FAQ
How cloaking differs from encryption and redaction, whether the AI ever sees your real values, where your data lives, and how each tool works. We have tried to answer everything here, and every answer links to the full page when you want to go deeper.
No. Encryption scrambles data into ciphertext the AI cannot reason about. Untraceable replaces each confidential value with an informative, meaning-preserving cloak, so the model still writes fluently and accurately, while your real values never leave your environment.
Never. The AI model only ever receives cloaked data, never your files, never your raw values. The truth is re-inserted only on your screen, after the AI responds. We never see your real values or your keys: cloaked text passes through us, and nothing else does.
Increasingly, yes. Anthropic announced in August 2026 that Claude models launched in the EU on or after 2 August 2026 mark their text output at launch, with older covered models to follow; Google has marked Gemini text with SynthID since May 2024; and other providers are rolling out their own schemes. A detection API is already in private preview for regulators, media, researchers and similar bodies, which is to say, in the hands of the people who would ask. The mark is coming either way; the only variable is whether you can produce the record that shows the use was authorized, scoped and clean. A detected mark alongside a certification report is a compliance record. A detected mark with no record is a problem. Untraceable does not remove the mark and would not try to; it produces the audit that makes it defensible.
It's worth separating three things. Redaction removes the context the model needs. Opaque tokens (x7Qk, §TKN_4) leave it there but meaningless. The model treats them as real words and invents nonsense around them. Generic substitution swaps in fake values that break type and consistency, so the reasoning quietly goes wrong. Rapid and Advanced Cloaking preserve the meaning of each value, what kind of thing it is, how it relates to everything else in the document, so the model reasons correctly while your real values never leave your environment.
The idea of replacing confidential values with meaning-preserving stand-ins is not ours alone: there are APIs that do a version of it, and a research literature converging on it. But an API is a component, not a tool. To use one, a consultancy has to build the document handling, the review step, the drafting, the analysis, the restore, the audit trail, and hire the engineers to maintain it. We didn't ship the primitive. We shipped the work: VaultScribe, VaultStat, VaultDelphi and VaultAudit, built on the cloak, in the fields you actually work in.
All API traffic is encrypted in transit: TLS 1.2 minimum, TLS 1.3 with AES-256-GCM negotiated by default, and TLS 1.0 and 1.1 refused outright, so interception is unlikely in the first place. The stronger answer is that it would not matter if it happened. Before anything is transmitted, a submission has to clear a cloak-coverage test, a sentinel that catches stray numerical and alphanumeric values, and a breach test in which a separate model is given the cloaked text and told to reconstruct the real values. Recover even one and the submission is rejected: zero tolerance rather than a threshold, and a compulsory human certification step on top of it. In practice you could not tell the .md file we send, no company names and every secret cloaked, from an undergraduate's homework: there is nothing in it to trace back to you, and nothing in it to read.
Not yet, neither is held today, and nothing on this site should be read as claiming otherwise. What exists now is architectural rather than attested: cloaking runs client-side, so no confidential value enters our infrastructure at all; per-document keys are held in your own Microsoft 365 tenant and never by us; every submission has to clear a cloak-coverage test, a sentinel, a breach test and a compulsory human certification before transmission, with a single recoverable cloak blocking it; and the full audit trail records every cloak and every AI submission. We are a member of the Microsoft AI Cloud Partner Program. SOC 2 Type I is to be initiated in late 2026, with ISO 42001 and SOC 2 Type II planned for H1 2027.
Regulated work where confidentiality is non-negotiable: HEOR, payers, real-world evidence, biostatistics, and pharma and regulatory affairs today, with legal, financial and professional services, and management consulting on the way. If your work demands advanced AI on confidential data, we want to collaborate.
We don't store it, and we never see it. Your documents and real values stay in your own Microsoft 365 environment; cloaking and compute happen in your browser or your M365 account, so your data never leaves where it already lives. What we keep is cloak-level: cloak labels, run identifiers and which model answered. None of these contains a single real value. Conversation transcripts are saved to your own SharePoint, not to our servers. Cloaked text passes through us; your real values and your keys never leave your computer.
Cloaking is Untraceable's patent-pending method for replacing each confidential value (a name, a price, an NDA-bound term) with an informative, meaning-preserving cloak before any AI model sees the text. Two tiers: Rapid (sequential) Cloaking retains 91–93% of the model's natural writing quality, and Advanced (semantic) Cloaking retains 94–98% (Tremblay & Harricharan, 2026, doi:10.5281/zenodo.21343321). Unlike redaction, the model keeps the context it needs to write well; unlike encryption, the cloak is something the model can reason over.
Source: Tremblay & Harricharan (2026), “Comparing De-identification Methods on AI Writing Quality in HEOR and Market Access,” Zenodo, doi:10.5281/zenodo.21343321. Composite writing-quality index, 30 tests per technique, rebalanced out of the study’s 96/100 baseline.
VaultScribe is a field-expert AI writer built on top of Cloaking. It drafts, rewrites and reviews regulated documents (HEOR dossiers, regulatory submissions, biostatistics narratives) using Hybrid RAG and a human-anchored Grounding Codex for domain accuracy. Because it runs on cloaked data, you get frontier-model writing quality without ever sending the confidential value to the model.
