Unplex Desktop removes sensitive details on your own computer, before anything is sent to Unplex. A redaction profile — also called an anonymization profile — is the set of rules it follows. The profile decides which values are searched for, which are removed, and which stay readable.

This article explains every setting in the profile editor, with several examples. It applies to Unplex Desktop on Windows. Profiles cannot be edited in the web app.

Before you start

Install Unplex Desktop and sign in. See How to Install the Unplex Desktop App.
Open Settings → Privacy and switch on Local privacy guard. The editor needs it: the Redaction profiles tab says “Switch on the local privacy guard” until the guard is running.
Under Installed language models, install the languages your documents are written in.
Optional: switch on Use an on-device model for smarter labeling. One section of the editor (Smart labeling) only has an effect when this model is installed.

Profiles live on one computer. They are files in your own user folder on this machine. They are not shared with colleagues and they are not stored in your workspace. If two people need the same profile, each of them creates it on their own machine.

Where a profile is used

You choose a profile per project, and separately for documents and for chat.

Documents. Settings → Privacy → Redaction profile — documents. The same setting is shown at the top of the Documents tab. It applies when you redact a PDF.
Chat. Settings → Privacy → Redaction profile — chat. It applies to every message you send. The pill above the message box names the profile in use.

Because these are two separate lists, every profile states where it may be offered. A profile marked for documents only never appears in the chat list.

The profiles that come with the app

Five profiles are built in. Read them first: often one of them is already what you need, or a good starting point to duplicate.

full — removes every value it detects, in documents and in chat. This is the default and the safest choice. It cannot be edited or deleted, and no other profile may be named full.
financial-statement (documents) — for bank statements and portfolio reports. Account numbers, IBANs, ISINs and statement dates are kept exactly as printed, so figures can still be extracted. Client names, national identity numbers, contact details and addresses are removed.
beneficiary-only (documents) — for data extraction. Only the account holder's name and personal identity numbers (AHV number, codice fiscale, passport) are removed. Everything else stays exactly as printed.
chat-minimal (chat) — removes only what points at a person: names, addresses, email addresses and phone numbers, identity numbers, account numbers, and dates of birth. Amounts, statement dates and ISINs stay readable. Company names are removed as well.
chat-minimal-llm (chat) — the same rules as chat-minimal, plus the on-device model. The model keeps a company name that is a bank, a provider or the issuer of a security, so “UBS” and “Nestlé” stay readable while your client's own company is still removed.

Open the editor

Open Settings → Redaction profiles. You can also open it from the profile list in the Documents tab, with Manage profiles….
The list shows each profile with a badge — Built-in, Customised built-in or Custom — and where it is offered (Documents, Chat).
Start in one of three ways:
- New profile — an empty form.
- Duplicate — a copy of an existing profile under a new name. This is the easiest way to start.
- Edit — change a profile you already have. Every profile except full can be edited, including a built-in one.

1. Name and use

Name. Lowercase letters, digits and dashes, at most 63 characters, for example portfolio-review. The name cannot be changed after you save, because your projects point at it. To rename a profile, duplicate it under the new name and delete the old one.
Description. One or two sentences for yourself and your colleagues. It is shown next to the name in the profile lists.
Offer it for. Tick Documents, Chat, or both. At least one is required.

If you type the name of a built-in profile, the editor warns you: saving replaces that built-in for every project on this computer that uses the name. You can undo it later with Restore default.

2. What is removed

This is the heart of the profile. Either switch on Remove everything that is detected — which is what full does, and then nothing below applies — or set each group of values by hand.

Each group has three choices:

Remove — the value is found and replaced by a token.
Keep readable — the value is found, and then protected. Being found matters: a name that runs into an IBAN is cut at the IBAN, so the IBAN survives complete, character for character.
Not looked for — the detector does not search for this group at all. The values stay in the text, but they are not protected either.

Example of the difference. A statement line reads Mario Rossi CH93 0076 2011 6238 5295 7. With account numbers set to Keep readable, the name is removed and the IBAN comes out whole. With account numbers set to Not looked for, the name detector may swallow the first characters of the IBAN, and the extraction that follows gets a broken number.

The groups are:

names — people and companies.
locations — places and street addresses.
contact — email addresses and phone numbers.
dates — dates and ages.
birth-dates — a date of birth. It is a separate group on purpose: a message can keep its meeting dates and lose the birthday.
account-ids — IBAN, account, policy and file numbers, cards, VAT numbers: what ties a client to an institution.
instrument-ids — ISIN, CUSIP, valor, LEI: they name a security, not a person.
national-ids — AHV number, codice fiscale, passports, identity cards and other government numbers.
other — IP and MAC addresses, web addresses, nationality or religion.

One rule to remember. A date of birth is also a date. If you set dates to Keep readable and birth-dates to Remove, the birth date would stay readable inside the kept date. The editor refuses to save that: set dates to Not looked for, or stop removing birth dates.

3. Words never removed

A short list of words that are always left in the clear, whatever the detector says.

Example. Your own firm is called Muster & Partner AG and appears in the header of every document you process. It is not client data, and reading [ORG_1] in every answer helps nobody. Add Muster & Partner AG here. The same applies to the custodian bank you always work with.

Keep this list short. It is not the place to list every company in a portfolio — Role rules and Smart labeling do that job, and they work on companies they have never seen.

4. Smart labeling (optional, closed by default)

Switch on Ask the on-device model to label each detected name, then write your own labels. For every name the detector finds, the model reads the document around it and decides which label fits. Your label then decides what happens to that name.

