Why Monday's export and Friday's export disagree about who PERSON_001 is
The Monday/Friday problem
A support lead exports the week's open tickets on Monday and runs the file through a pseudonymization tool before an AI analysis. One frequent customer comes out as PERSON_014. On Friday she exports again — resolved tickets this time — and the same customer comes out as PERSON_003, because the tool assigned numbers from scratch. Each file looks fine on its own. Together they are quietly wrong: a join on the alias column matches nothing, "repeat contacts this week" undercounts, week-over-week comparisons treat one person as two, and the AI's Monday finding about PERSON_014 cannot be checked against Friday's data — and none of it raises an error.
Detection worked in both runs: the tool found the name each time and replaced it each time. The missing piece was state — no record survived from Monday's run to tell Friday's run which aliases were already taken.
This is not a free-versus-paid divide. Some free tools carry state between runs, any script with a saved lookup table can, and a paid tool can just as easily process every file in isolation. Detection itself is widely available: OpenAI's Privacy Filter (April 2026, Apache-2.0) masks eight categories of PII in the browser or on a laptop, and OpenAI describes it as a "redaction aid, not a safety guarantee." For files that recur, the question that separates tools is what happens to the mapping after each run ends.
Four properties a recurring workflow needs
Session-level consistency
Within one file, every occurrence of the same value receives the same alias — deterministic aliasing — so a customer with four tickets stays visibly one customer. Tools built for redacting prose often replace each match with a constant like [REDACTED], which erases the difference between one person appearing four times and four people appearing once. Table-aware tools generally handle this; it is the entry-level property to check.
Cross-file consistency
Monday's file and Friday's file agree on who PERSON_014 is. This requires loading the previous mapping before new aliases are assigned, so known values reuse their aliases and only new values get new numbers. Its absence is what produces the problem above.
Mapping persistence
Cross-file consistency implies that the mapping — the table pairing each original value with its alias — is stored somewhere between runs: a file you keep, browser storage, a database. Persistence solves the consistency problem and opens a custody question: where that mapping lives, and who can open it, matters enough to get its own section below.
Restoration
Restoration closes the round trip, and it is what makes the technique reversible pseudonymization rather than one-way masking. An AI analysis of the aliased copy answers "PERSON_014 has three unresolved tickets," and someone has to translate that back into a real account before anything can be done about it. That translation needs the mapping at hand, which means the workflow has to support an export, analyze, restore path — masking alone leaves the answer stranded.
One screening question comes before any of this: where does the tool process the file? Some scrubbers process on their servers, which means sharing the original before any protection is applied; the offline test and Network-tab check for confirming browser-local processing are documented in How browser-local file processing works—and how to verify it.
The mapping is itself sensitive data
A mapping file is a complete re-identification key. Every row pairs an alias with a real name, email address, or account number, so anyone who holds it can reverse every safe copy ever produced with it using a simple lookup. An aliased export can circulate with some care, but the mapping deserves the same handling as the original file: it carries the file's full sensitivity, concentrated into one small table.
That changes how to judge tools that offer cross-file memory. If a tool provides it by keeping your mapping on the vendor's server, the most sensitive artifact in the whole workflow now sits with a third party, tied to an account login, retained on their schedule and inside their breach surface. Some organizations accept that trade knowingly; it should not happen as an unexamined default. Reasonable handling looks like this: the mapping stays on the machine that produced it, it is encrypted at rest if that machine or its backups are shared, and access to it is treated like access to the original data — because functionally, that is what it grants.
Doing this with free tools or a script
All four properties can be built with tools you may already have. A hidden lookup sheet feeding VLOOKUP formulas gives a spreadsheet workflow cross-file consistency. A short Python script that loads a saved mapping CSV, applies known aliases first, appends new ones, and writes the mapping back covers consistency, persistence, and restoration in well under a hundred lines. Teams with a data engineer do exactly this, and for stable, well-understood files it works.
The costs are in maintenance: the script needs an owner, and owners change jobs. The mapping CSV it reads and writes is plaintext unless someone adds encryption — and a plaintext mapping on a shared drive is precisely the exposure described above. Detection patterns cover new credential formats and name variants only when someone updates them. A changed column layout fails loudly or silently depending on how defensively the script was written. None of this argues against scripts; it is the workload you sign up to own.
Whatever you evaluate — a script, a free scrubber, a paid product — the checkable criteria are the same four: consistent aliases within a file, a mapping you can export and control, restoration, and output that preserves the table's structure.
Do you need a paid tool? A short checklist
Four questions decide it:
- Do the files recur? A weekly export in the same shape makes cross-file consistency matter. A one-time file does not need it, and a small file with the sensitive data in one or two obvious columns rarely needs more than deletion or find-and-replace.
- Do the outputs return to real work? If an AI finding about PERSON_014 has to reach the actual account, you need restoration, and that means a mapping you can use at translation time.
- Must the mapping outlive the session? If yes, decide where it will live and how it is protected before choosing a tool, not after.
- Who else touches the machine? Shared computers and synced folders turn a plaintext mapping into a standing risk; encrypted storage stops being optional.
If your work is genuinely one-off, a simpler method is often the right call; Four ways to remove or pseudonymize PII in a spreadsheet compares the options on the same criteria.
If the files do recur, these are the features to test in Data Alias. Aliases are consistent within each processing session by default, and cross-file consistency comes through the alias vault, which you create explicitly: the mapping is encrypted with a passphrase you choose and kept in your browser's localStorage, where it stays unless you export an encrypted backup, and it is not sent to a server. Restoration takes two forms, both in the browser. The de-alias panel on the result screen translates an AI answer's aliases back to real values using that session's mapping, and the mapping can be downloaded as a CSV that the restore page uses later to turn a safe-copy file itself back into originals. In Data Alias, these properties can be checked using sample data before a mapping is created for real records.
Detection quality is a separate question from workflow fit; whichever tool you shortlist, its automatic detection will have blind spots. What automatic PII detection misses in spreadsheets covers what to review regardless of tool.
However the count comes out, the checklist is the decision. Zero or one yes answers: use the simplest method that handles your columns. Two or more — a recurring cadence, outputs that come back, a mapping that must persist — and the workflow properties are what you are paying for, whether you pay a vendor or pay in the time it takes to maintain a script and guard its mapping file.