Never. Cloaking runs client-side, in your browser, before anything is transmitted. The AI receives only cloaks; your files and real values stay in your own environment. VaultScribe re-inserts the truth on your screen after the model responds; we never see your real values or your keys, only the cloaked text on its way to the model.
De-identification strips context, which guts writing quality and invites hallucination, and it protects persons, not the information an NDA covers. VaultScribe's cloaks preserve meaning, so writing quality stays near-frontier, and it is purpose-built for the document types regulated experts actually produce, with an audit trail of every cloak and every AI submission.
Health economics and outcomes research (HEOR), market access, regulatory affairs, medical writing and biostatistics today, with legal, financial and professional services, and management consulting, expanding. The Grounding Codex anchors drafts to real, field-specific references rather than the model's unaided priors.
VaultChat is a conversational AI assistant for quick questions and drafting on your own documents. Every confidential value is cloaked on your computer before the message is sent, so you get fast answers from frontier AI without exposing a thing. The truth is re-inserted only on your screen, after the model responds.
VaultDelphi is a multi-model consensus mode for high-stakes questions. Up to four AI models answer independently on the same cloaked input, then converge using the Delphi method, a structured process for reconciling expert opinions, to produce a more robust, defensible answer than any single model gives alone.
Use VaultChat for speed: quick questions, iterative drafting, everyday work. Use VaultDelphi when the answer has to hold up: a contested methodological choice, a regulatory judgment call, anything where you want several frontier models to independently agree before you rely on it. Both run entirely on cloaked data.
Never. Cloaking runs client-side before any message leaves your browser, so every model (one in VaultChat, up to four in VaultDelphi) receives only cloaks. Your files and real values stay in your own environment; what passes through us is cloaked text and nothing else, and every submission is auditable, recording cloaks and run IDs but never a real value.
VaultDelphi calls models from Anthropic, OpenAI and Google, so consensus is drawn from genuinely independent systems rather than several versions of one. The flagship tier is GPT-6 Astra; the premium tier is Claude Opus 5.5, Claude Opus 5.0, Claude Sonnet 4.6, Claude Haiku 4.5, GPT-6 Sol, GPT-5.6 Sol, GPT-5.6 Terra, GPT-5.6 Luna, GPT-5.4, GPT-5.4 mini; the standard tier is Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.6 Luna, GPT-5.4 mini. Every one of them is a third party, which is exactly why they only ever receive cloaks; the confidential value is replaced on your own computer before any of them is called. Region is honored where a model offers an in-region endpoint; models without one run in the US or on global deployments, on cloaked text (disclosed), never a silent cross-region switch. Which models make the list is decided by measurement: we benchmark them on HEOR writing and publish the per-model scores.
Treat every model's output as potentially marked. The schemes differ by provider and are rolling out at different rates; Google has marked Gemini text with SynthID since May 2024, and Claude models launched in the EU on or after 2 August 2026 mark their output at launch, with Anthropic committing to add marking to older covered models. VaultDelphi's audit trail records which models were used on which run, and it is included in the report you get at the end of the analysis; VaultChat's audit gives you the same full traceability for a conversation. That is the record that matters if provenance is ever questioned.
VaultStat is Untraceable's statistical-analysis tool. It generates pseudo-IPD (individual patient data) on cloaked inputs and auto-produces statistical code, so you can test and validate analyses under Untraceable's quasi-encryption cloaking method without exposing real patient-level data to any AI model.
VaultStat is in development and coming soon. You can request early access through the demo form, and we'll bring you in as it opens to pilot users.
Like every Untraceable tool, VaultStat runs on the cloaking engine: confidential values are cloaked on your own computer before anything reaches an AI model. VaultStat works with pseudo-IPD and cloaked inputs, so the analysis and generated code never depend on the AI receiving a real value.
Blueprint is Untraceable's library of field-specific generators for report templates and AI instructions. Instead of starting from a blank page, you begin with compliance-aware structure: document scaffolds and prompt patterns tuned to regulated work in HEOR, regulatory affairs and biostatistics.
Blueprint is coming soon. You can request early access through the demo form and we'll bring you in as it opens to pilot users.
A generic prompt library gives you text to paste. Blueprint gives you field-specific report templates and AI instructions that are compliance-aware and wired into the rest of the Untraceable suite, so the structure you start from already fits the document types regulated experts have to produce, and everything downstream still runs on cloaked data.
VaultCanvas is Untraceable's automated reporting tool. From a single Excel source of truth it produces polished DOCX and PPT reports (including secure, customer-facing report user interfaces), so a report and its underlying numbers stay in sync from one place. It is residency-native and built on the Microsoft Graph API.
VaultCanvas is coming soon. You can request early access through the demo form and we'll bring you in as it opens to pilot users.
VaultCanvas is residency-native and works inside your own Microsoft 365 environment through the Graph API, so your source data stays where it already lives. Any AI-assisted step runs on Untraceable's cloaking engine: the AI only ever sees cloaks, never your real values.
Under most standard NDAs, yes. Sending client-confidential information to a public AI service transmits it to a third party the client never authorized, which is precisely what a non-disclosure clause forbids. The breach happens at the moment of disclosure, whether or not the AI provider is storing or training on the data.
Not by itself. Enterprise terms are an agreement between your firm and the AI vendor: they reduce the risk that the vendor misuses your data. Your NDA is a separate agreement between your firm and your client. Unless the client authorized disclosure to that vendor, sending their confidential data to an enterprise AI service can still be, and certainly should be treated as, an unauthorized disclosure. It certainly comes with better safeguards than a standard free AI, but it is a disclosure nonetheless.
