Many privacy tools promise that they "can't see your data." The claim is easy to make and hard to verify. This article explains — honestly and in concrete terms — how piisafe.eu actually handles the data that flows through a website scan, what our no-storage architecture protects you from, and where its limits are.
What Actually Happens During a Scan
When you scan a website with piisafe.eu, this is the full data path:
- Your browser sends the scan request — target URL, selected entity types, and your anonym.legal API key — to the piisafe.eu server in Germany over TLS.
- Our server fetches the target pages, extracts their text, and sends it to the anonym.legal detection API (also operated from Germany) together with your API key.
- The findings come back to our server and are held in an in-memory session — a data structure in the running process, never a database and never a file.
- Your browser polls the session for progress and renders the findings.
- When your scan finishes (or you stop it), the session is automatically deleted from memory within 35 minutes — a service restart clears it immediately. After that, there is no copy anywhere.
Note what this is not: it is not client-side processing. The scan runs on our server — that is what lets it crawl hundreds of pages without exhausting your browser. The privacy property is different: we keep nothing.
No-Storage: The Design, Not a Policy
A retention policy says "we delete your data after N days" — and asks you to trust that the deletion happens. A no-storage design means the code has no write path for scan content in the first place:
- No database writes. Scan sessions live in a Node.js in-memory map. The scanner has no code that persists scan content.
- No logging of scan content. Server logs record IP, timestamp and path — never request bodies, findings, or API keys.
- No survival across restarts. If the service restarts, every active session is lost. Inconvenient? Occasionally. But it is also the proof: data that survived a restart would have to sit in storage somewhere.
- Your API key passes through, and that is all. The server forwards it to anonym.legal with each detection request and holds it in session memory for the duration of your scan. Only one place keeps it persistently: your own browser's localStorage.
What This Protects You From
1. Breaches of Stored Data
The most common privacy disaster is a breach of data at rest — a database dump, a leaked backup. piisafe.eu has no scan database and no scan backups, so this entire class of risk does not apply to your scan results.
2. Retention Creep
Services that store data tend to keep it longer than promised, use it for new purposes, or surrender it under legal compulsion. Nobody can repurpose, subpoena or quietly retain data that never reached storage.
3. Insider Access After the Fact
Within 35 minutes of your scan ending, there is no stored copy for anyone — including us — to look up. Nobody can browse what no longer exists.
The Honest Limits
No hosted scanner can offer literal zero knowledge of the content it scans — the detection engine has to read the text to find PII in it. During an active scan, your target pages' text and your API key transit our server's memory and the anonym.legal API. What we minimize is not the processing — that is the product — but the window: data exists on our side only while your scan runs plus a sweep margin of at most 35 minutes, then the sweep deletes it automatically.
You should also know that our server fetches the websites you scan, so the target site sees requests from piisafe.eu's IP address, not yours.
Where Real Client-Side Encryption Is Used
One part of piisafe.eu does use genuine client-side cryptography: optional premium accounts. If you create one and store OAuth credentials for cloud integrations, your browser encrypts those secrets locally with AES-GCM, using a key that Argon2id derives from your password. The server stores only ciphertext it cannot decrypt. For that specific data — credentials, not scan results — the server genuinely cannot read what it stores.
Why This Matters for GDPR
The GDPR asks for data minimization (Art. 5(1)(c)) and storage limitation (Art. 5(1)(e)). An audit tool that retained copies of the personal data it finds would itself become a data-protection problem — a second copy of every exposed record, sitting in a vendor's database. A no-storage scanner avoids creating that second copy at all: the only lasting record of your scan is the export you choose to download.
The Trade-offs
- No scan history. We cannot show you last month's results, because we do not have them. Export what you need.
- Sessions are ephemeral. A service restart ends active scans. Long scans of very large sites carry that risk.
- The design narrows trust; it does not eliminate it. You still trust us — and anonym.legal — for the duration of processing. The design shrinks the trust window to minutes instead of forever, and the deployed behaviour (sessions do not survive restarts; you must download exports during the session) matches that design.
The Numbers Behind the Design
The numbers are small and fixed. That is the point. One scan covers at most 1,000 pages. Each call to the detection API takes at most 50,000 characters. The scanner splits longer pages at word boundaries first. Rate limits apply per IP address: 30 API requests a minute, 20 new scans an hour, 120 status polls a minute. A sweep runs every five minutes. It deletes any session that finished more than 30 minutes ago. Running scans it leaves alone.
The legal frame is the GDPR — Regulation (EU) 2016/679, in force across the EU since 25 May 2018. Article 5(1)(c) asks for data minimisation. Article 5(1)(e) asks for storage limitation. A system that keeps nothing takes the shortest route to both. Article 32 asks for appropriate technical and organisational measures. Article 44 restricts transfers outside the EU, so the location of processing matters. The Court of Justice made that concrete in 2020, when it invalidated the EU-US Privacy Shield in Case C-311/18. Getting this wrong is costly. Article 83(5) sets the upper fine band at €20 million or 4% of worldwide annual turnover. Article 83(4) sets the lower band at €10 million or 2%. An AI system in the same pipeline brings the EU AI Act with it — Regulation (EU) 2024/1689. Article 99(3) there reaches €35 million or 7% of worldwide annual turnover, and Article 99(4) sets €15 million or 3%.
Key Takeaways
- piisafe.eu scans server-side but stores nothing: scan data lives in memory only, for the duration of your session.
- No database writes, no content logging, no survival across restarts — a design property, not a policy promise.
- The server forwards your API key per request; only your own browser keeps a copy.
- Genuine client-side encryption protects premium account credentials; for scan content, the honest claim is no retention, not zero knowledge.
- For compliance audits, no-retention scanning avoids creating a second copy of the very data you are trying to protect.
Bottom line: If you are scanning your website for sensitive data, the question to ask any vendor is not "can you see my data?" — every hosted scanner processes it — but "what do you keep?" piisafe.eu's answer is: nothing. Within 35 minutes of the scan ending the sweep removes the data from memory, and the only copy left is the export in your hands.