Anonymize HR documents for AI
To anonymize HR documents for AI, you start from the files the HR department produces or receives every week: an employment contract in Word, a batch of payslips in PDF, sixty annual review reports, resumes, a staff register in Excel. Each one names an employee or a candidate and carries identifiers that point to them unambiguously: employee number, badge number, French social security number. Biffer recognizes them on your computer, with no connection, replaces them with stable aliases and highlights them in black in the output file.
On this page we go through these files one by one, how to redact them, the framework of the GDPR and French labor law, and the AI uses that follow.
An HR department's files and what they contain that is sensitive
The HR department holds more data about people than any other, from hiring to departure. Here are the files we find everywhere, with what each one reveals.
Employment contracts and amendments (Word, PDF)
Civil status, address, social security number, salary, negotiated clauses, residence permit or license for some positions.
Payslips and DSN payroll filings (PDF, Excel)
Payslip number, employee number, URSSAF number (social contributions), health insurance, wage garnishments, sick leave that reveals a health condition.
Annual and career reviews (Word, PDF)
The manager's named assessments, objectives, career wishes, personal difficulties sometimes on record.
Applications and resumes (PDF, Word)
Application number, France Travail ID (the French public employment service), full career history, address, age, photo.
Staff register and tracking sheets (Excel, CSV)
One row per employee: number, badge, start and end dates, contract type, nationality.
Disciplinary letters and absence files (PDF, Word)
Warnings, notices of meetings, sick notes, disability recognition, trade union mandates.
Text PDFs, Word, Excel, CSV and plain text go through the same process (see redact a PDF); images and scanned PDFs go through built-in optical character recognition, offline, then are redacted by blacking out the pixels, with no possible restoration.
Redacting these files in practice: formats, aliases, black highlighting
Everything happens on your computer, with no connection (see offline software).
- You drop the file with the human resources profile enabled. The local analysis highlights people, addresses, dates, social security numbers, staff numbers, employee and badge numbers.
- You untick false positives (a job title mistaken for a name) and add what is missing, all occurrences at once.
- Each item becomes a stable alias (SALARIE_001 for an employee, MATRICULE_001, CANDIDAT_007; the alias labels are in French), identical from one file to the next for the same person.
- In Word and PDF, redacted data is highlighted in black, an option enabled by default: you see at a glance what was removed. In Excel and CSV, columns and formulas are preserved.
- You choose whether to save the mapping table, encrypted (Argon2id and AES-256-GCM) or in plain text. With it, the real names are restored in the AI's answer; without it, the redaction is irreversible.
The queue takes an entire review campaign, in reviewed or automatic mode. Biffer is free for five files per month, all redaction features included, after a one-time email confirmation in the software, with no password. Beyond that, Biffer for Mac or Biffer for PC costs €10 excl. VAT (€12 incl. VAT) per computer, paid once by card via Stripe: a lifetime license for the version purchased, tied to the computer, unlimited files, each major version sold separately. Every feature is included from the free plan (see pricing).
The human resources profile adds employee and candidate identifiers to the general detections. Here is the exact list from the software:
| Field | Where you find it |
|---|---|
| Employee number, badge number | Staff register, access control, spreadsheets |
| Payslip number | Payslips, payroll journals |
| URSSAF number | Payslips, DSN filings, letters from the agency |
| Health insurance (mutuelle) number | Enrollments, payslips, benefit files |
| Residence permit number, license number | Hiring files, regulated positions |
| France Travail ID | Applications, certificates, hiring subsidies |
| Application number | Recruitment tools, acknowledgments of receipt |
On top of these come the fields shared by all professions (file number, reference, contract number, staff number) and the general detections: people, emails, phone numbers, addresses, French company numbers (SIREN and SIRET), French social security number, IBAN, license plates, dates. An identifier specific to your company can be added by keyword (see anonymization by profession).
GDPR and French labor law: the HR department's obligations
The employer is the controller for the data of its employees and candidates. The GDPR and the French Data Protection Act No. 78-17 of 6 January 1978 require a specified purpose, data minimization and appropriate security measures. The French Labor Code adds, in Article L1221-6, that the information requested from a candidate must have a direct and necessary link with the job.
Two consequences for the department's files. Some data is sensitive within the meaning of Article 9 of the GDPR: sick leave, disability recognition, a trade union mandate are masked, beyond simple pseudonymization. And identifiers add up: Biffer removes the name, the staff number, the badge and the hiring date together, for complete protection. Biffer prepares, you validate: the HR officer reviews the preview and has the final word on what is shared.
AI use cases once the files are redacted
A redacted review report keeps its content: SALARIE_014 met their objectives and wants to move up. The AI can use it while the person stays protected.
- Summarize an annual review campaign: trends, training requests, warning signs.
- Compare redacted applications against a set of criteria, without bias from name or age.
- Draft a standard amendment or a job description from existing contracts.
- Analyze a staff register to prepare a workforce report.
The redacted file can be pasted into ChatGPT, Claude or Gemini; the page anonymize before Gemini gives the useful settings. The answer, loaded back into Biffer with the mapping table, gets the real names back, still locally. Biffer is designed in Lyon by Romain Rissoan, its founder, trainer and consultant, at OPCADIA.
Frequently asked questions
How do you redact a stack of resumes for AI pre-screening?
You drop the resumes (PDF or Word) into the queue with the human resources profile enabled. Biffer replaces name, address, email, phone number, date of birth and application number with stable aliases, CANDIDAT_001, CANDIDAT_002, and keeps the career history, skills and degrees that the selection grid needs. Biffer processes the text; for photos, a visual check before sending keeps you in control of the result. The AI can then rank profiles on objective criteria, and the mapping table gives you the names back once pre-screening is done, on your computer.
Are sick leave or a union mandate redacted like a name?
They are handled differently, and the distinction matters. A name is pseudonymized: it becomes SALARIE_001 and stays useful for following the person through the document. A mention of sick leave, disability, pregnancy or union membership is sensitive data within the meaning of Article 9 of the GDPR: it disappears from the file you send, beyond a simple change of label. For this, Biffer offers the "mask" policy, which replaces the value with a neutral label, and the custom keyword field to find these mentions in your review reports.
What happens to an Excel payroll sheet once redacted?
It stays an Excel sheet, with its columns, formulas and tabs. Biffer reads every cell, spots names, staff numbers, social security numbers, IBANs and payslip numbers, and replaces them with stable aliases while fully preserving amounts, dates and calculated totals. The same employee keeps the same alias from one tab and one month to the next. The output file can be given to the AI for a payroll or pay gap analysis, with every row protected from re-identification.
Your business documents anonymized, ready to be published or handed to an AI tool.
Biffer runs on your computer without sending a single file. Free for five files a month, unlimited for €10 excl. VAT per computer.
100% offline · Free: 5 files a month · No file sent