| Platform | LegalDocs-Assist (legaldocs-assist.co.uk) |
| Operator | CaseFlow Automation Ltd, registered with the ICO (ZC013423), operating under UK GDPR |
| Reissued | 30 September 2026. This edition supersedes the 3 September 2026 edition in full. It adds file names as a masked category, records the neutral file name used when a scanned page is read, describes the shared gateway and the two paths that layer on top of it, and corrects two statements that claimed more than the build delivers: that titled names are always masked, and the scope of the automated coverage test. |
| Classification | Internal, Compliance |
| Document Purpose | DPIA / Compliance Reference |
Masking is a strong first layer, not a perfect filter. What follows is the route a document actually travels, described so a reviewer can test each step against the build.
pdfjs-dist on those paths, and only the extracted text is transmitted. On those paths the original file never leaves the machine.When a document is drafted, the substitution happens in the handler’s browser, from a map that never left the device, and restored spans are highlighted so they can be read and checked.
When an uploaded document is read to extract case details, the substitution happens inside the backend function as soon as the model replies, before anything returns to the browser. The map exists for that single request, is never written to disk or logs, and is destroyed when the request ends. The model only ever sees tokens, and the fee earner receives the restored details on the Confirm Case Details card.
Reinsertion into a finished document is available only to a firm with a signed Data Processing Agreement and a completed Data Protection Impact Assessment. Every other firm receives masked output only.
| Group | Categories |
|---|---|
| Identity | Person names, dates of birth, National Insurance numbers, NHS numbers |
| Contact | Email addresses, telephone numbers, postal addresses |
| Financial | Bank account numbers, sort codes, IBANs, card numbers |
| Tax and employment | Unique Taxpayer References (UTR), PAYE references |
| Vehicle and licence | Vehicle registration marks, driving licence numbers |
| Case | Claim, policy and matter references |
| Document | The names of uploaded files |
Detection is validated where a standard permits it. NHS numbers are Mod-11 checked, card numbers are Luhn checked, UTRs are check-digit checked, and vehicle registration marks require at least two digits in the prefix so that car model names such as X3, A3 and M5 are not eaten. Titled names are masked, including a title carrying initials in place of a forename such as Ms L Campbell. On a scanned document a title misread when the page is read can prevent this, which is covered by the scanned-page exception below. File names are masked too, because a file name often carries the claimant's surname, and scanned pages are sent to the reading service under a neutral file name. The Microsoft reader is sent no file name at all, because it receives only the raw bytes of the page, so the position is at least as strong on that route. Bare names are masked in high-precision contexts, that is field labels, salutations and sign-offs, and an output-side re-scrub catches bare first and last name pairs in model responses, with guards for case citations and known organisation names. A bare name buried in free prose with no surrounding cue can still pass the input gateway.
Postcodes are preserved by design. Locality is the substance of a credit hire basic hire rate argument and of housing disrepair venue analysis, and a masked postcode makes both impossible to run. Removing the one data point the argument turns on would not be data minimisation, it would be a broken product.
Two controls sit around that decision. An output scrubber removes any postcode the model produces that was not present in the input, so locality data cannot be fabricated. Separately, a compliance check refuses a finished statement that carries a third-party postcode, so a preserved postcode cannot become an unrelated person's address in a document that leaves the firm.
A scan cannot be masked before it is read, because masking needs text and reading is what produces the text. From 5 October 2026, the scanned page is read for every firm by Microsoft Azure AI Document Intelligence in UK South. There is no fallback to the former reader. Everything downstream of that read is masked normally. Because reading precedes masking on this route, errors introduced during optical character recognition can alter an identifier so that it is not recognised by pattern matching that would otherwise catch it in typed text (for example, where a scanned title is misread before the surname). Reading scanned pages is an inherent, plainly disclosed and audit-logged part of a product built for scan-heavy bundles, rather than a separate user-controlled gate or a guaranteed filter. Every scanned read is recorded, who, which tool, when, so a firm can see each occasion a scanned document was read. The log records the event rather than the document's contents or name. Each entry also carries a content fingerprint and page count, so a firm can match a logged read to a document it holds without the log ever storing the document itself. The firm controls what it uploads.
The witness statement is drafted with names, addresses, vehicle registration marks and case references unmasked. A statement of truth signed against placeholders is not a draft, it is a document nobody can sign. Financial and health identifiers stay masked throughout that path: dates of birth, National Insurance numbers, NHS numbers, bank details and contact details.
The letter of claim is drafted with the party names and the property address taken from the intake form preserved in the call note, for the same reason: a letter of claim written about an anonymous tenant at an anonymous address is not a document anyone can send. Every other name and address in the note (neighbours, council officers, contractors, previous occupants, children) is masked, and phone numbers, emails, dates of birth, National Insurance numbers, NHS numbers and bank details stay masked throughout. Contact details are merged into the finished letter on the handler's own computer and never reach the model.
The medical chronology keeps the names of treating clinicians, medical experts, hospital trusts and clinical units readable so that care can be attributed to the right provider. Patient and claimant names, dates of birth and patient contact details are masked.
These three carve-outs are the complete list. Every other tool masks names like any other identifier.
Nothing is retained on the impecuniosity and statement paths. The medical bundle store and the witness bundle store are the exception: they hold the original under a 24 hour delete, and the deletion is verified rather than assumed.
The credit hire locality check calls public mapping services. It sends the claimant's postcode and coordinates, and nothing else. That call sits outside the masking gateway, which is why it is disclosed here rather than described as covered.
Masking runs through one shared gateway that every extraction path uses. Two paths add a further layer on top of it: the clinical chronology and the bank statement reader. A fix to the gateway reaches every path at once. An automated coverage test fails any build in which an AI-facing function calls the model without routing its input through the gateway, and exceptions must be named in that test with a written reason, which turns a silent gap into a recorded decision. That test verifies routing only, that every function reaching a model uses the masking gateway. It does not verify that every field within a function is masked, nor how much personal data survives masking in free prose.
We do not claim full redaction, guaranteed removal or complete coverage. Pattern matching cannot recognise every identifier format, and information that is identifying only in combination is not something a pattern can see. What we do claim is that the first layer is strong, mandatory, shared and tested, that the exceptions are written down rather than discovered, and that the reinsertion of real values happens on the firm's own device under a signed DPA and a completed DPIA. Scanned reading is disclosed plainly above and every use is audit logged.