How ONYRI Sanitize anonymizes a document inside your browser

ONYRI Sanitize reads, scans and masks your document inside your browser tab. The file is never uploaded. Once your document is anonymized, before the masked preview opens, our server receives counters and statistics without content: numbers of documents, pages and masked items, masks per category, the file type, whether it is a scan, the country and language recognised in the document, and your browser's language, plus a token of the file name, computed in your browser with a key that never leaves your device (never the name itself).

If you tick a “not masked right?” report, only the boxes you tick are sent too. Nothing else about the document. Here is the pipeline, a two-minute test to check it, and the limits.

What happens between the drop and the download?

Five steps, all on your device. Take a contract naming Jane Example, her email and her IBAN.

1. Open. You drop a PDF, a Word file (.docx) or an image. The browser opens it in the tab's memory. No upload starts.
2. Read. A PDF text layer is read directly, with word positions. A scan goes through on-device OCR. A Word file is laid out as A4 pages.
3. Detect. About 40 detectors scan the text, plus your custom rules and the terms typed under “Also mask”.
4. Review. Each detected item shows as a box on the preview. You untick what should stay visible and add what was missed.
5. Export. Each page is drawn as an image with the masks burned in. The images form a new PDF, or a PNG for a single image.

No server is needed. PDF pages are read with PDF.js, an open-source library from Mozilla and its contributors. OCR uses Tesseract.js, which wraps a WebAssembly port of the Tesseract engine. According to MDN, WebAssembly lets high-performance code run directly in the browser.

What stays on your device, and what does our server get?

The counters apply your plan: the Free plan allows 1 document per day, so the server must count it.

The statistics show where the product falls short. When a document fails, a technical diagnostic without file name or content is also sent. The file-name token lets the server avoid counting the same document twice. A “not masked right?” report is sent only if you tick it. None of this needs the content, so the server does not get it. One caution: a saved custom rule is stored with your account. For a term you want stored nowhere, use “Also mask”.

This is data minimisation in practice. GDPR Article 25 (EU) asks controllers for data protection by design, with measures such as pseudonymisation. The ICO (UK) says to consider it when choosing the products and services you use. A tool that never receives your file holds no copy to secure or delete.

How can you verify this yourself?

Do not take our word for it. Chrome's Network panel and Firefox's Network Monitor list the requests a page sends. Chrome's documentation notes that activity is logged only while DevTools is open, so open it first. The same test works on any online tool.

1. Open the Documents page. In Chrome, press Ctrl+Shift+J (Command+Option+J on a Mac) and click the Network tab. In Firefox, press Ctrl+Shift+E (Cmd+Opt+E on a Mac).
2. Drop a test file. Engine files, such as the OCR engine, may load from our site. Those are downloads.
3. In Chrome, click the Fetch/XHR filter. The Method column is hidden by default: right-click a column header and tick Method. According to MDN, POST is the method that sends data to the server.
4. Click Anonymize. One POST request appears before the masked preview opens. Its Payload tab shows your workspace identifier, the counters, the content-free statistics and the file-name token.
5. Open any other request. None carries your file, its name or its text.

Which formats and OCR languages does it handle?

The export is always flattened: a PDF or a PNG made of images. There is no text layer, so nothing sits hidden under a mask. The trade-off: the text can no longer be selected or searched, and a Word file comes back as a PDF.

Black marker draws opaque bars and cannot be undone. Token mode, on Pro, replaces each value with a consistent label: Jane Example becomes [NAME1] everywhere in the document. This is pseudonymization (GDPR Article 4(5)), not anonymization. Neither mode can restore the original, so keep your original file.

What does it detect, and what does it miss?

About 40 detectors work in 6 families: personal (names, emails, phones, postal addresses, official IDs, dates), financial (IBAN, BIC, card numbers checked with the Luhn algorithm, tax IDs, amounts with a currency), credentials (passwords written in a text, one-time codes), technical secrets (API keys, cloud tokens, JWT), corporate (SIREN, SIRET, VAT numbers) and internal URLs. Technical secrets and private SSH keys are Pro only. Detection is country-aware: FR, US, GB, BE, DE, AT, CH.

• Only text is detected. A signature, a photo or a handwritten note stays visible.
• No detector exists for medical terms in words or salaries as such; a company name is detected only with a legal form attached. Add them with a custom rule or under “Also mask”.
• OCR makes mistakes on blurry or skewed scans. A misread word cannot be matched.
• Detection is not exhaustive, even on clean text. An unusual name can slip through.

So the review step is part of the pipeline, not an option. Check the preview item by item before the download. Then read the export once more before you share it.

What does it cost?

As of October 2026, the Free plan covers 1 document per day and 5 pages per document, with Black marker, base detectors and 3 custom rules. Pro costs €9.90 per month or €99 per year ($11.90 or $119). It adds unlimited documents and pages, Token mode, technical-secret detectors, and unlimited custom rules and profiles. A one-time 7-day pass (€5.90) gives you all of Pro for a week, with no subscription.

Team costs €24.90 per user per month or €249 per user per year ($28.90 or $289), from 3 seats. Each seat gets Pro and priority email support. The shared workspace, invitations, roles and audit logs are coming soon; they are not available yet. Enterprise is no longer offered: since October 2026, a lifetime offer replaces it, at €198 for Pro or €498 for Team with 3 seats, paid once.

Frequently asked questions

Sources & references