National ID number (HETU)never leaves identifiable.

It only observes. Shield detects national ID numbers (HETU), account numbers, payment cards, business IDs, email addresses, phone numbers, street addresses and the names of people and organizations, and shows which data types passed through. It doesn’t touch the requests. No detection is perfect, which is exactly why the pilot starts with monitoring. Once you have seen your own numbers, you decide which data is masked, run in Finland or blocked.

See current prices here.

Masking replaces detected data with a placeholder such as HETU_1, so the model never sees the real value, and the real value is restored in the user’s answer. Logging lets the request through unchanged and records which data type was found. Blocking stops the request entirely and nothing is sent. The fourth option is to run the request on AIvantage’s own capacity in Finland, so the data doesn’t leave the country at all. You can choose the rule one data type at a time.

No detection is perfect. National ID numbers (HETU), payment cards, account numbers, business IDs, email addresses, phone numbers and street addresses are recognized by format and check digits. Names of people and organizations are recognized by a language model whose sensitivity you can tune. You can also add your own data types, such as customer numbers. If a use case can’t tolerate a single leak, run all of its requests in Finland.

We sign a data processing agreement. Where processing happens follows your rules, and you can see how the rules were applied, request by request, in the customer portal. You get the documentation you need for audits and for demonstrating AI Act compliance.

Yes. Your app sends requests to the AIvantage router, which runs on a server of the Finnish provider UpCloud in Helsinki. From there the request continues to the model provider your rules allow. From prompts and responses we store only training excerpts for your own savings model. They are deleted after 180 days, and collection can be switched off. For reporting we store metadata such as time, model, tokens and price. The Shield log records which data types were found and what was done with them, but not the values themselves, and it is kept for 90 days by default. The mapping between masking placeholders and real values is held encrypted only in the router’s memory and is forgotten an hour after last use.

The log keeps the data type, not the personal ID number. We store metadata for reporting (time, model, tokens and price), the Shield log of which data types were found and what was done with them (90 days by default), your API key encrypted (AES-256-GCM) in Helsinki, and training excerpts for your own savings model (deleted after 180 days, collection can be switched off).

Detected values and the masking mapping are never stored permanently: the mapping is held encrypted only in the router’s memory and forgotten an hour after last use. Your data is not used for anything else.

You decide whether the request is let through or stopped in that case. If a model provider doesn’t respond, the router moves the request to the next model your rules allow. A failure never widens the allowed set, so a request would rather stop than end up where it doesn’t belong.

You don’t have to trust blindly. Create a separate key for AIvantage in your model provider’s console. You can see in the provider’s own view what it is used for, and revoke it there in seconds. AIvantage stores the key encrypted (AES-256-GCM) and never shows it to anyone after it is saved. During the pilot Shield only observes, so nothing changes in production because of it.

Only your own savings model. Your data trains only your own savings model – never shared models, other customers or our own purposes. Training excerpts are deleted after 180 days, collection can be switched off, and data is deleted on request.