Secure AI Translation for Confidential Documents (Business Guide)

Yes, you can translate documents with AI. But be careful with confidential ones. When you upload a contract, an HR file or a medical record to a consumer AI translator, you send its full contents to a third party. Party names, terms, financial figures, personal data — all of it. That third party may retain the text, let staff review it, or reuse it to train models. The whole point of the document was confidentiality. Once uploaded, you lose control of it. The safe method is simple: anonymise the identifiers before translating, then restore them locally.

What a confidential document exposes

A confidential document is dense with sensitive data. That is what makes it confidential. A single contract can hold the names of both parties. Their addresses. Payment terms and amounts. Bank details. Sometimes personal data about employees or clients. An HR file adds salaries, evaluations and health notes. A legal filing adds case details and identities.

A consumer AI translator reads the whole file to translate it. It does not skip the sensitive parts. It processes every line. So every identifier in the document travels to the provider's servers. You are trusting a third party with the exact information the document was meant to protect.

The documented lesson: Translate.com, 2017

This is not theory. In September 2017, Norway's public broadcaster NRK revealed a stark example. Text run through the free web service Translate.com had been indexed by search engines. It was findable through a plain Google search. Employees of the energy company Statoil found their own submitted text online.

The exposed material was not trivial. According to Slator, it included full names, email addresses and phone numbers. It also held highly sensitive business content. A termination letter. A bank's staff performance review. Late-payment notices. A physician's tax correspondence with a pharmaceutical firm.

The cause was structural, not a hack. Text submitted to the free translator was routed to a community of human reviewers. It was stored in a way that search engines could crawl. That design turned private business content into public search results.

GDPR: the data stays personal through translation

European law is clear on this point. Under the GDPR (General Data Protection Regulation, Regulation (EU) 2016/679), any personal data in a document stays personal data when it is translated. Translation is itself a form of processing under the GDPR. The protections and obligations follow the data through the whole workflow.

The responsibility does not move to the tool. In a translation workflow, the business that owns the document is typically the data controller. The translation provider is a processor acting on its instructions. The GDPR's integrity-and-confidentiality principle (Article 5(1)(f)) requires appropriate security. The ICO (Information Commissioner's Office, the UK regulator) stresses that the controller stays accountable for it.

The fix: two safe paths

You do not have to give up AI translation. You have two safe options. You can combine them.

• Anonymise first: replace names, parties, account numbers and amounts with tokens before translating.
• Restore locally: swap the real values back after the AI returns the translated text.
• Or go contractual: use an enterprise service with written no-retention and no-training terms.
• Always verify those terms in writing before sending regulated documents.

The anonymise-then-restore path is the strongest. The confidential values never reach the third party at all. The AI translates the language and the structure. It never sees the real names or numbers. You restore them on your own machine.

1. 1Spot the identifiers: party names, addresses, account numbers, financial figures, personal data.
2. 2Replace each one with a reversible token, in your browser.
3. 3Send only the anonymised text to the AI translator.
4. 4Restore the real values in the translated output, locally.

That is exactly what ONYRI Sanitize does. The engine detects sensitive data — party names, addresses, account numbers, amounts — and replaces it with reversible tokens before anything is sent. Detection and the mapping stay in your browser. Only anonymised text reaches the AI translator. The model sees tokens, never your confidential values. You get a clean translation, without handing your document to a third party you cannot control.