Frequently Asked Questions

piisafe.eu is a free website PII scanner that detects 58 types of exposed personal information on websites. It uses exact pattern recognisers plus an NLP recogniser to find sensitive data like emails, phone numbers, IBANs, credit cards, and government IDs across 48 languages with a no-storage architecture—scan results are held in memory only during your session and are never stored.

Privacy officers, developers, compliance teams, and security auditors use piisafe.eu to find exposed PII before regulators do. It's ideal for pre-launch audits, GDPR/HIPAA verification, vendor assessment, and incident response.

The scanner itself is free and requires no account. PII detection runs through the anonym.legal API, so you need an anonym.legal API key (entry tier from €3/month). You can start 20 scans per hour per IP and scan up to 1,000 pages per scan. The Dead Link Scanner works without any API key.

anonym.legal — 58 entity types with MCP Server integration, 48 languages, built by curta.solutions in Germany.

piisafe.eu is built by curta.solutions, a German company with 27+ years of experience in data protection and PII handling. The product suite includes anonym.legal, anonym.plus, and anonymize.solutions.

No-storage means scan data is never persisted. The piisafe.eu server fetches the pages, sends their text to the anonym.legal detection API with your API key, and keeps the findings in memory only while your session is active. Nothing is written to a database, disk or log, and finished sessions are automatically deleted within 35 minutes.

No. piisafe.eu uses in-memory processing only. Scan data doesn't persist on disk or in databases, and finished sessions are automatically deleted from memory within 35 minutes. There is no stored scan data to access or sell.

All processing occurs on German servers (Hetzner infrastructure, ISO 27001-certified data centres). No third-country data transfers. Your website content is fetched, analyzed in memory, and the findings are polled by your browser — nothing is stored.

Yes. piisafe.eu is fully GDPR Article 44 compliant with no third-country data transfers. No tracking, no cookies (except essential), no analytics. Zero personal data collection. Privacy policy available at /legal/privacy.html.

No. Scan results live in server memory only for the duration of your session and are never stored. There is no saved copy for anyone to read afterwards.

It is deleted automatically. Scan results exist only in server memory and are swept within 35 minutes of the scan ending (a restart clears them immediately). Export to HTML/JSON/CSV if you need to save results locally.

With the anonym.legal API: 58 entity types including SSN, IBAN, credit cards, medical records, passport IDs and driver licenses, covering 48 languages.

Hybrid approach: exact pattern recognisers (score 1.0, fully reproducible) combined with optional ML/NLP for contextual detection. Built on Microsoft Presidio open-source framework with custom patterns for regional IDs.

Deterministic = same input always produces same output. No randomness. Critical for compliance because auditors need reproducible results. You can prove findings and re-scan to verify. ML-only tools produce variable outputs.

Deterministic regex patterns minimize false positives. For example, credit card detection checks Luhn algorithm validity—not just pattern matching. You can adjust confidence threshold to balance precision vs. recall.

48 languages including English, German, French, Spanish, Italian, Portuguese, Dutch, Polish, Russian, Arabic, Hebrew, Chinese, Japanese, Korean, and 34 more. RTL languages (Arabic, Hebrew, Persian, Urdu) fully supported.

Image-embedded text (OCR requires premium API), heavily obfuscated data, password-protected pages, database content (not public web), and context-dependent PII without clear patterns. Deterministic detection prioritizes precision over recall.

Enter a URL, scanner discovers pages via sitemap.xml or crawling, you select pages to scan, content is analyzed against the 58 selectable entity types, results stream in real-time showing entity type, location, and confidence score.

API limit is 50,000 characters per request. Larger pages are automatically chunked at word boundaries, analyzed separately, then aggregated with position offsets adjusted. This ensures 100% content analysis.

HTML (styled, printable report), JSON (structured data for developers), and CSV (spreadsheet import). All formats include entity type, detected value, confidence score, page URL, and position in source.

No. piisafe.eu scans publicly accessible pages only. For authenticated content, use the text input mode (copy/paste HTML) or integrate the anonym.legal API directly into your application.

German servers only (Hetzner infrastructure, ISO 27001-certified data centres). No US cloud providers. All processing within EU borders. GDPR Article 44 compliant with no third-country transfers.

Built-in presets for GDPR (EU), HIPAA (US healthcare), PCI-DSS (payment cards), CCPA (California), plus 7 regional, 7 industry and 5 quick-start presets - 24 in total (the compliance group holds 5, counting GDPR Standard and GDPR Full separately). Each preset pre-selects relevant entity types. Customizable for specific requirements.

Yes. Reproducible detection + exportable reports (HTML, JSON, CSV) = audit-ready documentation. Results are reproducible—re-scan anytime to verify. Suitable for internal audits and regulator submission.

Grade A = minimal PII exposure (low risk). Grade F = severe exposure (high regulatory risk). Grades factor in finding count, severity (email vs. credit card), and entity diversity. Prioritize remediation by grade.

Yes. Data Protection Impact Assessments require identifying PII processing. piisafe.eu shows exactly what personal data is exposed—fulfilling the data inventory requirement. Export for DPIA documentation.

Scan vendor websites before data sharing agreements. Reports reveal their data handling practices. High-risk grades indicate poor security—use findings to negotiate stronger data protection commitments.

The scanner is free and needs no account. PII detection requires an anonym.legal API key (from €3/month). Limits: 20 new scans per hour per IP, up to 1,000 pages per scan. The Dead Link Scanner needs no API key.

Tokens are consumption units based on content size - larger pages cost more tokens, and the scanner shows a real-time usage meter during the scan. Your quota depends on your anonym.legal plan; check the anonym.legal dashboard for current tiers and pricing.

piisafe.eu is free. For enterprise features (unlimited scans, custom patterns, on-premise deployment, SLA), curta.solutions offers enterprise plans. Contact sales@curta.solutions for custom quotes.