Context
Commercial APIs advertise 48+ languages and up to 285 entity types, shallowly. Chasing that breadth is the incumbents' game and produces exactly the unverifiable claims a small project should refuse to make. The defensible position for a local-first library is the opposite: fewer identifiers, each with checksums, honest per-identifier tests, and documented failure modes.
The tailwind is regulatory but the product is engineering: EDPB Guidelines 01/2025 on Pseudonymisation (and the 02/2026 anonymisation draft) make pseudonymization a named, auditable control, and EU data-residency pressure favors tools where nothing leaves the process. Users who answer to a DPO need identifiers that are provably detected, not a long marketing list.
Proposal
Building on the Italian pack (codice fiscale, partita IVA, #44), a staged EU identifier pack, each with checksum/structure validation where the identifier has one, and per-identifier precision tests on realistic surrounding text:
- Italy: complete the set (SSN/health card variants, targa where policy-relevant).
- High-value EU: Spanish DNI/NIE/NIF, French NIR (INSEE) + SIREN/SIRET, German Steuer-ID, Dutch BSN, Polish PESEL/NIP, EU VAT number family (checksum per country).
- Cross-cutting: European health insurance card numbers, EU driving licence format.
Each detector ships with: validation logic (not just a regex), true/false-positive tests in prose context (the #59 standard), and a documented mapping to the relevant entity type.
A short docs page can map the library's mechanisms (deterministic aliases, namespace isolation, safe reports) to the EDPB pseudonymisation vocabulary as an engineering reference. Explicitly not a compliance product or legal guidance; the boundary in the vision's non-goals stays.
Why depth wins
A verified regional pack beats 285 shallow types for the users who must actually defend their pipeline: checksummed detectors have near-zero false positives, so they can run at full confidence in the default policy without the corpus-tuned heuristics problem (#59).
🤖 Generated with Claude Code
https://claude.ai/code/session_012JiX3zWeEC28kmy5KmAXvf
Context
Commercial APIs advertise 48+ languages and up to 285 entity types, shallowly. Chasing that breadth is the incumbents' game and produces exactly the unverifiable claims a small project should refuse to make. The defensible position for a local-first library is the opposite: fewer identifiers, each with checksums, honest per-identifier tests, and documented failure modes.
The tailwind is regulatory but the product is engineering: EDPB Guidelines 01/2025 on Pseudonymisation (and the 02/2026 anonymisation draft) make pseudonymization a named, auditable control, and EU data-residency pressure favors tools where nothing leaves the process. Users who answer to a DPO need identifiers that are provably detected, not a long marketing list.
Proposal
Building on the Italian pack (codice fiscale, partita IVA, #44), a staged EU identifier pack, each with checksum/structure validation where the identifier has one, and per-identifier precision tests on realistic surrounding text:
Each detector ships with: validation logic (not just a regex), true/false-positive tests in prose context (the #59 standard), and a documented mapping to the relevant entity type.
A short docs page can map the library's mechanisms (deterministic aliases, namespace isolation, safe reports) to the EDPB pseudonymisation vocabulary as an engineering reference. Explicitly not a compliance product or legal guidance; the boundary in the vision's non-goals stays.
Why depth wins
A verified regional pack beats 285 shallow types for the users who must actually defend their pipeline: checksummed detectors have near-zero false positives, so they can run at full confidence in the default policy without the corpus-tuned heuristics problem (#59).
🤖 Generated with Claude Code
https://claude.ai/code/session_012JiX3zWeEC28kmy5KmAXvf