Protected external AI
External AI: your sensitive data filtered before the API call
You want to use an external AI model for its performance. Bestlog places a layer between your applications and the API that detects, filters and pseudonymises sensitive data before it is sent.
When to choose it
The right model, with less data exposed
- The task needs a model you cannot deploy in-house.
- The texts sent contain identifying data: names, contact details, identifiers, case references.
- You have already chosen an AI provider and need to govern how it is used.
What this architecture does not do
It does not make data anonymous. Pseudonymised data is still personal data under the GDPR: the AI provider remains a recipient, which requires a contract, safeguards and, where applicable, a framework for transfers outside the European Union.
Automatic detection is never exhaustive: some data may slip through the filter, particularly when it is implicit, misspelt or in an unexpected format.
How it works
Six steps between your application and the API
Interception
The application sends its request to the gateway, installed on your infrastructure, not directly to the API.
Detection
Rules (email formats, IBANs, phone numbers, internal reference numbers) and entity recognition models running locally.
Decision
According to your rules: pseudonymise, mask, or block the request.
Pseudonymisation
Values are replaced by consistent placeholders. The mapping table stays on your side.
API call
Only the transformed text is sent to the authorised AI provider.
Return
The response is re-identified locally where needed, then returned to the application. The processing is logged.
Security and logging
A record of every call, without copying the data
- A list of authorised providers and models, defined by you; any other call is refused.
- A log per request: application, user, types of data detected, action applied, provider called. Detected values are not written to the log.
- An encrypted mapping table, with limited retention and restricted access.
- Versioned rules: every change is tracked.
- An observation mode before blocking is switched on: measure before you enforce.
Measurement
Protection can be measured
On a dataset representative of your cases, we track:
- the detection rate, per data type;
- false positives, i.e. items masked unnecessarily, which can degrade the response;
- the impact on the quality of the model's responses, compared with sending unprotected test data.
These measurements guide the tuning. They may also show that sovereign AI is a better fit for your case.
GDPR and AI Act
GDPR: pseudonymisation is not enough
Pseudonymisation is a security measure recognised by the GDPR. It reduces risk; it does not take data out of the scope of the regulation. Still to be addressed: the legal basis, information to data subjects, the contract with the AI provider (Article 28), the framework for any transfers outside the European Union, and the impact assessment where required.
Hosting the gateway in Europe does not change this reasoning: the processing as a whole, AI provider included, is what gets assessed.
AI Act
The AI Act transparency obligations (Article 50) have applied since 2 August 2026, with transitional provisions for certain generative systems placed on the market before that date. Obligations for high-risk systems listed in Annex III apply from 2 December 2027; those for systems embedded in products covered by Annex I, from 2 August 2028. The obligations that actually apply depend on the nature of the system, how it is used, and your organisation's role (provider, deployer…).
Frequently asked questions
Before you start
Which AI providers are compatible?
Those that expose a documented API. The choice of provider and the contract remain yours; the gateway applies the list you define.
Does the protection degrade responses?
Sometimes, when a masked piece of information is useful to the task. That is why the impact on quality is part of the measurements.
Can both architectures be combined?
Yes. For example: process the most sensitive data locally and keep protected external AI for the tasks that need it.
Explore an AI use case for your organisation
A first conversation to clarify the process, the data and the constraints.