PCI DSS
PAN, CVV, expiry.
Layer 1 · Patterns
Deterministic, and checksum-validated wherever possible.
Patterns run first because they are fast and explainable. They are written to be linear in input size with no backtracking-prone expressions — a catastrophic regex in this path is not a performance bug, it is a denial of service against someone’s own typing.
| Type | Validation beyond the pattern |
|---|---|
| Card number (PAN) | Luhn checksum and BIN range |
| IBAN and bank routing | Checksum |
| National ID numbers | Allocation rules and surrounding context |
| Cloud API keys | Known fixed prefixes, with an entropy fallback |
| Private keys | PEM header detection |
| Passport, phone, email | Format plus context weighting |
Layer 2 · Context
What patterns cannot reach.
A small quantised model handles names that are only sensitive in context, addresses, and clinical terminology. It runs only on candidates, not on every submission, which is what keeps the combined path inside budget.
Context is the difference between usable and unusable. A phone number in a signature block is not PHI. The same number next to “discharge summary” and a date of birth is. The layer fires HIPAA severity only on co-occurrence with health context terms — a list your administrators edit, because your vocabulary is not ours.
Layers 3 and 4 · Frameworks and your rules
Report against obligations, not data types.
Every finding is tagged with the frameworks it implicates, so the console answers “what are we exposed on” rather than only “what was found”. On top of that sit your own regex and keyword lists — and an exception list for the patterns that look sensitive and are not.
Exception handling is not a nicety. It is how you keep precision high enough that warnings still mean something.
HIPAA
The eighteen Safe Harbor identifiers, in health context.
GDPR, CCPA and FERPA
General personal data; student identifiers in academic context.
GLBA, SOX and Internal
Financial account data, material non-public information, and your own patterns.
Accuracy targets
Asymmetric on purpose.
Structured identifiers with a checksum should be near-perfect. Context-dependent inference gets latitude on recall but not on precision, because its errors are the ones users notice and learn to dismiss.
These are targets, not measured results. Ask for measured numbers against your own traffic during a pilot — and treat any vendor quoting a single site-wide false-positive rate as not having thought about it.
Straight answers
What is Itzal’s false positive rate?
Targets are set per detector rather than as a single number. Checksum-validated detectors such as card numbers and IBANs target precision of 0.99 or better; context-dependent inference is given latitude on recall but not on precision, because its errors are the ones users notice and learn to dismiss.
Does the contextual model run in the cloud?
No. It is a small quantised model executing inside the local agent process. No text is sent anywhere for classification.
How does detection improve if you never see customer data?
Through synthetic corpus generation, public corpora for realistic negatives, on-device aggregate firing-rate counters that carry no content, and analyst dispositions that supply a label plus the already-redacted snippet.