Why AI never sees your customers' names in Effistar

A question we get in almost every demo — usually from the CTO, not the sales manager: "If your AI assistant analyzes our deals, where does our data go?"

It's the right question. AI analysis has to read something to analyze it — and what it reads is your customer book: names, numbers, deal values. You want both things at once: analysis that points at the stalling deal, and a guarantee that your customers' identity never leaves your system.

Why we don't say "encryption"

The easy answer you'll hear elsewhere is "your data is encrypted." That answer confuses two things. Encryption turns text into something unreadable — and a model that can't read can't analyze. Anyone telling you "we encrypt your data before AI, then analyze it" is describing something that doesn't technically hold together.

The correct craft is called tokenization — pseudonymization, the term data-protection law itself uses. The idea: strip the identity out of the text, keep the meaning in.

How it actually works

Before any text leaves our server for the model provider, it passes through a single gate that replaces everything identifying your customer with tokens:

Your rep writes: "Customer Waleed, mobile 0501234567, wants a discount on the 38,000 deal" The provider receives: "Customer {C-1}, mobile {mobile-1}, wants a discount on the {amount: 10–50k} deal" The model replies: "I suggest answering {C-1} with an alternative offer…" Your rep reads: "I suggest answering Waleed with an alternative offer…"

Tokens are resolved back inside your system only. The model analyzed the whole situation — the hesitation, the discount, the amount range — without ever knowing who Waleed is, his number, or the exact figure.

Four levels, your decision

Organizations differ in sensitivity, so we made it a decision, not a template. The default level tokenizes contact data — email, mobile, IBAN, national ID — always, with no measurable effect on analysis quality. A higher level tokenizes all names and turns financial values into ranges. Above both sits a sovereign mode for those whose compliance demands it: whatever cannot be tokenized by nature — binary attachments, audio transcription — is simply never sent, and you're told so with a clear message, never silently.

And what we don't promise

We write this section because absolute privacy promises are a sign of weakness, not strength:

The model does see the substance of the analysis — the note text, the customer's objection, the deal's trajectory — because that is what it analyzes. What it doesn't see is identity. A name mentioned in free text that isn't registered in your system as a contact may pass through, so the practical rule for your team is: whoever gets mentioned, gets registered. And a feature that needs identity by nature — like analyzing a company from the web by its name — works with the name and says so, or is blocked entirely in sovereign mode.

Your reports, dashboards and command center, meanwhile, are deterministic computations that run on your server and send not a single character to any provider — that one we say without qualification.

For the compliance-minded

The data-minimization principle in the Personal Data Protection Law says: nothing leaves for external processing except what that processing requires. That is literally what the gate does, and every AI call is stamped in the usage log with the tokenization level it left under — so when an auditor asks "what went out?", you have a documented answer, not an impression.

The feature is managed from your organization's settings, with the two higher levels part of the sovereign-privacy add-on. And if you'd rather see the tokens with your own eyes than take our word for it, ask during the demo — we'll show you exactly what leaves.