Yeco-PII security audit: what we fixed and what we're improving

First, a clarification: some of the most serious flaws found in the audit, including the one where detection stopped redacting data after 512 tokens, were not a defect of the model. They were a bug in the console that hosts the model, which did not split long text into chunks correctly. The on-premises model delivered to banks and business customers already included this chunking mechanism and was not affected by the problem.

We want to thank Ing. Ezio Amodio, CISSP, with over 20 years of experience in cybersecurity. He carried out a free, independent security audit of the personal data detection service in Yeco-PII for us.

The audit found several vulnerabilities. We analysed each one carefully and fixed it. All critical and high-severity issues are resolved.

Status of the fixes

• Fixed: long documents. Every part of a document is now analysed.
• Fixed: data hidden by spaces or invisible characters is now detected.
• Fixed: IBANs are recognised regardless of how they are written.
• Fixed: identifiers hidden behind labels or frames, such as VAT numbers, tax codes and card numbers, are now checked with official validation rules.
• Fixed: tax codes and birth dates written out in words, including years.
• Improving: names inside some structured formats, such as HTML, JSON and tables.
• Improving: how the service handles parameters and responses.

What's next

We are still working on the two items marked as improving. We will update this page when they are complete.

Thank you

External security reviews are a key part of how we protect our customers' data. Thank you again to Ing. Amodio. For questions or security reports, contact [email protected].