You decide what leaves.
Upload a DOCX, PDF or Markdown file. xfilguard highlights the personal data it finds; you choose, entity by entity, to tokenize, redact, allow or skip it, and download a copy with your choices applied.
Registration is by invitation. Request access by email.
Client: Jane Doe Email: jane.doe@example.com Acme Corp. agrees to provide consulting services to the client. For billing questions, contact Richard Roe at +1 202 555 0183. Authorized card: 4111 1111 1111 1111.
Six plain facts about the web app as it works today, limits included.
01 · review
Detections are highlighted next to the original text, each with a default decision you can change to Tokenize, Redact, Allow or Skip. Low-confidence detections start as Skip and stay hidden until you choose to show them.
02 · tokens
Tokenize replaces a value with a token such as ⟨person_01⟩. The same value of the same type gets the same token throughout the document, so an LLM can still follow who is who.
03 · formats
Up to 50 MB per file. A DOCX keeps its formatting. A PDF comes back as an image of each page: the layout is kept, but its text can no longer be selected.
04 · languages
Names, organizations and addresses are found by statistical models for Spanish and English only. IDs, emails, phone numbers, card numbers and IBANs are matched by their structure in a document in any language.
05 · restore
With pseudonymization and tokenization, paste the LLM's answer into the document page and xfilguard swaps the tokens back for the original values. The encrypted mapping is removed with the obfuscated file, which becomes eligible for removal 30 days after it was made.
06 · honest output
If part of a document could not be read, or a replacement could not be applied to the file, the app warns you before you download.
xfilguard does not sit between you and the model, and it never sends your document to one. You take the cleaned copy there yourself.
step 01
Upload a DOCX, PDF or Markdown file in the web app. xfilguard reads it and detects names, IDs, contact details, card numbers and other personal data.
step 02
Detections are highlighted beside the original, each with a default decision. Change any of them to Tokenize, Redact, Allow or Skip, and mark by hand anything it missed.
step 03
Confirm, and xfilguard writes your decisions into a copy of the file. You download it and take it to the LLM yourself.
Detection is automated, and automated detection misses things and flags things that are not personal data. That is why there is a review step before the obfuscated copy is made.
it is
it is not
Files are removed by an hourly cleanup that retries failures, so removal can come later than the window. xfilguard holds no security or compliance certification today; its compliance presets are settings, not an attestation.
What people ask before they request access, answered with what the product does today.
xfilguard is a web app that removes personal data from documents before you give them to an LLM. You upload a DOCX, PDF or Markdown file, review the entities it highlights, decide what happens to each one, and download a copy with your decisions applied. It does not send your document to any LLM provider: you take the cleaned file to the model yourself.
xfilguard accepts DOCX, PDF and Markdown (.md) files of up to 50 MB each. Scanned PDFs with no text layer are read with OCR in Spanish and English, up to 100 pages; a longer scan is refused rather than partly read. Text inside images embedded in a document is not read. Audio, image files and spreadsheets are not supported. You can also paste up to 50,000 characters of plain text in the Text module.
A DOCX keeps its formatting: each replacement is written into the original text runs. A PDF is rebuilt as an image of each page, so its layout is kept but its text can no longer be selected or copied. If part of a document could not be read, or a replacement could not be applied to the file, the app warns you before you download.
xfilguard finds names, organizations and addresses with statistical models for Spanish and English only. Structured identifiers such as national IDs, tax IDs, emails, phone numbers, card numbers and IBANs are matched by their structure in a document in any language, but the checks that rely on context words use Spanish and English words. OCR reads Spanish and English. The interface is in English.
xfilguard detects names, organizations, addresses and places; national ID numbers from Argentina, Chile, Colombia, Ecuador, Mexico, Panama, Peru, Spain, the United States and Uruguay; tax ID numbers from Argentina, Colombia, Mexico, Peru and the United States; emails, phone numbers, URLs and IP addresses; dates, ages and amounts of money; card numbers and bank accounts, including IBANs; and usernames and passwords. Detection is automated and not perfect: it misses some values and flags some that are not personal data, which is why the app has a review step. You can mark anything it missed by hand.
Each detected entity gets one of four decisions: Tokenize, Redact, Allow or Skip. Tokenize replaces the value with a token such as ⟨person_01⟩, and the same value of the same type gets the same token everywhere in the document. Redact replaces it with [REDACTED]. Allow keeps it in clear after you reviewed it; Skip keeps it in clear because it is not personal data, and the two are recorded differently. Detections with a confidence of 0.6 or more start as Tokenize; the rest start as Skip and are hidden until you choose to show them. You can change any of them.
You can restore the original values only if you chose pseudonymization with tokenization when you obfuscated the document. Paste the LLM's answer into the document page and xfilguard puts the original values back in place of the tokens; neither the pasted nor the restored text is stored. The encrypted mapping is removed with the obfuscated file, which becomes eligible for removal 30 days after it was made, or when you delete the document. With anonymization the original is deleted when the document is obfuscated, a failed deletion is retried, and the values cannot be restored.
xfilguard keeps the original file for the window chosen per upload: 0 hours, 24 hours, 7 days or 30 days from upload. After that, an hourly cleanup removes it and retries failures, so removal can come later than the window. Workspace admins can set a ceiling that members cannot exceed and can enforce one compliance preset for every upload. The obfuscated copy becomes eligible for removal 30 days after it was made. Deleting a document deletes the original, the obfuscated copy and the detected text, and the workspace owner can close the whole workspace. Copies in backups remain for up to 30 days before they rotate out.
xfilguard stores uploaded files on the application's own server. Backups keep copies of the database and the stored files for up to 14 days on the server and 30 days in an encrypted offsite copy, so a deleted document can remain there until they rotate out. Document content is not sent to any LLM provider: you take the obfuscated file to the model yourself. Stripe handles billing and receives the workspace name and seat count, not your documents.
xfilguard costs USD 50 per seat per month, billed monthly through Stripe; taxes may apply. A seat is an active member or a pending invitation. A new workspace starts with a 14-day free trial with 5 seats and no card required; when the trial ends, processing stops until the workspace subscribes. Each workspace can create up to 200 documents in any rolling 30 days, and deleted documents count toward that limit.
Registration for xfilguard is by invitation today. Email support@xfilguard.com to request access; once your email is on the list you can create a workspace, which starts the trial. If you already have an account, sign in at app.xfilguard.com.
xfilguard holds no security or compliance certification today. Its compliance presets choose which entity types are flagged, the default decision and how long originals are kept; they are settings, not a certification or legal advice, and selecting one does not make a document compliant with any law.
Registration is by invitation today. Ask for access by email; once your email is on the invitation list, you create your workspace and the trial starts.