HCPD — Holistic Contextual PII Detection
Legal agreements, board papers and investor materials carry contextual fingerprints — a jurisdiction, a team size, a pilot quarter, a house term. HCPD extends the twin to those signals. Step through one below.
1 · As written — your environment
This Agreement is between Halden Data Ltd (the Discloser) and Merrow & Finch LLP (the Recipient).
The Discloser’s reversible semantic pseudonymisation applies a stained glass transform to data before any large language model sees it.
The Recipient will evaluate it within its FCA-regulated compliance operations, under English law, through its 12-person compliance team at its Edinburgh office during a Q4 2025 pilot on the Cortex platform.
Signed by Daniel Whitmore and Priya Natarajan, 14 November 2025.
Read for meaning → 5 entities, 8 contextual signals
Two threat models
RSP handles the documents a regulated business processes every day. HCPD is for the ones it shares with people who would recognise it — where the names are only part of what gives the author away.
Operational documents
What identifies the record is the customer: a name, a date of birth, an account number, an address. RSP swaps each one for a semantic twin, and the model reasons on a complete record.
RSPentity-level twin
High-sensitivity documents
What identifies the document is its context: the jurisdiction, the office, the size of the team, the quarter of the pilot, the house name for a method. Together they narrow a counterparty’s guess to one company. HCPD twins those signals too.
RSP + HCPDentity and contextual twin
The documents
Three kinds of document that never used to go near a model. Open one: what you see is what HCPD sends — every entity and every contextual fingerprint already its twin, and every twin reversible.
2 entities, 9 contextual signals — all twinned.
MUTUAL NON-DISCLOSURE AGREEMENT
Between Corvale Systems Ltd (the Discloser) and Ashby Rowe LLP (the Recipient).
The Discloser’s context-preserving substitution applies a lattice transform to sensitive data prior to processing by large language models.
Governed by Irish law; the courts of Ireland have exclusive jurisdiction. The Recipient is CBI-regulated.
The 9-person compliance team at the Cork office are the sole users during the Q2 2026 pilot on the Meridian platform.
An agreement names two parties. Its terms name a third: the author. The method has a house name, the pilot has a quarter, the team has a size and a city. A counterparty who knows the market can put those together. The twin keeps the agreement’s shape and takes the fingerprint out of it.
The model only ever saw the twinned document; the answer you read had the originals restored — entities and context alike, from the same audit trail.
When to use each
Redaction removes the names and the meaning with them. RSP keeps the meaning and twins the names. HCPD twins the rest of what gives a document away.
| Property | Standard redaction | RSP | RSP + HCPD |
|---|---|---|---|
| Entity-level PII | RemovedNames and addresses replaced with placeholders | TwinnedSemantically equivalent replacements | TwinnedSemantically equivalent replacements |
| Semantic context | LostPlaceholder masking destroys it | PreservedFull analytical utility retained | PreservedFull analytical utility retained |
| Contextual fingerprints | Still readable | Still readable | TwinnedDomain, jurisdictional, organisational and temporal signals |
| Use case | LimitedModel output quality degrades | OperationalComplaints, customer correspondence, internal processing | High-sensitivityLegal, board and investor documents |
| Reversibility | NoneThe original is lost | FullVia the entity mapping | FullEntity and contextual mappings |
Legal and regulatory basis
Identifiability is judged on every means reasonably likely to be used, not on names alone. Here is the basis, framework by framework, in the regulator’s own words where it has them.
Identifiable means directly or indirectly.
The test is not whether a name appears. It is whether anyone, using the means reasonably likely to be available to them, could work out who the data is about.
“Personal data means any information relating to an identified or identifiable natural person. A person is identifiable if they can be identified, directly or indirectly, by reference to an identifier or to factors specific to their identity.”
“To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, including combinations of data points that, taken together, allow identification.”
Could a person without specialist knowledge, but with access to the internet, public records and social media, re-identify someone from the data? A document’s contextual fingerprints fail this test on their own.
The maximum penalty is £17.5m or 4% of global annual turnover, whichever is higher.
Reasonably linkable is the standard.
Personal information is defined by what it could be linked to, not by what it names. Contextual signals create exactly that linkability, and the state laws are converging on the same reading.
Personal information includes data that is “reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Contextual signals create that linkability.
The Gramm-Leach-Bliley Act requires financial institutions to protect nonpublic personal information. Contextual data that permits re-identification of account holders falls within its scope.
Virginia, Colorado, Connecticut and twelve further state laws adopt variations of the reasonably-linkable standard. The direction is towards a broader reading of identifiability.
Model inputs are model risk.
Supervisors on both sides of the Atlantic treat what goes into a third-party model as a risk the firm owns. A contextually identifiable document sent to a model is an unmanaged one.
Banks must understand and manage model risk, including the risk of data exposure through model inputs. Contextual re-identification is an unmanaged model risk.
Banks using third-party models must assess data exposure. Sending contextually identifiable documents to a third-party model is a third-party data risk that has to be mitigated.
Firms are expected to identify and manage model risk, including data leakage through model inputs. HCPD addresses the contextual component of that risk.
The guidance refers explicitly to indirect identification through combinations of contextual data when third-party AI services are used.
What matters, the courts have held, is whether the recipient has any realistic means of identifying anyone. Regulators call that boundary the pseudonymisation domain. With HCPD the model sits outside it for the document as a whole, not only for the names in it.
Coverage
The same document, recorded twice: once as RSP sends it, once as RSP with HCPD sends it. Equivalent in every way that matters, different in the one that counts.
| Signal | Entity-level twin · RSP | Entity and context twin · RSP + HCPD |
|---|---|---|
| Direct identifiers — a name, a national ID | Twinned | Twinned |
| Quasi-identifiers — a date of birth, a postcode | Twinned | Twinned |
| Domain terminology | Still readable | Twinned |
| Jurisdictional signals | Still readable | Twinned |
| Temporal markers | Still readable | Twinned |
| Organisational fingerprints | Still readable | Twinned |
| Combinatorial re-identification | Possible | Mitigated |
| The motivated intruder test | Fails | Passes |
Both columns reverse exactly. The contextual mappings are written to the same audit trail as the entity mappings, so a reviewer can see every substitution and its reversal in one place.
RSP for the documents you process every day. HCPD when the threat model demands it. Both reverse exactly, and both write to the same audit trail.
Your real data never leaves your environment. The model only ever sees the twin, and you still get the accuracy you needed.