Information that is not confidential (public data, your own general knowledge, fully synthetic examples), information the client has authorized for the specific tool, or text from which the confidential values have been removed before it reaches the model. The last route only satisfies the NDA if the removal is complete and verifiable, and it only stays useful if the AI can still reason about it.
Only partly. Redaction that strips names may still disclose confidential business information, such as pricing, strategy or unpublished results, which are confidential on their own. Disclosure of such secrets can be more costly than a PII or PHI leak. And heavy redaction destroys the context the AI needs, degrading output quality sharply, which we have measured. This is the gap cloaking addresses: confidential values are replaced with semantic markers on your computer, so the model never receives them but can still reason about the whole thing.
Modern NDAs increasingly address AI directly: whether confidential information may be processed by AI systems at all, which deployment classes are permitted (public, enterprise, or architectures where the model never receives confidential values), and what audit evidence the disclosing party can request. If your NDAs are silent on AI, the general non-disclosure clause still governs, silence is certainly not permission. Our recommendation when you adjust your NDA: don't let your secrets leak when you can get the power of AI without sharing them. Allow your data to be cloaked, but restrict any dumping of your raw data into online AI tools.
No. Names are one kind of confidential value, not the definition of confidentiality. A cost model, an unpublished trial endpoint, or a pricing strategy is confidential in itself under an NDA. Removing the names attached to it does not release it from the agreement.
Not in general. Safe Harbor is a health-privacy standard (45 CFR 164.514(b)(2)): it removes 18 categories of identifiers so that information no longer relates to an identifiable person. An NDA protects information itself, trade secrets, business terms, unpublished results, industrial secrets and strategies, regardless of whether any person is identifiable. The two frameworks answer different questions, and satisfying one does not satisfy the other.
Privacy is about persons: it restricts the use of information that identifies or relates to an individual, and it is governed by laws like HIPAA, GDPR and PIPEDA. Confidentiality is about obligations: it restricts disclosure of information you agreed to protect, whoever it concerns, and it is governed by contracts. Your NDAs, engagement letters, employment terms and MSA are the contracts that protect that data. Generic AI tools, enterprise licences included, and AI tools built for privacy (PII and PHI redaction) do not automatically address confidentiality.
Semantic cloaking, which the product calls Advanced Cloaking, replaces each confidential value in a text with an informative marker, one that preserves the value's role and meaning for reasoning. The value is replaced before the text leaves the user's computer. The AI model receives only the cloaked text and never the underlying value. The real values are restored locally for the human operator. Unlike redaction, the model can still reason about the document. And unlike traditional fixed-identifier tokenization, it applies to any confidential value rather than a fixed list of 18, which is what lets it protect secrets and not only identifiers.
It depends on the method. Blunt redaction and random tokenization destroy the context a model needs, and internal benchmarks put retained writing quality near a third of baseline. Semantic cloaking, which preserves each value's meaning, retains roughly 95% of output quality (Tremblay & Harricharan, 2026). The method, not the principle, determines the cost.
It depends entirely on the method. Removing or opaquely replacing information, censoring/redaction and random substitution/tokenization, collapses quality to roughly a third of baseline (about 37% and 32% respectively). Methods that hide the value but keep its meaning, rapid (sequential) and advanced (semantic) cloaking, retain 91–98% of baseline writing quality (Tremblay & Harricharan, 2026), rebalanced out of the study's 96/100 baseline. The ~37% and ~32% de-identification figures are provisional: their per-condition data is not yet published.
Because a language model reasons from context, and redaction removes the context. Replacing values with [REDACTED] or opaque tokens (x7Qk) leaves the model with nothing to reason about, so it stalls, hedges, or invents, and the writing quality will drop by roughly two-thirds.
Yes: cloaking that preserves meaning. Rapid cloaking (SLC) retained 91–93% of baseline quality and advanced cloaking (SSA) 94–98% in a controlled benchmark, because the cloaks encode each value's role and position so the model can still reason, while the real value is never transmitted. Rapid and advanced are the product's names; the patent documents call them sequential and semantic cloaking.
Source: Tremblay & Harricharan (2026), “Comparing De-identification Methods on AI Writing Quality in HEOR and Market Access,” Zenodo, doi:10.5281/zenodo.21343321. Composite writing-quality index, 30 tests per technique, rebalanced out of the study’s 96/100 baseline.
Yes. It comes from Tremblay & Harricharan (2026), a preprint on Zenodo (doi:10.5281/zenodo.21343321) comparing censorship, substitution, and sequential/semantic cloaking on AI writing quality in HEOR and market access, using a composite writing-quality index across 30 tests per technique.
It is safer than consumer ChatGPT. Enterprise terms include no-training commitments, retention controls and admin oversight. But 'safe', 'authorized' and, in some regions, 'legal' are three different questions. Sending a client's confidential data to any third-party AI service is a disclosure under a standard NDA, and the client's permission, not the vendor's terms, is what makes a disclosure authorized. Sending uncloaked data to AI is a trust-based model agreed between two parties, and the limits of that trust should be known to both.
No. Copilot's enterprise data protection (Microsoft's term for the paid Microsoft 365 Copilot tier; “commercial data protection” refers to the free Copilot Chat tier) is a commitment from Microsoft to your organization about how prompts are handled. Your NDA is a commitment from your organization to your client about who may receive their information. Microsoft's promise cannot grant your client's consent.
