A confidentiality gateway for tax case files: multilingual anonymisation (DE/RU/EN) and a re-identification test bench

Tax advisers are bound by professional secrecy. Large language models that run outside the adviser's office are useful for legal research, but a case file cannot simply be sent to them. I describe a confidentiality gateway that keeps all work on case files local and lets only anonymised questions leave the machine. The gateway has four stages: local anonymisation by rules and named-entity recognition, an outbound check (guard()), an exchange sheet with case-wide masks, and the call to the external model. One person receives one mask throughout a case, in Latin and Cyrillic script. For institutions only the proper name is masked and the type is kept, because the type can decide a tax question. The gateway also removes hidden file content and seals the outbound log with a hash chain. I report measurements on fictitious data only. Leakage on invented letters fell from 28.7 % to 6.0 % and then 2.1 % of identifying data units on different independent sets. For Russian names, missed name parts fell from 35 % to 6 %. On 28 attack types (49 probes; 29 types and 50 probes in the final run), five leaks before a fix fell to one residual. An initial re-identification bench gave 6 of 6 "not identified" against a weak adversary; this is a lower bound. Code is open (AGPL-3.0). Part of a series; overview: https://doi.org/10.5281/zenodo.23949487. Files: English version (authoritative) and German version (Deutsche Fassung). Code: https://github.com/sevriukov/schweigepflicht-gateway-code. Not legal or tax advice.