tacit-deid
tacit-deid runs inside your own infrastructure. It turns a real consultation transcript into a
de-identified clinical timeline plus a minimal demographic shell (an age band and sex), seals the
result as one typed BoundaryArtifact, and sends that artifact to Tacit. Tacit stores it, and on
your request turns it into a scenario and regenerates a synthetic consultation. The real
transcript, the audio, and your case identifier never leave your boundary.
The package imports no Tacit platform code. One command runs the pipeline; one function does the
same as a library.
The one invariant
The model targets, code transforms, and code verifies before anything is redacted. No model output is trusted as a rewrite. A model may only propose spans; a verified matcher must find each span verbatim in the text before it becomes a token. A black-box detector, a judge, or a sanitizer model cannot leak by omission or by paraphrase, because none of them ever writes the output. When the pipeline cannot clean a transcript within its round cap, or the demographic shell is too rare to hide in, it refuses. Nothing crosses for that record.What crosses
There is no field that can hold the transcript, a name, a date, or the case id. The contract is
strict: an unknown field is a validation error.
Quickstart
Install, configure, check an input, run it, send it.
Feeding it transcripts
Six input formats, the keep list, batches, and the preflight.
How it works
Tokenize, judge to a fixpoint, fill, extract, clean, seal.
Security
The trust boundary, the one LLM seam, files at rest, stated limits.