A notary's duty of secrecy has no exception and no balancing test. So we did not build an assistant that is careful with client data; we built one that is never given it in the first place.
This page explains, without jargon, what aiNotaris can and cannot reach, what happens when something goes wrong, and where the notary stays in charge. If you would rather have the technical version for your IT adviser, we publish that too.
The four guarantees
Names
Before a question reaches the AI model, every name, address, postcode, BSN, IBAN and telephone number is replaced by an invented stand-in. The model reasons about the stand-in and answers about the stand-in.
Key
The list that maps a stand-in back to a real person stays inside your own environment and is never sent anywhere. The answer is translated back to real names on the way to your screen, after the AI has finished.
Reach
It cannot open, browse or search your systems. It can only submit one of a fixed set of named requests, each checked against who you are and which files you are allowed to open.
Failure
If the protection layer cannot confirm a question is clean, the question is not sent at all. There is no fallback that quietly forwards the original text.
This is the part most people expect to be different. An AI assistant is often imagined as something that roams a firm's files and reads whatever it likes. That is not how this is built, and it is not something you have to take on trust: it follows from the architecture.
The assistant sits behind a gate. On the far side of that gate are your files, your mailbox, your documents and the official registers. The assistant has no connection of any kind to them. What it has instead is a short, fixed list of request forms, which we call tools. Each one does a single, defined job, and every request is checked before it runs.
You and the assistant
You type a question. The assistant works out what you are asking for, with all real names already replaced by stand-ins.
The gate: named tools only
listTasksForDossieropen items on one filesearchLegalKnowledgethe legal librarydraftEmailReplyproposes a replylookupCuratelethe official court registercreateReminderproposes a taskYour office systems
Files, e-mail, documents, calendar and the official registers, reached only by an automation that has just been authorised, and only for the one item requested.
There is no path from the assistant to the database. It cannot write a query, cannot list what exists, and cannot reach a file nobody asked it about.
The practical effect: the worst an unexpected instruction can do is trigger a tool the user was already allowed to trigger, on a file they were already allowed to open, and leave a record of having done so.
Step by step
A single question, from the moment you press enter to the moment you read the answer.
You ask something: for example, what still has to happen before a transfer can be signed.
Identities are removed. Names, addresses, BSN and account numbers are found and replaced with stand-ins. The mapping is held in your environment only.
The check runs. If that step could not be completed for any reason, everything halts here and you are told the assistant is briefly unavailable. Nothing is sent.
The AI model reasons about a file belonging to people it cannot identify, and decides which tools it needs.
The gate checks each request against your sign-in, your office and your role, then runs the automation and returns only what was asked for.
Real names are restored on the way back to your screen, and the exchange is written to the audit trail.
Most systems, when a safety check fails, carry on and write a line in a log file. We took the opposite decision, and it is the one we would most want a supervisory body to examine.
If the assistant cannot prove a question is free of client identities, that question is not sent. Not by another route, not in its original form, not at all.
In practice this means that on the rare occasion the identity-removal service is unreachable, AI features pause for a few minutes and say so. We consider a visible interruption entirely preferable to an invisible disclosure: an interruption you can wait out, a disclosure you cannot take back.
Who decides
Nothing that touches the outside world happens on its own. Sending an e-mail, changing a file, booking an appointment, creating a task: each is shown to you first as a proposal, with the wording and the consequences visible, and only proceeds when you confirm it.
This is deliberate, and it reflects the obvious: the deed is the notary's. Responsibility for what is read, explained and executed cannot be delegated to software, and we have not built anything that invites you to try. Every AI-assisted action is recorded, including what was proposed, what was approved, by whom and when, so the file can be reconstructed later.
Reviewing aiNotaris for your office and need to satisfy your own adviser, the KNB or the BFT? Ask us for the technical security description and the data-protection documentation. We would rather you interrogate it than take our word for it.