Skip to content
Rota Nacional

Privacy engineering · 2026-09-19

Explicit methods.
Verifiable evidence.

Brazilian rules, treatment policies and encrypted auditing in operation. Expanded neural detection under evaluation, with metrics, synthetic data and open references.

01 / Operational foundation

A policy applied before the next destination.

  1. DetectPatterns, textual context and check digits.
  2. Apply the policyPlaceholders, removal or blocking within authorized policies.
  3. Deliver and auditSanitized output, metadata and an encrypted archive.

Deterministic rules

The engine rules-v1 traverses text values in JSON objects and arrays. Regular expressions identify email, phone, addresses and contextual identifiers. Object keys and numeric values are not examined as text.

CPF and numeric CNPJ undergo modulo-11 checks, comparison of both check digits and rejection of repeated sequences. This validates structure without querying a registry or proving ownership. This detector does not cover alphanumeric CNPJ.

Health card numbers, physician registrations, medical records, insurance identifiers and clinical dates use patterns and contextual words; they do not receive the same mathematical validation as CPF/CNPJ. Names in the deterministic engine depend on a configured list, without general person recognition.

Policies with defined effects

placeholder replaces findings with placeholders and reuses the placeholder for a normalized value within the same category and request. The map is ephemeral, without a persistent restoration table.

redact replaces the passage with [REMOVIDO]. In /v1/privacy/clean, block stops sanitization with HTTP 422 when personal data is found, without returning the blocked text.

In the inference API, monitor observes and records findings but preserves text. The sanitization endpoint does not accept this policy. Organization settings restrict permitted choices; instructions in the text do not change authorization.

How do we calculate check digits?

After removing punctuation, CPF requires 11 digits and numeric CNPJ requires 14. For each check digit, we compute the weighted sum, its remainder modulo 11 and the expected digit. The second calculation includes the first computed digit.

CPF DV1:  [10, 9, 8, 7, 6, 5, 4, 3, 2]
CPF DV2:  [11, 10, 9, 8, 7, 6, 5, 4, 3, 2]
CNPJ DV1: [5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2]
CNPJ DV2: [6, 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2]

r = sum(digit[i] * weight[i]) % 11
dv = r < 2 ? 0 : 11 - r

A sequence rejected by a checksum may still match another pattern, such as a phone number. Classification is per category, without a guarantee that every invalid number will remain unchanged.

Stack and data boundaries

TypeScript gateway on Cloudflare Workers; static pages; D1 for metadata and R2 for the audit archive. The media flow extracts or transcribes content before applying the text privacy layer. OCR or transcription errors can reduce coverage.

Auditing uses AES-256-GCM, a random 96-bit IV and authenticated associated data. When enabled, it may retain original and sanitized content in encrypted form with restricted access and expiration. Operational logs must not contain raw text. Encryption protects the archive; it does not fix detection errors.

NIST SP 800-38D — the GCM specification

02 / Expanded detection under evaluation

From tokens to exact text positions.

The candidate rn-privacy-0.2.0 is not serving customer traffic. Home-page examples are precomputed results. Medical shadow evaluation, when enabled, is a separate flow and does not replace the rules producing the output.

Token classification

A MiniLM-based detector and a DistilBERT-based multilingual person recognizer classify tokens in context. We use pretrained weights: RN did not train these base models or tune the weights to the test names.

The adaptation starts from Rampart 0.1.3. The general model has six layers and dimension 384, in Q4; the specialist has six layers and dimension 768, in INT8. It runs on CPU with ONNX Runtime 1.21.0 and local weights pinned by revision and SHA-256.

The window budget is 500 tokens, with a target overlap of 64 adjusted to segment boundaries. Entry thresholds are 0.40 for the general detector and 0.50 for the specialist. Classifier scores are not calibrated probabilities of anonymization.

Unicode, alignment and merging

Premasking isolates deterministic findings. Grapheme projection applies NFKC and retains a map to original UTF-16 positions. Emoji, decomposed accents, typographic apostrophes and invisible controls must not silently shift a name.

WordPiece is aligned to the text; a mismatch raises an error. BIO aggregation ends an entity on O. Person fragments are completed only within the selected word. Overlapping spans are merged without losing covered characters.

A location with a score ≥0.90 may reject a fully contained person false positive if no independent person evidence exists. Partial overlaps remain protected. This arbitration also requires validation in new domains.

What is the contract and how are failures handled?

The experimental handler accepts up to 16 texts and 8,192 UTF-8 bytes in total. It returns only positions, categories and scores, without detected values. Invalid offsets, initialization failures or expiration prevent a successful response.