Each label has four fields:

Label — a short technical name in lowercase, for example financial_institution.
What it means — one sentence. The model actually reads this sentence, so write it for a reader who does not know your business: “A bank, custodian, fund house or securities issuer that provides a service. Never the client.”
Applies to — Person, Company, Place, or several of them.
Decision — Keep readable or Label only.

The order of the labels matters: it is the tie-break when two labels could fit. Use Move up and Move down to put the more specific label first.

Why there is no “Remove” decision. A “Remove” label would leave a value readable every time the model fails to recognise it. The editor never writes one. A name the model cannot place simply keeps the decision from section 2 — which means it is removed, never left readable by mistake.

If the on-device model is not installed, no label is produced and the profile still works: the decisions from section 2 apply on their own.

5. Role rules (optional, closed by default)

Role rules are the version of the same idea that works without the on-device model. They keep securities issuers and the custodian bank readable, and they hold a document for review when the account holder cannot be found.

Three word lists tell the rules where to look, and all words must be lowercase:

Words that mark the account holder — for example titolare, inhaber, titulaire, account holder.
Words that mark the custodian bank — for example depotbank, custodian, banca depositaria.
Words that mark an issuer — for example emittente, issuer.

If you leave a list untouched, it follows the privacy guard's own updates, which is usually what you want. Be careful when you add a custodian or issuer word: it moves values out of removal, so a wrong word can leave a client name readable.

6. Detection (optional, closed by default)

Leave this section alone unless you have a specific reason.

Detection engine. Only gliner2-pii has its models installed by the app. Another engine downloads its own models on first use, or the redaction fails.
Score threshold. A number between 0 and 1; empty means the default. Higher is not safer. A higher number means fewer values are found, so more can slip through. The editor warns you when you go above the default.

Save, and what happens next

The privacy guard checks your profile while you type. At the bottom of the dialog you see either “No problems found” or the number of problems to fix; each problem is shown next to the field it belongs to. Save profile stays disabled until there are none.

These are the checks that most often block a save:

The profile must remove something. Choose Remove for at least one group, or switch on Remove everything.
Remove everything cannot be combined with a kept group, with role rules, or with smart labeling.
Smart labeling needs at least one label, and every label needs a definition sentence and at least one entity type.
Birth dates cannot be removed while dates are kept readable (see section 2).
The name must be free, and it cannot be full.

After saving, the profile appears in the lists straight away, and the header shows a new Revision number. Documents you have already redacted are not redone: run the redaction again to apply the new rules.

Worked examples

Example 1 — Portfolio review, without the client's identity

You want an analysis of a portfolio statement. The securities must stay readable; the client must not be identifiable.

Name portfolio-review, offered for Documents.
Remove: names, locations, contact, national-ids, birth-dates, other.
Keep readable: instrument-ids, account-ids.
Not looked for: dates — the statement dates are part of the analysis.
Add your own firm under Words never removed.

Result: Unplex sees “[PERSON_1] holds 250 shares of ISIN CH0038863350”, and can still compare, total and quote the positions.

Example 2 — Data extraction from a bank advice

You extract every field of a document into your own system, and only the beneficiary must disappear.

Duplicate beneficiary-only and adapt it, instead of starting from an empty form.
Remove: names, national-ids.
Keep readable: account-ids, instrument-ids, dates.
Not looked for: everything else — the bank's letterhead, its phone number and its reference codes stay exactly as printed.
Switch on Role rules so the custodian bank and the issuers are not removed together with the client.

Example 3 — A readable chat about a case

Under full, a chat message can read like a puzzle: amounts, dates and company names are all replaced. You want a policy that only hides the person.

Duplicate chat-minimal under the name case-chat, offered for Chat.
Remove: names, locations, contact, national-ids, birth-dates, account-ids.
Not looked for: dates, instrument-ids, other.

Result: “Client [PERSON_1] asks whether to sell CH0038863350 before 31.03.2026” — readable, and it names nobody.

Example 4 — Keep the banks readable, remove the client's company

Your documents name many companies. Some are banks and fund houses, one is the client's own firm. A word list cannot separate them, because next month there will be other companies.

Start from chat-minimal-llm or switch on Smart labeling in your own profile.
Add the label financial_institution, applies to Company, decision Keep readable, definition: “A bank, custodian, fund house or securities issuer named because it provides a service or issues a security. Never the client's own company.”
Keep names on Remove in section 2. That is what protects you: a company the model cannot place is removed.

Change, undo or delete a profile

Edit changes the profile for every project on this computer that uses it, from the next redaction or the next message on.
Restore default appears on a built-in profile you have changed. It removes your version and puts the original definition back.
Delete asks for confirmation and tells you how many projects on this computer use the profile. Those projects go back to full, which removes everything — they are never left without protection.
If you remove Documents or Chat from Offer it for while a project uses the profile there, the editor asks before saving, and that project goes back to full.

If something does not work

The Redaction profiles tab asks for the privacy guard. Switch on Local privacy guard in Settings → Privacy and wait for the models to finish downloading.
Save profile stays grey. Read the line at the bottom of the dialog: it counts the problems, and each one is written next to its field.
The profile is missing from a list. Check Offer it for: a documents-only profile is not offered in chat, and the other way round.
Smart labeling seems to do nothing. The on-device model is not installed. Switch on Use an on-device model for smarter labeling in Settings → Privacy.
“Waiting for the current document to finish”. A redaction is running. The save completes on its own when the document is done.
“A file in the profiles folder could not be read”. A profile file written by hand is not valid. The message names the file and the reason; fix or remove that file.
The result is not what you expected. Open ⋯ → Redaction details on the document row to see exactly what was found and what was removed, then adjust the profile.

Still stuck? Contact Unplex support from this Help Center and describe which profile you built and what you expected — we can look at it with you.

How to Set Up an Anonymization Profile