DocketXDocketX / Docket Scrambler
Send the case, not the client.
Docket Scrambler pseudonymizes a case file on your own hardware before any frontier model sees it (every person, organisation, address, docket, account and identifier replaced by a stable placeholder), sends only the placeholders out, and puts the names back in the answer. The document itself comes back byte-exact. The mapping never leaves your box. Every number on this page comes from a proof run you can re-run.
What it does
Three passes on your hardware, one off it
1. Deterministic first
Social security numbers, phone numbers, emails, dates of birth, docket and cause numbers, bar numbers, Bates ranges, account, policy, VIN and licence numbers, street addresses: replaced by code before any model runs. No model is involved, so none of these is ever missed.
2. A local model proposes, code decides
A model running on your hardware proposes spans: "these characters are a PERSON". It never writes text anyone reads. Every proposal is checked against the input; an invented name, a citation, a placeholder look-alike, or an instruction planted in the document is refused with a recorded reason.
3. One graph per matter
"Robert T. Evans", "Bob", "Mr. Evans", "EVANS" and "Evans's" resolve to one placeholder across every filing in the case, including a filing added months later. Two people who share a surname never merge. Cited cases stay intact, because a citation is public law.
4. The frontier sees placeholders only
The one step that leaves your hardware carries [CLIENT_1], [ORG_2] and the public citations. Every outbound message and every tool argument is swept for every name in the matter first; a tool call that carries one never runs.
5. Byte-exact swap-back
Every substitution is ledgered and sealed with the matter. The document restores to its own bytes. The frontier's answer is rendered the way a lawyer writes: full name first, surname after, so "Mr. [CLIENT_1]" becomes "Mr. Evans". A placeholder the matter never minted is reported, never guessed.
6. Refuse, never leak
A release gate re-checks the output for every accepted name and every identifier pattern. If anything remains, the document does not leave. There is no path that returns text together with a residual.
Measured, not promised
The proof run
One command runs every suite at full scale with no model in the loop and writes a report stamped with the commit. Twelfth run, 2026-09-16: 231 tests, 0 failures.
40 real federal case files
18 million characters of public filings from the Southern District of Texas, with each docket's own party, attorney and judge list as ground truth. With the names known: 0 of 1,989 entities leaked, 6,200 of 6,200 chunks restored byte-exact, 0 filings refused, 1,965 of 1,965 entities on one placeholder across the whole file. A state or the United States as a party is left in place by design: a sovereign is public.
3,000 adversarial filings
A synthetic battery of 167 filings with planted secrets of twelve types, and 1,000 generated filings, each run against a competent model, a hijacked one that proposes every injection trick, and a lazy one: 0 secrets survive outside a cited caption; every release round-trips.
No egress, provably
During the proof the network is replaced by a tripwire: a document is scrambled, restored and answered and not one call is made. The local-model builder refuses any model that is not local. The frontier step cannot even be constructed without an explicit arming flag.
The pipeline is what the proof is about. The local model's own miss rate is a separate measurement we publish alongside it: today about 19 secrets per 1,000 on the synthetic battery, down from 84 two days earlier. That is the number early access is for.
What it cannot promise
Read this before you rely on it
Placeholder substitution is not anonymity: the facts of a matter can identify a client with every name gone, and no scrubber changes that. A local model can miss a name that no deterministic rule catches; the release gate catches what it can and refuses what it cannot, but "zero" is a claim we make only about the pipeline with the names known, never about a model. The frontier model can be attacked by the scrambled document itself; that is a separate gate. Over-scrubbing (a public official, a place, a defined term taken as a name) degrades the analysis and is the safe direction, so it happens. None of this is hidden in the report.
Early access
Run it on your own case files
Early access is a self-hosted endpoint plus the proof run, so you can measure it on your matters before anyone trusts it with a client. Tell us the size of the practice and the kind of files.
Prefer email? info@docketx.ai. The method is written up at anonymize case files before AI.