{"version":1,"texts":["..."]}
→ {"version":1,"engine":"rn-privacy-0.2.0","results":[
    {"index":0,"spans":[{"start":0,"end":5,"label":"GIVEN_NAME","score":0.99}]}
  ]}

start/end: UTF-16; [start, end)
bytes: UTF-8; maximum total = 8192

The consumer must validate the complete response and block forwarding if a required detector fails. This integration is not yet active. Classifiers are cached; text, entities and coordinate maps are not cached across requests.

Normalization and segmentation follow the concepts in Unicode UAX #15 and UAX #29. Alignment, contract and policy adaptations are RN engineering; models and runtimes retain their own authorship and licenses.

03 / Published measurements · 2026-09-19

Results with denominators, methods and limitations.

Both datasets measure the isolated candidate, without the API's Brazilian rules composition. They contain 46 synthetic Portuguese texts. The additional dataset also helped reveal alignment errors; this is not a blinded or independent evaluation.

Detection measured by alphanumeric characters and diacritical marks
DatasetTP / FP / FNRecallPrecisionComplete names
Original · 16 texts 263 / 9 / 6 97.8% 96.7% 13/13
Additional · 30 texts 431 / 22 / 1 99.8% 95.1% 21/22

What each metric measures

TP are correctly covered sensitive positions; FP are unannotated positions that were marked; FN are sensitive positions left uncovered. We count letters, numbers and diacritical marks by offset, excluding spaces and punctuation.

recall    = TP / (TP + FN)
precision = TP / (TP + FP)

“Complete name” requires coverage of every counted character in the entity. This is not span F1, classification accuracy or a probability of preventing reidentification. These figures do not estimate production performance.

Errors that remain visible

In the original dataset, six characters of a CNPJ were left uncovered by the isolated candidate. The Brazilian rules remain required in the combined pipeline. In the additional dataset, the conjunction “e” in a surname was missed, giving the strict result of 21/22 complete names.

False positives also occurred in public words. The first version covered only 5/13 original names; Unicode, boundary and recognition fixes improved this to 13/13. This improvement does not imply universal coverage.

Which criteria prevent premature promotion?

Character recall ≥95%, precision ≥90%, zero execution failures and complete coverage of the 13 original names. A high average cannot compensate for a regression. Packaging verifies weight hashes and requires passing reports bound to the evaluation files.

A separate medical regression uses eight texts and 31 values: no complete value remained after rules and candidate processing. This presence check does not prove removal of every character. The clinical negative case remained unchanged.

Execution was verified on Linux x86-64 with Node.js 22, no network access, one CPU and 1 GiB. This does not measure AWS cold starts, network latency, concurrent throughput or an SLA. Promotion requires representative validation, a pilot and observation.

Data and calculations to inspect.

The JSON contains the 46 fictional texts, annotations, predicted spans and provenance hashes. The script uses only Node.js to recalculate metrics from these predictions; it does not run the models.

Download corpus and predictions Download the scoring script 
node score-privacy-benchmark.mjs privacy-benchmark.json

04 / Foundations and attribution

Papers, standards and components.

These references explain the techniques used. Authors' results on other datasets are not RN results, product certification or researcher endorsement.

  1. BERT · Devlin et al., 2018

    Bidirectional contextual representations, WordPiece and token classification. A conceptual foundation of the model family, not a third detector executed by RN.

  2. MiniLM · Wang et al., 2020

    Attention distillation for smaller models. It underpins the general detector's architecture; its published results do not measure PII detection in this implementation.

  3. DistilBERT · Sanh et al., 2019

    Distillation of BERT models. The multilingual NER variant used in this evaluation complements person-name detection; RN did not train it.

  4. Rampart · National Design Studio

    Component adapted for the evaluation, with a general model and heuristics. RN adds position corrections, a bounded contract, classifier combination and its own validation gates. CC BY 4.0 attribution is preserved.

  5. ONNX Runtime · Quantization

    Execution and quantization reference. Q4 and INT8 reduce weight size; accuracy and actual memory usage must be measured for each artifact.

  6. Unicode UAX #15 · Unicode UAX #29

    Text normalization and grapheme boundaries, used to map normalized text back to original positions.

  7. NIST SP 800-38D · GCM

    Authenticated encryption with associated data, the foundation of the encrypted audit format.

The multilingual NER specialist is by Davlan / David Ifeoluwa Adelani, with ONNX conversion by Xenova / Joshua Lochner and an author-declared AFL-3.0 license. ONNX Runtime uses the MIT license. Selecting and adapting these components does not transfer their authorship to RN.

From evidence to your use case.

Compare the examples, review the API contract and define a pilot with representative data. Suitability depends on the domain, text quality and chosen policy.

View the ten examples Explore the API