Three common cases. The input contains no client-confidential information. Or the client has authorized use of that specific AI system, which you should hold in writing in a signed contract (an MSA or the NDA itself, and sometimes added to the engagement SOW), with no conflicting clause between the NDA and the MSA that would prevent the use. Or your engagement terms expressly permit processing in approved third-party systems and the AI deployment meets those terms. Outside those cases an enterprise licence reduces vendor risk without resolving the client obligation, and without establishing that the use is lawful where PII or PHI are involved.
A DPA (data processing agreement) and a BAA (business associate agreement) govern how a vendor processes data you send it. They sit between you and the provider and they address privacy law. An NDA sits between you and your client and it addresses confidentiality. A vendor-side DPA or BAA can make the vendor a compliant processor, but it cannot make your transmission to that vendor an authorized disclosure under the client's NDA.
By ensuring the model never receives the confidential values, the secrets, the PII or the PHI, and that no metadata carries information about the client either. That is no longer a trust-based model, it is an architecture-based one. If every confidential value is replaced with a semantic cloak on the consultant's own computer before the text is transmitted, no client-confidential information is disclosed to the AI provider, so there is nothing for the client to consent to. That is an architectural resolution rather than a contractual one. We still recommend full transparency with your clients.
We measure it rather than assert it. General leaderboards score reasoning, code and trivia; none score whether a model can write a defensible HEOR or market-access deliverable. Our benchmark runs the same controlled task set across frontier models and scores the output with an AI-Delphi panel, and we publish the per-model results, including for models we do not offer and models that scored badly. In the 2026-06 round, unanchored scores ran from 66.3 to 79.1 across sixteen runs, with Claude Opus 4.8 on the Untraceable Grounding Codex at the top. The table is updated as new models arrive.
It depends on the model, and a vendor claiming a uniform uplift has not measured it per model. In our 2026-06 round, six models were scored both with and without the Untraceable Grounding Codex: a curated HTA, methods and reporting-standards layer retrieved at generation time. It raised three and lowered three. The gains landed on the strongest models (+4.7 on Claude Opus 4.8) and the losses on the smallest, because a retrieved knowledge layer is only worth what the model can do with it: a lighter model spends capacity reading the context instead of reasoning over it.
Increasingly, yes, ISPOR named AI the top HEOR trend for 2026–2027 (ISPOR, “2026–2027 Top 10 HEOR Trends”, 20 January 2026, ispor.org/heor-resources/top-10-heor-trends), and an ISPOR Working Group has published a taxonomy of generative AI applications across the HEOR workflow (Fleurence et al., Value in Health, 2025;28(11):1601–1610, doi:10.1016/j.jval.2025.04.2167). The same group's HTA report is explicit about the conditions: foundation models should augment human activities for which humans remain fully accountable; reporting guidance and checklists should cover validation, reproducibility and bias; and it advises against putting protected health information into these models at all, because absolute de-identification is not attainable and re-identification risk stays non-zero (Fleurence et al., Value in Health, 2025;28(2):175–183, doi:10.1016/j.jval.2024.10.3846). Acceptance comes with conditions the field keeps repeating: human oversight, transparency about AI involvement, and traceability that survives HTA scrutiny.
Anything confidential to a sponsor or client: drug names, specific mutations and targets, the target product profile (TPP), unpublished trial results and endpoints, unpublished economic and statistical results, pricing and market-access strategy, patient-level data, draft dossier content, and the sponsor's identity where the engagement itself is confidential. Under a standard NDA or engagement terms, sending these to a public AI service is an unauthorized third-party disclosure, regardless of how useful the model would be.
Not by sending it to a model. Patient-level data carries both privacy obligations (HIPAA, GDPR, PIPEDA) and, in most engagements, sponsor confidentiality obligations. The workable pattern keeps the real data on your side: derive what the analysis needs locally, cloaked summaries or pseudo-IPD that preserves statistical structure, and let the model work on that instead.
That every AI contribution to a deliverable can be reconstructed and defended afterwards: what was submitted to which model, when, what came back, and what a human accepted or changed. HTA bodies and sponsors increasingly expect this. In practice it requires an audit trail generated by the tooling itself: a policy document cannot reconstruct a submission after the fact.
Three routes: restrict AI to public inputs only (safe but excludes most real work); obtain sponsor authorization for a specific enterprise AI deployment (valid but slow, and many sponsors decline, and it demands serious precautions with the BAA, privacy tooling and auditability, cutting no cost on advanced traceability); or cloak confidential values on the consultant's own computer so the model receives semantic and sequential markers instead of the sponsor's data. The third route preserves roughly 95% of output quality (Tremblay & Harricharan, 2026) while transmitting no confidential values at all, which is what cloaking is all about, so only you see the truth.
Semantic cloaking is a technique that replaces each confidential value in a text with an informative marker, one that preserves the value's meaning and role for reasoning. This transformation happens before the text leaves the user's device. The AI model receives only the cloaked text and never the underlying value. The real values are restored locally, for the human operator only.
Redaction removes information, since it replaces a value with [REDACTED] or a black box, leaving the model nothing to reason about. The output quality collapses when important variables are redacted, and sensitive values and secrets are typically very important to the narrative. Semantic cloaking removes the value but keeps an informative flag encoding what the value means and how to contextualize it in the text, so the model can still reason about the document while the specific confidential value is never sent.
