts that built the data, trained the model and scored it are in source/; the full scores are in scores.json.

Test scores

Exact entity match on 300 held-out rows: precision 1.0, recall 1.0, F1 1.0.

Type	Precision	Recall	F1	Count
ADDRESS	1.0	1.0	1.0	48
CARD_NUMBER	1.0	1.0	1.0	30
DATE	1.0	1.0	1.0	123
EMAIL	1.0	1.0	1.0	113
ID_NUMBER	1.0	1.0	1.0	49
IP_ADDRESS	1.0	1.0	1.0	62
MONEY	1.0	1.0	1.0	48
ORG	1.0	1.0	1.0	113
PERSON	1.0	1.0	1.0	317
PHONE	1.0	1.0	1.0	96
QUASI_IDENTIFIER	1.0	1.0	1.0	61
URL	1.0	1.0	1.0	31

Cross-test on 220 sentences from a different generator (the HIPAA PHI Detector's test set, counting only the types both share: person, phone, email, date, IP address, URL): precision 0.791, recall 0.987, F1 0.878.

Limits

• Trained only on invented English text with US-style formats. Real business text is messier; test it on a sample of your own data before relying on it.
• Its own test set comes from the same generators as its training data, so it scores perfectly there. The cross-test below, on sentences written another way, is the better guide.
• It finds details; it does not decide what to replace them with. Consistent placeholders (Customer 1, Client 1), generalised dates and regions, and a re-identification check are separate steps.
• This model is not legal advice and not a certification. Whether a de-identification method meets HIPAA Safe Harbor or Expert Determination, CCPA and CPRA, GDPR or UK GDPR anonymisation, PIPEDA, Quebec Law 25 or another rule is a question for your counsel and, where a rule requires one, a qualified expert. A person should review its output before any data is shared.

Read more

• How company data is de-identified for HIPAA, CCPA and GDPR
• Why pseudonymized data is not anonymous

License and credit

Apache 2.0. Please credit AI Training Data Broker and link to https://aitrainingdatabroker.com/ when you share or build on it.

About

AI Training Data Broker is a broker and technical advisor for companies that sell or license their data to AI labs. It guides the technical side, including export, format, de-identification and compliance, and publishes free checklists on de-identifying data and keeping it within the privacy rules that apply.