What gets detected

Version 0.1.0 detects 242 data types in 60 packs: 7 global packs plus packs for 52 countries and the EU. Everything is checked locally in the browser.

On this page

Check digit: where one exists, AImori validates it. A real IBAN is reported, a random string of digits is not.
Keyword: some types without a check digit are only reported together with a keyword (for example "SSN:").
Country packs: which ones apply is decided by automatic detection.

Complete list with IDs for policies: All data types.

Try it yourself: official test values

Only test with these published example values, never with real data. Type the value exactly as shown into a supported AI site and press Enter: sending is paused.

Data type	Test value	Origin of the value	Redacting gives
IBAN (bank account)	`CH93 0076 2011 6238 5295 7`	Example from the SWIFT IBAN Registry	`[Financial data]`
IBAN (Germany)	`DE89 3704 0044 0532 0130 00`	Example from the SWIFT IBAN Registry	`[Financial data]`
Visa card number	`4242 4242 4242 4242`	Test card from the Stripe documentation	`[Financial data]`
Mastercard number	`5555 5555 5555 4444`	Test card from the Stripe documentation	`[Financial data]`
American Express number	`3782 822463 10005`	Test card from the Stripe documentation	`[Financial data]`
Swiss social security number (AHV, Switzerland pack)	`756.1234.5678.97`	Example from the Swiss Central Compensation Office (ZAS)	`[Social security]`
Machine-readable zone (ID card)	`I<UTOD231458907<<<<<<<<<<<<<<<`	Sample ID from ICAO Doc 9303	`[ID document]`
International phone number	`Phone: +44 20 7946 0000`	Number range reserved by UK Ofcom for films and books	`[Contact data]`
Email address	`max.muster@example.com`	Domain example.com is reserved for examples (RFC 2606)	`[Contact data]`

Note

Formatting matters: without grouping or without a keyword (for example 5555555555554444 or +44 20 7946 0000 on its own) these are only uncertain findings: a subtle hint while typing, sending is not paused.
AHV number: only with the Switzerland country pack active. That happens automatically, for example with a Swiss time zone; otherwise use "Choose myself" under Country packs.
AWS example key: AImori deliberately does not report AKIAIOSFODNN7EXAMPLE from the AWS documentation. Example keys from documentation are excluded.

For the other national numbers and most keys there is no official test value. Use values you make up yourself that satisfy the format and check digit, never numbers belonging to real people or companies.

Certain and uncertain findings

Certain: check digit and format match, and where needed the standard notation or a keyword. AImori pauses sending and pasting.
Uncertain: for example a phone number or an unformatted card number, each without a keyword. Only a subtle hint while typing ("possibly … – please check") that never pauses sending.
For IT: policy uncertainFindings with hint (default), warn (uncertain findings open the warning bar, at most with the action Warn) or enforce (same as certain findings).

Local AI detection

In addition to the rules, an AI model on your device recognises names of people, companies, postal addresses and health data.

On by default. Switch under Settings → Detection ("Use local AI in addition to the rules"), policy detection (ki or regeln).
The rules always apply. The AI only adds findings and cannot cancel a rule finding.
The AI only checks the first 4000 characters of a text.
Nothing is sent. If an error occurs, AImori continues with the rules only.

Checking images

AImori reads pasted, dropped and uploaded images in PNG, JPEG or WebP format locally with text recognition and checks the text like pasted text. The AI site then receives the original, a redacted copy or nothing.

Limits: at most 4 images at once, each at most 10 MB and 25 megapixels, at most 20 seconds in total.
Anything that cannot be checked (too large, too slow, error) is reported, not passed on silently.
ID documents in an image are blocked by default, invoices in an image are reported.
An aid, not a guarantee: small, slanted or blurred text can slip through.
Other formats (GIF, HEIC, PDF …) count as files, see Images and files.

To switch off: Settings → Images and files → "Check images", policy imageScan.

Context risks and tables

Some things are only sensitive in context. AImori also reports:

Identity: name and date of birth together with an address, phone, email or an ID or social security number.
Health (diagnosis, medication), HR data (dismissal, salary, appraisal, sick note) and religion, political views or union membership, each only with a recognisable person. General questions such as "What is diabetes?" trigger nothing.
Customer lists: 10 or more different email addresses, phone numbers or IBANs.
Tables with rows of people (name, email, date of birth …), pasted or uploaded as a .csv or .xlsx file.
Obfuscated values: invisible characters, look-alike letters, digits written as words or backwards, Base64 or hex, also spread over several messages.
Confidentiality markings such as "CONFIDENTIAL" or "Classification: internal".

What is used when redacting

Every match is replaced with its category in square brackets, in the extension's language: [Financial data], [Social security], [Health], [Personal data], [Company data], [Contact data], [Tax ID], [Credentials], [ID document], [National ID].

Pasted tables: depending on the policy tableRedaction, the sensitive columns are redacted, or the header and 3 rows are kept and the rest becomes [N rows removed].
Images: the redacted copy paints over every match in solid black.
Placeholders instead of redacting give numbered values such as [IBAN_1], see Placeholders.

Custom terms

Add customer names, project code names, internal domains or initials under Settings → Detection → "Custom terms"; your organisation can add more. Only checksums are stored. Matches appear as "Custom term" with the ID custom_term. The older company dictionary has the ID dictionary.

Default action

Protection class high and medium → Warn, low → Off. Changeable per data type in the settings or via the policy rules.