hiddentokens
Free · written 100% in your browser

Your AI confidentiality charter, written and enforced

Every DPO has to write one. Most charters end up as a PDF nobody can check. This one is different: answer twelve questions and get the charter as a Word file, plus the Hidden Tokens policy that enforces it on every computer — same red lines, same internal references, same terms left readable.

1 · Answer

Country, sector, tools, data, red lines, your own references. Ten minutes.

2 · Download

The charter (.docx), the policy to sign (JSON) and the folder settings for one workstation.

3 · Enforce

The admin console signs the policy; each seat applies it to every message. The monthly report checks it.

How can you check that nothing is sent? This page forbids the browser from making any connection (connect-src 'none' in its security policy) and loads no analytics. Turn Wi-Fi off before you start: the generator works just the same. The only thing that can leave is the optional contact form at the bottom, and it sends its own fields only.
1 · Your organisation
People who use AI
2 · AI tools

The tools the organisation provides. Anything else is covered by the personal-account rule.

Personal AI accounts
AI on phones
3 · The data you handle

Names, contact details, bank details and case references are always covered. Tick what else your files contain.

Amounts
4 · Red lines never sent, not even coded

Hidden Tokens blocks any message that contains one of these and alerts the person in charge. Leave empty if coding is enough.

5 · Your own rules what makes the charter yours

Internal references — a case number, an employee ID, a contract number. Give a name and a fictitious example with the same shape (the digits count: AFF 26/0412 catches two then four digits). They are coded under their own name, AFFAIRE-001, so the AI knows what it is looking at.

Industry packs — ready-made rules shipped with Hidden Tokens: the trade's identifiers coded under their name, its vocabulary left readable. Ticked from your sector; adjust freely.

6 · Governance

These emails go into the policy file you download; they are not sent anywhere.

Your files

The charterWord file, ready for your counsel or DPO to review, then for the staff handbook.
The policy to signpolitique-source.json: your red lines, references, terms and packs, in the format the Hidden Tokens admin console validates and signs.
One workstation's settingsreglages.json: the same rules for a single working folder, applied by the app without any console.
See the policy file (politique-source.json)
See the folder settings (reglages.json)

From the charter to the computers

  1. Have the charter validated by your counsel or DPO, fill in the blanks, append it to the staff handbook and inform staff (the policy carries the notice).
  2. Install Hidden Tokens on every computer that uses AI (Mac and Windows) and the browser extension for ChatGPT, claude.ai, Gemini and Copilot.
  3. One workstation: drop reglages.json into the working folder's Hidden-Tokens sub-folder, or re-enter the rules under the folder menu → “Rules…”. Several seats: from the admin console, hidden-tokens-admin signer --source politique-source.json validates the file, hashes the names and signs it; each enrolled computer applies it to every message and refuses an unsigned policy. To change a rule later without touching JSON, hidden-tokens-admin editeur opens the policy editor in your browser, on your own computer: edit, test on a sample sentence, publish.
  4. Every month, the coverage report says which computers protect their files and which do not. That is how a charter stops being a PDF.

The admin console, the organisation registry and the coverage report come with the Firm plan (2 to 20 seats) and the Organisation plan. The charter, the app's folder rules and the industry packs work on every plan, including the 14-day trial.

Want a second pair of eyes?

Optional. We read your charter with you in a 30-minute call, or show you the policy editor that turns it into signed rules. This form sends its own fields only — never the charter, never a rule, never a name you typed above.

The charter is the easy part

Hidden Tokens codes names, accounts and case numbers on the computer before they reach Claude or ChatGPT, then puts the real values back into the answer. The charter says it; the tool does it; the report proves it.

Try Hidden Tokens free for 14 daysFirst, see what already leaked

The charter is a template adapted to your answers, not legal advice: have it validated by your counsel or DPO. The legal references in the annex are given for orientation and may change. Patterns derived from an example catch numbers of the same length only; the admin console and the app validate every rule again before applying it.