They are two cloak types in the same system. Every datapoint carries a sequential component (SLC), which is a stable, position-aware marker that lets the AI locate, repeat and reference the value consistently across the document without knowing it. Semantic cloaks (SSA) add a semantic component on top of the sequential one, encoding the value's strategic meaning (for example, that a price is a premium launch price). In practice users cloak roughly 95% of values sequentially and reserve semantic cloaks for the ~5% of key value messages that carry strategic meaning, the best mix of protection and efficiency.
Fixed-identifier tokenization and masking target a defined list, which typically includes the 18 HIPAA identifiers, and swap them for opaque tokens (x7Qk) that carry no meaning. Semantic cloaking applies to any confidential value, not a fixed list, and its markers are informative rather than opaque, which is why AI output quality survives.
No. Differential privacy adds statistical noise to protect individuals in aggregate datasets, where homomorphic encryption lets computation run on encrypted data. Both are powerful for their use cases but do not fit interactive drafting with a general-purpose LLM. Semantic cloaking is a text transformation applied before a normal model call, avoiding noise and hallucination at all cost: no special model, no advanced computation, and no encryption math on the model side.
Far less than the alternatives. Because the markers preserve meaning, internal benchmarks measured roughly 94 to 98% of baseline writing quality retained under semantic cloaking (Tremblay & Harricharan, 2026), versus about 37% for censoring-style redaction and 32% for random tokenization. The ~37% and ~32% de-identification figures are provisional and the data is not yet published.
Source: Tremblay & Harricharan (2026), “Comparing De-identification Methods on AI Writing Quality in HEOR and Market Access,” Zenodo, doi:10.5281/zenodo.21343321. Composite writing-quality index, 30 tests per technique, rebalanced out of the study’s 96/100 baseline.
Yes. Employees are already using AI (KPMG and the University of Melbourne found that 57% of employees who use AI at work conceal it from their employer, and 48% have uploaded company information into public AI tools), so the choice is between an explicit policy and an unwritten one enforced by individual judgment. A short, practical policy that tells people which tools are allowed for which data prevents both reckless use and blanket bans that push usage underground.
Source: KPMG & University of Melbourne, “Trust, Attitudes and Use of AI: A Global Study 2025” (n ≈ 48,000 across 47 countries).
At minimum: which data classes may go into which tool tier; the rule that client-confidential data requires either client authorization or an architecture where the model never receives it; a prohibition on public/consumer AI for any client data; a record-keeping expectation; and a named owner. It should be one or two pages, not a manual.
A ban is a policy, but usually an ineffective one: it doesn't stop use, it stops disclosure of use. The measurable outcome of blanket bans is shadow AI on personal devices: IBM's Cost of a Data Breach Report 2025 (Ponemon Institute, n = 604 organizations) found shadow AI was a factor in one in five breaches and added about USD 670K per incident. A permissioned policy, clear allowed tiers, protects confidentiality better than a prohibition nobody follows.
It treats client-confidential data as its own tier with a hard rule: it may only be processed by AI when the client has authorized the specific system in writing, or when the confidential values never reach the model (client-side cloaking). This mirrors the legal reality that enterprise AI terms bind the vendor to you, not you to your client. However you proceed, use the data safely and make sure you have auditability and traceability; your relationship and reputation depend on it.
If the data includes personal information about identifiable individuals and you're a private-sector organization operating in Canada, PIPEDA's rules on consent, purpose limitation, and safeguards apply, including when that data is processed by a third-party AI service. Sending personal information to an AI vendor is a use and often a transfer, both of which PIPEDA governs.
Law 25 (the Act to modernize legislative provisions respecting the protection of personal information) adds stricter obligations for organizations handling Quebecers' personal information: a mandatory privacy impact assessment before any communication of personal information outside Quebec (s. 17), which must also be the subject of a written agreement; a privacy impact assessment for any project to acquire, develop or overhaul an information system involving personal information (s. 3.3); transparency where a decision is based exclusively on automated processing (s. 12.1); heightened consent standards; and significant penalties. Using an AI service on Quebecers' personal information most often engages the assessment duties. The s. 12.1 transparency duty is narrower than it first appears; it is triggered by decisions made exclusively by automated processing, so AI used as a drafting aid under human review generally does not engage it.
It depends on the data and the safeguards. Cross-border transfer is not prohibited. Under PIPEDA a transfer for processing is a use rather than a disclosure, and the Office of the Privacy Commissioner's position is that additional consent for the transfer is not required; what is required is comparable protection, secured primarily by contract (Schedule 1, principle 4.1.3), and transparency about the practice. Quebec's Law 25 is stricter: a privacy impact assessment is mandatory before any communication of personal information outside Quebec, and the communication must be the subject of a written agreement (s. 17). Data-residency controls (keeping processing in Canada) and, better, not transmitting the personal values at all, materially reduce this exposure.
If personal values are cloaked on the user's device before any text reaches the AI model, the personal information is not transmitted to the AI vendor, so the cross-border-transfer and third-party-use questions that PIPEDA and Law 25 raise are reduced at the source. It does not remove your obligations for holding the data, but it narrows what leaves your environment to non-identifying markers.
