hiddentokens.com/france-gdpr-ai · 27 October 2026 · info@hiddentokens.com
Hidden Tokens in France: AI, the GDPR and professional secrecy
Your teams use ChatGPT, Claude, Copilot or Le Chat on contracts, payroll, patient files and court documents. Every file given to the AI goes to a provider, often subject to US law, with the names, NIR (social security) numbers, SIRET (company establishment) numbers and IBANs it contains. Hidden Tokens codes them on your computer, before the AI reads the file, and puts the real values back into the result, on your side.
Download this sheet (PDF) A4- The GDPR names pseudonymisation among the expected security measures; professional secrecy is a criminal matter in France (article 226-13 of the Code pénal); the CNB's April 2026 guide recommends systematic pseudonymisation before any generative AI tool.
- Hidden Tokens codes names and French identifiers (NIR, SIREN, SIRET, IBAN, RG numbers) on your computer before the AI reads the file. The key is kept separately, on the computer, never transmitted.
- It doesn't make you "GDPR compliant": it supports your compliance, and documents it. It protects what goes through it.
- From €30 a month (Solo, billed €360 a year), excl. VAT. 14-day trial, no account, no card. 30-day guided pilot, deducted in full from your first year.
Why the question arises
- The GDPR names pseudonymisation among the expected security measures, and requires data protection by design.
- Professional secrecy is a criminal matter (article 226-13 of the French Criminal Code, the Code pénal). For lawyers, the guide "La déontologie et l'IA" (Ethics and AI) published by the CNB (Conseil national des barreaux, the French national bar council) in April 2026 recommends systematic pseudonymisation before using any generative AI tool, and points out that providers' commitments can be neither proven nor verified.
- The EU AI Act (Regulation (EU) 2024/1689) has required, since 2 February 2025, AI literacy among the people who use AI (art. 4): a written rule on AI use and a tool that enforces it are the first evidence of it.
What the texts say, and what Hidden Tokens does
| Text | What it requires | What Hidden Tokens does |
|---|---|---|
| GDPR, art. 4(5): pseudonymisation | The information that allows re-identification is kept separately | The key is kept separately, on the computer, never transmitted |
| GDPR, art. 25: data protection by design | Protective settings by default | Names and identifiers coded by default; sensitive financial columns (payroll, turnover, assets) protected automatically; opened up only explicitly |
| GDPR, art. 32: security | Appropriate measures, including pseudonymisation | A documented and tested technical measure (public benchmark, leak hunting) |
| GDPR, art. 35: impact assessment | A DPIA for high-risk processing | Pre-filled DPIA template provided |
| GDPR, chapter V: transfers outside the EU | Safeguards for data leaving the EU | The recipient receives only codes and has no means of re-identifying |
| Lawyers: art. 66-5 of the Law of 31 December 1971; CNB guide, April 2026 | Secrecy, and pseudonymisation before AI | The ten points of the CNB grid, with answer and proof, at hiddentokens.com/cnb-compliance |
| Chartered accountants (experts-comptables): art. 21 of the Ordinance of 19 September 1945 | Professional secrecy | Accounting pack: invoice, voucher and entry numbers coded; chart of accounts readable |
| Healthcare: art. L1110-4 of the Code de la santé publique (Public Health Code); banking: art. L511-33 of the Code monétaire et financier (Monetary and Financial Code) | Medical secrecy, banking secrecy | Healthcare and Banking and insurance packs: patient, insured-person and policy numbers, and IBANs from any country, coded |
What Hidden Tokens recognises for you
- French identifiers: NIR (check digits verified), SIREN and SIRET, IBAN, RG (docket) and pourvoi (appeal) numbers, driving licences, number plates, phone numbers, addresses.
- Industry packs: legal (law firm, France), accounting, HR and payroll, banking and insurance, healthcare, telecom. All included in every plan.
- All your AI tools: Claude Desktop through the connector; ChatGPT, claude.ai, Gemini, Copilot, Le Chat (Mistral), Perplexity and DeepSeek through the extension. One key:
NAME-001is the same person everywhere.
Prices in France and the euro area (excl. VAT)
| Solo, 1 seat | Firm, 2 to 20 seats | Organisation, 21 to 100 seats | 101 to 500 seats |
|---|---|---|---|
| €30 / month billed €360 / year | On quote | On quote | On quote |
For the first ten customers in France on the Firm or Organisation plan: one day of on-site rollout free (travel costs extra).
14-day trial, no account, no card. 30-day guided pilot, deducted in full from your first year.
What Hidden Tokens doesn't do
- It doesn't make you "GDPR compliant": it supports your compliance, and documents it.
- It protects what goes through it. Text pasted by hand into the chat isn't covered.
- Pseudonymised data remains personal data for whoever holds the key: you. The EDPB's Guidelines 01/2025 on pseudonymisation and the CJEU judgment of 4 September 2025 (C-413/23 P) should be reviewed with your counsel.
This sheet is not legal advice: the references should be confirmed by your counsel or your DPO. Hidden Tokens · hiddentokens.com · info@hiddentokens.com · WhatsApp +212 680 092 567
Next steps. 14-day trial: hiddentokens.com/#download · 15-minute leak test or pilot: WhatsApp +212 680 092 567 or info@hiddentokens.com · CNB compliance file: hiddentokens.com/cnb-compliance · Shadow AI diagnostic: hiddentokens.com/shadow-ai-diagnostic · AI policy generator: hiddentokens.com/ai-charter