It depends on the agency, and the answer is changing quickly. NICE (August 2024) and Canada's Drug Agency (April 2025) both require the submitting organisation to declare AI use, explain the method and report the human input, and both say the submitter remains accountable for the content. Quebec's INESSS goes further: its June 2026 submission form carries a mandatory yes/no question covering the submission, the economic model and the evidence. The EU's HTA Coordination Group adopted principles in July 2026 requiring that AI-assisted steps be documented and that all prompts be recorded and produced on request. The US is the outlier: neither ICER nor AMCP's current Format mentions AI at all.
No. FDA's January 2025 draft guidance expressly excludes AI used for "operational efficiencies (e.g., internal workflows, resource allocation, drafting/writing a regulatory submission)" that do not impact patient safety, drug quality, or the reliability of study results, and it contains no disclosure duty anywhere in it. It also remains a non-binding draft. FDA is silent on AI-assisted writing, which is not the same as having approved it, and a detailed record of what was used and what a human checked is the minimum preparation for the next iteration of the guidance.
No, and it is the one rule on which every body agrees. ICMJE, COPE, WAME, ISPOR, ASCO, ESMO and all six major medical publishers prohibit it, for the same stated reason: authorship carries accountability, and only a human can be accountable. ISPOR adds that AI may not be cited as a reference either.
Research-process AI goes in the Methods section almost everywhere; that is the one dependable rule. Writing assistance is scattered: Elsevier and The Lancet want a declaration at the end before the references; Wiley and JAMA want the Acknowledgments; BMJ wants the contributor statement; ASCO wants it in the abstract body, where it counts against your word limit; and ISPOR wants it visible to the audience on the poster or slides. Check the venue, not the field.
If your engagement terms or the client's own policy require it, or if you have an NDA or any clause concerning confidentiality, the answer is yes. Beyond that, the practical answer is that disclosure is cheap in advance and expensive after the fact: a line in the engagement letter costs nothing, while the same fact surfacing later reads as something that was concealed. Separately, if the deliverable is going to an HTA agency or a journal, several of them require a declaration regardless of what your client asked for. This is an orientation, not legal advice, consult your corporate counsel before relying on it.
Several say so publicly. The FDA has run an internal generative AI tool, Elsa, since June 2025, now integrated with its HALO data platform. The EMA extended its Scientific Explorer knowledge-mining tool in March 2026 to support initial marketing authorisation applications. NICE's AI delivery plan of 6 August 2026 names using AI to improve NICE's own work as one of three strands. Canada's Drug Agency covers internal operations in its AI position statement. France's HAS states it has run an internal action plan since 2023 to deploy AI tools supporting literature review, data exploitation and the analysis of dossiers. Brazil's ANVISA has recognised AI models as a complementary criterion in sanitary risk analysis since 29 July 2025. And Quebec's INESSS goes furthest in the other direction: its June 2026 submission form tells you the dossier may be processed with Copilot unless you object in the form.
Four things, in a sentence or two: which tool, what it was used for, what it did not receive, and who is accountable for the output. Naming the tool matters more than people expect, "we used AI" invites the question, while "drafting assistance from a named tool, with no confidential values transmitted, reviewed and approved by the named author" answers it. Vagueness is what turns a disclosure into a conversation.
No, and this is the most common misreading. Cloaking removes the data disclosure: if the model never receives a confidential value, nothing confidential was disclosed to a third party. The duty to declare AI assistance is separate and survives untouched, because agencies and journals require it on the basis that AI helped produce the document, not on the basis of what the model saw. What cloaking changes is the cost of disclosing: you can declare the AI assistance and show, in the same breath, that no confidential value left your machine.
Before the work starts, in the engagement letter or statement of work. At that point it is a description of your method and the client can agree to it, which means it never becomes a disclosure at all. Mid-project it is an update. After delivery, or in answer to a direct question, it is the same fact carrying the worst possible framing, and it is the version that damages the relationship, not the AI use itself.
No. As of September 2026 no US federal or state law requires the author of a health economics, market access or regulatory document to declare that AI assisted in writing it. The FDA's draft guidance on AI in regulatory decision-making expressly excludes drafting a submission from its scope. What does bind you is contracts and client NDAs, your engagement terms, and the terms of the AI tool you used. This is an orientation, not legal advice, please consult your corporate counsel before relying on it.
Contract, not regulation. An NDA restricts who may receive confidential information, and sending it to a third-party AI service can be a disclosure to a third party regardless of whether any law mentions AI. That exposure exists today and we do not really need any statute, since it is enforced by your client rather than by a regulator.
The executive order of 11 December 2025, "Ensuring a National Policy Framework for Artificial Intelligence", is directed at state AI laws. It established a litigation task force in the Department of Justice to challenge state AI statutes in federal court, and directed the Federal Trade Commission to address state-mandated bias mitigation. It creates no disclosure duty for anyone writing a submission. This is an orientation, not legal advice, please consult your corporate counsel before relying on it.
We should probably expect paperwork duties rather than more severe forms of limitation. At the UN Security Council on 23 September 2026, OpenAI and Anthropic asked for common standards for testing AI systems and for incident reporting between states, which is really just a records-and-evidence requirement, something we are used to in regulated industries. Expectedly, the United States rejected international governance at the same meeting. Any regime that emerges from that pressure is likely to ask what a system did and who checked it, and most specifically what sensitive data left the building, which is something you should probably start keeping track of by now.
Three things that cost little and hold up under any future rule, and in my experience of implementing new guidelines over many years, the transition is predictably painful when you are not ready. First, keep confidential values out of the model rather than relying on a vendor's promise not to train on them. Second, disclose AI assistance to clients and in submissions where a venue asks, because no venue penalises disclosure and several penalise the absence of transparency. Third, keep a deep record of which tool did what, on which document, reviewed by whom, and what could potentially be exposed as a sensitive value. That record, the Untraceable protocol, as we like to call it here, is the unit every proposed regime is built around.
Whatever its configuration allows, which is usually far broader than the task at hand. A filesystem server can read any path in its permitted roots, not the file you had in mind, but the directory it sits in. A database server can query the tables it was granted. A connector reaches whatever the authenticated account reaches. The scope is set once, at configuration, and then applies to every subsequent request. Nothing narrows it per task.
Pasting is bounded by intent: what you deliberately put in the box is what leaves. An agent is bounded by scope, which is configured once and loosely, so the failure requires no bad intent and no careless moment. A well-intentioned agent asked to gather background will range across a working drive doing exactly what it was told. The other difference is evidentiary, though neither is good. People rarely remember what they pasted into which project. A traversal is worse still: there is usually no record at all of which files were opened.
It can be, and for the same reason pasting is: the test in a standard NDA is whether confidential information was disclosed to an unauthorised third party, not whether you intended to disclose it. If an agent reads a client file and sends its contents to a model provider, that is a transmission to a third party. The fact that a tool selected the file rather than a person does not change the analysis, and it makes the disclosure harder to scope afterwards because usually nobody recorded what was read. This is an orientation, not legal advice: consult your corporate counsel before relying on it.
None of them, as of September 2026. We searched the journals, the societies, the HTA agencies and the regulators. ESMO’s clinical guidance names agentic systems only to scope them out, saying future guidance will be needed. Elsevier’s June 2026 policy names AI agents only to fold them into the disclosure rules written for chatbots. NICE asks submitters to evidence measures against prompt injection and data poisoning; the closest any HTA text comes to the new attack surface, without naming agents. The UN’s Independent International Scientific Panel on AI came closest, publishing “AI Agents Misalignment Risks” on 21 September 2026 and warning that the traditional model of safeguarding is unravelling, but that is advice to states, not a rule binding a submitter. Every published rule still assumes a person typing into a chatbox.
Our position is that current MCP tooling does not belong on a machine holding client or patient material at all; the risk outweighs the benefit by a wide margin, and running it is difficult to reconcile with the duty to take all necessary measures to protect the data. A tool that can traverse a drive, pass what it finds to a third-party model or to several tools in turn, each calling its own uncloaked API, and leave no reliable account of what it read or where that material went is not something careful configuration fixes. Tools of this class belong on a regulated machine when three things can be demonstrated and tested without relying on a vendor assurance: reach limited at the root rather than per installation, removal of secrets, confidential values, PII and PHI before the AI sees the data, and deep traceability covering the reasoning itself, including the chain of thought. This is an orientation, not legal advice: consult your corporate counsel before relying on it.
No. Identity controls govern who and what may reach a model: credentials, non-human identities, agent permissions, shadow-agent discovery. Untraceable governs what the model actually receives once they do. Both layers are necessary, and they are complements rather than substitutes.
Okta's AI Agents at Work 2026 asked them. 80% said it is easier to use their own accounts, 78% that their team already uses it, 57% that approval is too slow, and 49% that the approved tools do not meet their needs. Only 6% did not know approval was required, so only 6% of it is an awareness problem, and the rest is a product problem that stricter policy will not solve.
Source: Okta, “AI Agents at Work 2026.” Percentages for knowledge workers describe AI-using knowledge workers, not a general workforce: the study screened for prior AI use.
Okta's AI Agents at Work 2026 found 90% of executives confident in their visibility into which AI tools are in use and 95% confident their employees use AI responsibly, while 52% of knowledge workers reported using AI without IT approval, and 24% do so regularly. Among those using unapproved tools, 39% shared confidential company documents including financials and contracts. The study screened for knowledge workers who already use AI, so those worker percentages describe AI users rather than a general workforce.
Source: Okta, “AI Agents at Work 2026.” Percentages for knowledge workers describe AI-using knowledge workers, not a general workforce: the study screened for prior AI use.
Yes. Protocol Certification produces a permanent, shareable report certifying that the cloak held under breach testing, and the audit trail records every AI submission at cloak level. Both are designed to be handed to a client or a compliance officer without further preparation.
No. It records cloak labels and run identifiers only, never real values. It is safe to share by construction. Audit records are stored in your project's region, United States or Canada, and never contain a raw value; conversation transcripts are saved to your own SharePoint.
No. Okta's published research is cited as independent third-party evidence, with attribution. Okta is not a partner, sponsor, endorser or affiliate of Untraceable, has no commercial relationship with us, and has not reviewed or approved our use of their findings. Any interpretation of their data is ours alone.
It solves one step, not the job. A de-identification or crypto-token API scrubs a value and hands it back; you still have to build the drafting, statistics, reporting and audit workflow around it, integrate the API, and maintain it. That's a months-long engineering project before a single deliverable ships. And redaction alone strips the context the model reasons from, so output quality drops to roughly a third of baseline. Untraceable is the workspace, not the pipe: cloaking plus the tools, turnkey.
Copilot is the strongest mainstream posture (tenant isolation, Purview governance, a no-training contract), and the best generic assistant a consultant can buy. But governance controls who can access data; it does not stop the model from receiving your raw data. Under a client NDA, the exposure remains. Note also that Copilot itself runs on a range of base licences (E3, Business Standard, even Office 365 E1), while the Purview DLP and sensitivity-label controls that make it safe for confidential content generally require E5 or a Purview add-on, so the governance posture and the Copilot licence are not the same purchase. Untraceable is complementary: it cloaks the confidential values before the text ever reaches Copilot or any model, so the model never sees the secret.
No. An enterprise agreement is between your firm and the AI vendor. Your NDA is between your firm and your client. A vendor's promise not to train on your data does not grant your client's consent to send their confidential data to that vendor, and the model still receives every value in full. Architecture, not a contract, is what removes the disclosure.
It goes deep in one regulated field at a time. Blueprint provides guideline-anchored report templates: ask for a Canadian budget-impact analysis and you get the template pre-loaded with AI instructions; feed it your primer and it produces the BIA skeleton, roughly half of work that used to take an analyst weeks. A field-specific Hybrid RAG bundles the relevant guidelines, agency recommendations and laws, and the Grounding Codex, an expert-approved field encyclopedia, feeds the AI authoritative definitions and sources as it writes. Generic tools do none of this.
No. The infrastructure players ship an API you have to wrap in your own AI workflow: an expensive, months-long build. Untraceable is turnkey: cloaking plus eight tools (drafting, chat, multi-model consensus, templates, reporting, statistics, and audit) work out of the box inside your Microsoft 365 environment, with nothing to build or maintain.
Only if the redaction is complete and verifiable, and even then the output usually suffers, because a model can't reason about what's been blanked out. Manual redaction is slow, error-prone, and one missed value is a disclosure. Cloaking that preserves meaning protects the value without gutting the output.
No. An enterprise agreement is between your firm and the AI vendor; your NDA is between your firm and your client. A vendor's promise not to train on your data does not grant your client's consent to send their confidential data to that vendor. The data still reaches the model in full.
It rarely fits real practice. Provisioning is slow, it covers one client, and you can't run a practice across several sponsors' separate sandboxes. It's a valid option for a single long engagement, not a way to work.
You can, and it's compliant, but it only helps with the work that was already easy. The confidential 80% (the analysis, the argument, the numbers) is exactly the part AI can't touch under that approach.
A ban doesn't stop AI use; it stops supervised AI use. The work moves to a personal device with no log, no policy and no oversight; the exposure doesn't disappear, it just goes where nobody can see it.
The Untraceable Protocol is an open specification for auditable AI use on confidential data. It defines the record an organization should be able to produce for any AI-assisted deliverable: what was cloaked, what was submitted to which model, what returned, and who reviewed it, with confidential values never appearing in the record. It is a conformance target, not only a product feature.
Because the problem it solves (defending AI-assisted regulated deliverables to HTA reviewers, sponsors and compliance teams) is industry-wide, and a specification others can conform to is more useful (and more citable) than a proprietary feature. Untraceable implements the Protocol, but the Protocol is written so any tool or team can meet it.
No. The Protocol requires the record to reference cloak labels and run identifiers only, never real confidential values. That is what makes the record safe to retain, share with a client's compliance officer, or hand to a regulator.
Certification is a series of completeness and AI-breach tests: an opening screening that cloaks all values, a closing sentinel that catches anything the user may have missed, a cloak-coverage test confirming the AI receives exactly what the user reviewed, and a breach test confirming the AI cannot reconstruct any value. The breach test is pass/fail with zero tolerance; a single recoverable cloak blocks the submission. A certified run is one you can defend, and its certification report is part of the audit trail.
No, and deliberately so. Cloaking governs what the model receives, not what it emits; the text that comes back is watermarked like any other model output. The mark is statistical, a bias in which candidate word the model selects, and it carries no identifying information, so it reveals nothing about you, your client or the document. Removing a provider watermark would defeat a transparency mechanism the industry and regulators are now building on, and it is not something we will do. As a consultant or a regulated-industry expert, it is not something you should be approaching either; the goal is to use AI safely and legally while preserving your secrets, not to hide that you used it.
As of August 2026 no general US or Canadian statute makes removal a criminal or civil offence on its own, which is the weakest reason not to do it. It breaches every frontier provider's terms of use, and that can mean throttling, suspension or termination of access. California's AI Transparency Act builds the consequence into the supply chain: a covered provider that learns a licensee has stripped or disabled a latent disclosure must revoke that licensee's access within 96 hours, so the sanction arrives through your vendor rather than a regulator. In the EU, Article 50 of the AI Act places the marking duty on providers, and the emerging reading is that deployers must not suppress or defeat provider-embedded disclosures, where you carry your own disclosure duty, removal works directly against it. The sharpest point for regulated work is simpler: deliberate removal is evidence of intent to conceal, which converts a policy question into a bad-faith question in front of a regulator, an HTA agency, a government body, or a client that simply wants transparency. The tools that strip marks are betting against the direction of regulation, and a regulated consultancy cannot afford that bet.
Longer-form guides, the plain-facts sheet, and the compliance protocol.
Tell us about your confidential-data workflow and we'll show you exactly how the cloak keeps it out of the model.